theonedev/onedev · error · ExplicitException

Cannot create access token for disabled user

Error message

Cannot create access token for disabled user

What it means

createToken throws ExplicitException when the owner specified for the new access token is a disabled user account. Disabled accounts must not receive new credentials, so the endpoint rejects token creation even if the caller is an admin or the owner themselves.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenResource.java:76

	@Api(order=150)
	@Path("/{accessTokenId}/authorizations")
	@GET
	public Collection<AccessTokenAuthorization> getAuthorizations(@PathParam("accessTokenId") Long accessTokenId) {
		var accessToken = accessTokenService.load(accessTokenId);
		if (!isAdministrator() && !accessToken.getOwner().equals(getAuthUser()))
			throw new UnauthorizedException();
		return accessToken.getAuthorizations();
	}
	
	@Api(order=200, description="Create access token")
	@POST
	public Long createToken(@NotNull @Valid AccessToken accessToken) {
		var owner = accessToken.getOwner();
		if (!isAdministrator() && !owner.equals(getAuthUser()))
			throw new UnauthorizedException();
		else if (owner.isDisabled())
			throw new ExplicitException("Cannot create access token for disabled user");
		
		if (accessTokenService.findByOwnerAndName(owner, accessToken.getName()) != null)
			throw new ExplicitException("Name already used by another access token of the owner");
			
		accessTokenService.createOrUpdate(accessToken);

		if (!getAuthUser().equals(owner)) {
			var newAuditContent = VersionedXmlDoc.fromBean(accessToken.getFacade()).toXML();
			auditService.audit(null, "created access token \"" + accessToken.getName() + "\" in account \"" + owner.getName() + "\" via RESTful API", 
					null, newAuditContent);
		}

		return accessToken.getId();
	}

	@Api(order=250, description="Update access token")
	@Path("/{accessTokenId}")
	@POST

View on GitHub (pinned to d44925c47c)

Solutions

1. Re-enable the user account (Admin > Users) if the account should be active, then retry.
2. Create the token under a different, active user/service account.
3. Remove the disabled user from the provisioning configuration.
4. If the user was offboarded, stop attempting to create credentials for them.

Example fix

// before: owner 'alice' is disabled
POST /~access-tokens  {"owner": {"name": "alice"}, ...}  -> ExplicitException
// after: reactivate alice in Admin > Users, or use an active account
POST /~access-tokens  {"owner": {"name": "alice-active"}, ...}

const user = await getUser(ownerName);
if (user.disabled) {
  throw new Error(`User ${ownerName} is disabled; cannot create access token`);
}

function isEligibleOwner(user: { name: string; disabled: boolean }): boolean {
  return !user.disabled;
}

try {
  await createToken(payload);
} catch (e) {
  if (/disabled user/.test(String(e.response?.data?.message ?? e.message))) {
    // reactivate account or pick an active owner
  } else throw e;
}

When it happens

Trigger: POST /~access-tokens (AccessTokenResource.createToken) where owner.isDisabled() returns true — the target user account has been deactivated in OneDev.

Common situations: Provisioning pipelines still referencing offboarded employees' accounts; users deactivated due to license limits or LDAP sync; bulk scripts that don't check account status before minting tokens.

Related errors

• Not authorized
• Access token owner should have permission to manage authoriz
• Not authorized
• Name already used by another access token of the owner
• Unauthenticated

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/a8d3a69bd210f9fa. Report an issue: GitHub.