theonedev/onedev · error · UnauthorizedException

No permission to access specified issues

Error message

No permission to access specified issues

What it means

POST /issueLinks (createLink) throws UnauthorizedException("No permission to access specified issues") when the caller cannot access either the source or the target issue of the link. canAccessIssue() checks that the authenticated user can read the issue's project and that the issue is not confidential to them. OneDev requires visibility of both ends before linking issues.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/IssueLinkResource.java:52

	public IssueLinkResource(IssueLinkService linkService) {
		this.linkService = linkService;
	}

	@Api(order=100)
	@Path("/{linkId}")
	@GET
	public IssueLink getLink(@PathParam("linkId") Long linkId) {
		var link = linkService.load(linkId);
		if (!canAccessIssue(link.getTarget()) && !canAccessIssue(link.getSource()))
			throw new UnauthorizedException();
		return link;
	}
	
	@Api(order=200, description="Create new issue link")
	@POST
	public Long createLink(@NotNull IssueLink link) {
		if (!canAccessIssue(link.getSource()) || !canAccessIssue(link.getTarget()))
			throw new UnauthorizedException("No permission to access specified issues");
		if (!canEditIssueLink(link.getSource().getProject(), link.getSpec())
				|| !canEditIssueLink(link.getTarget().getProject(), link.getSpec())) {
			throw new UnauthorizedException("No permission to add specified link for specified issues");

		}
		link.validate();
						
		linkService.create(link);
		return link.getId();
	}
	
	@Api(order=300)
	@Path("/{linkId}")
	@DELETE
	public Response deleteLink(@PathParam("linkId") Long linkId) {
		var link = linkService.load(linkId);
		if (!canEditIssueLink(link.getSource().getProject(), link.getSpec()) 
				&& !canEditIssueLink(link.getTarget().getProject(), link.getSpec())) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Confirm both issue ids exist and are in projects your token can read (GET each issue first).
2. Use a token with access to both projects involved.
3. If the target is confidential, either use the reporter's token or make the issue non-confidential.
4. Adjust your account's project membership to include the inaccessible project.

Example fix

// before
client.createIssueLink(new IssueLink().source(srcIssue).target(dstIssue));
// after: pre-check access
if (!canRead(srcIssue) || !canRead(dstIssue))
    throw new IllegalArgumentException("token cannot access both issues");
client.createIssueLink(new IssueLink().source(srcIssue).target(dstIssue));

// both issues must be readable by the token user before linking
for (var issue : List.of(sourceId, targetId)) {
    var loaded = client.getIssue(issue); // throws if inaccessible
    if (loaded == null) throw new IllegalStateException("issue " + issue + " not accessible");
}

try { client.createIssueLink(link); }
catch (UnauthorizedException e) {
    if (e.getMessage().contains("access specified issues")) log.warn("Check visibility/confidentiality of issues {} -> {}", sourceId, targetId);
}

When it happens

Trigger: POST /~api/issueLinks with a link whose source or target issue (a) belongs to a project the user cannot access, or (b) is confidential and the user is not the reporter/a user who can access confidential issues.

Common situations: Linking an issue in a private project with an issue in a public one using a limited token; linking to a confidential issue reported by someone else; project visibility changed after the script was written; stale issue ids from another environment.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to add specified link for specified issues
• No permission to schedule issue. Remove iterationIds if you
• Issue schedule permission required to set iterations
• No permission to access issue:
• No permission to access build: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/85b744e16ae3456c. Report an issue: GitHub.