theonedev/onedev · error · NotAcceptableException

Cannot set email address for disabled user

Error message

Cannot set email address for disabled user

What it means

The API refuses to create an email address for a disabled user account. Disabled users cannot receive mail or sign in, so attaching an email address to them is rejected with NotAcceptableException. This check applies regardless of whether the caller is an administrator.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/EmailAddressResource.java:77

	
	@Api(order=150)
	@Path("/{emailAddressId}/verified")
	@GET
	public boolean isEmailAddressVerified(@PathParam("emailAddressId") Long emailAddressId) {
		EmailAddress emailAddress = emailAddressService.load(emailAddressId);
    	if (!SecurityUtils.isAdministrator() && !emailAddress.getOwner().equals(getAuthUser())) 
			throw new UnauthorizedException();
    	return emailAddress.isVerified();
	}
	
	@Api(order=200, description="Create new email address")
	@POST
	public Long createEmailAddress(@NotNull @Valid EmailAddress emailAddress) {
		var owner = emailAddress.getOwner();
		if (!SecurityUtils.isAdministrator() && !owner.equals(getAuthUser()))
			throw new UnauthorizedException();
		else if (owner.isDisabled())
			throw new NotAcceptableException("Cannot set email address for disabled user");
		else if (owner.getType() != User.Type.ORDINARY)
			throw new NotAcceptableException("Cannot set email address for service or ai user");
		else if (User.getLoginName(emailAddress.getValue()) != null)
			throw new NotAcceptableException("Email address with noreply domain is not allowed");
		else if (emailAddressService.findByValue(emailAddress.getValue()) != null)
			throw new NotAcceptableException("This email address is already used by another user");
		
		if (SecurityUtils.isAdministrator()) 
			emailAddress.setVerificationCode(null);
		
		emailAddressService.create(emailAddress);

		if (!getAuthUser().equals(owner)) 
			auditService.audit(null, "added email address \"" + emailAddress.getValue() + "\" in account \"" + owner.getName() + "\" via RESTful API", null, null);
		return emailAddress.getId();
	}
	
	@Api(order=250, description="Set as primary email address")

View on GitHub (pinned to d44925c47c)

Solutions

1. Re-enable the target user account before creating the email address
2. Skip disabled accounts in provisioning scripts
3. Pick a different active user as the owner

Example fix

// before
if (owner.isDisabled()) createAddress(owner);
// after
if (!owner.isDisabled()) createAddress(owner); else reEnableUser(owner);

if (owner.isDisabled()) skip or re-enable user before create;

boolean canAssign = owner != null && !owner.isDisabled();

try { createEmailAddress(ea); } catch (NotAcceptableException e) { /* disabled user: re-enable or skip */ }

When it happens

Trigger: POST an EmailAddress whose owner.isDisabled() returns true, even when called by an administrator.

Common situations: Provisioning automation re-enabling/assigning addresses to deactivated (e.g. off-boarded) accounts; importing user data where accounts were disabled; race where user is disabled between validation and call.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• Reviewer not found:
• Assignee not found:
• Not authenticated
• Unauthorized
• Unauthorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/2dc985a01ac476b9. Report an issue: GitHub.