theonedev/onedev · error · NotAcceptableException

Count should not be greater than ${MAX_PAGE_SIZE}

Error message

Count should not be greater than ${MAX_PAGE_SIZE}

What it means

queryPacks limits the 'count' query parameter to RestConstants.MAX_PAGE_SIZE for everyone except administrators. Requesting a larger page size throws NotAcceptableException with 'Count should not be greater than <MAX_PAGE_SIZE>'. This protects the server from oversized result pages.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/PackResource.java:90

	@Api(order=300)
	@Path("/{packId}/blobs")
    @GET
    public Collection<PackBlob> getBlobs(@PathParam("packId") Long packId) {
		Pack pack = packService.load(packId);
    	if (!SecurityUtils.canReadPack(pack.getProject())) 
			throw new UnauthorizedException();
    	return pack.getBlobReferences().stream().map(PackBlobReference::getPackBlob).collect(toList());
    }
	
	@Api(order=600)
	@GET
    public List<Pack> queryPacks(
    		@QueryParam("query") @Api(description="Syntax of this query is the same as in <a href='/~packages'>packages page</a>", example="\"Type\" is \"Container Image\"") String query, 
    		@QueryParam("offset") @Api(example="0") int offset, 
    		@QueryParam("count") @Api(example="100") int count) {
		var subject = SecurityUtils.getSubject();
		if (!SecurityUtils.isAdministrator(subject) && count > RestConstants.MAX_PAGE_SIZE)
    		throw new NotAcceptableException("Count should not be greater than " + RestConstants.MAX_PAGE_SIZE);

		var parsedQuery = PackQuery.parse(null, query, true);
    	
    	return packService.query(subject, null, parsedQuery, false, offset, count);
    }
	
	@Api(order=700)
	@Path("/{packId}")
    @DELETE
    public Response deletePack(@PathParam("packId") Long packId) {
    	Pack pack = packService.load(packId);
    	if (!SecurityUtils.canWritePack(pack.getProject()))
			throw new UnauthorizedException();
    	packService.delete(pack);
		var oldAuditContent = VersionedXmlDoc.fromBean(pack).toXML();
		auditService.audit(pack.getProject(), "deleted package \"" + pack.getReference(false) + "\" via RESTful API", oldAuditContent, null);
    	return Response.ok().build();
    }

View on GitHub (pinned to d44925c47c)

Solutions

  1. Reduce the count parameter to MAX_PAGE_SIZE or less (e.g. count=100).
  2. Paginate with offset increments until all results are retrieved.
  3. If truly needed, perform the call as an administrator account (admins bypass the cap).
  4. Read the error message for the exact allowed maximum.

Example fix

// before
curl "http://server/~api/packs?count=1000"
// after
curl "http://server/~api/packs?offset=0&count=100"
curl "http://server/~api/packs?offset=100&count=100"
Defensive patterns

Strategy: validation

Validate before calling

int MAX_PAGE_SIZE = 100; // RestConstants.MAX_PAGE_SIZE
int safeCount = Math.min(requestedCount, MAX_PAGE_SIZE);
if (requestedCount > MAX_PAGE_SIZE && !SecurityUtils.isAdministrator(SecurityUtils.getSubject()))
    requestedCount = MAX_PAGE_SIZE;

Type guard

boolean validCount = (requestedCount >= 0 && requestedCount <= 100) || SecurityUtils.isAdministrator(SecurityUtils.getSubject());

Try / catch

try { page = client.queryPacks(query, offset, count); } catch (NotAcceptableException e) { page = client.queryPacks(query, offset, 100); }

Prevention

When it happens

Trigger: GET /~api/packs?count=1000 (count > MAX_PAGE_SIZE) by a non-administrator subject. Default MAX_PAGE_SIZE is small (typically 100).

Common situations: Client tries to fetch all packages in one call; generic REST client defaults count to a large number; pagination loop written without respecting server page-size cap.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors


AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/8f0fbb6cc5860f59. Report an issue: GitHub.