theonedev/onedev · error · UnauthorizedException

No permission to add specified link for specified issues

Error message

No permission to add specified link for specified issues

What it means

createLink separately checks that the user has permission to edit issue links (canEditIssueLink) on both the source and target issue's projects for the given link spec. If either check fails it throws UnauthorizedException("No permission to add specified link for specified issues"). Access to the issues alone is not enough: editing links requires the project's 'Edit Issue Links' permission or link-spec authorization.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/IssueLinkResource.java:55

	@Api(order=100)
	@Path("/{linkId}")
	@GET
	public IssueLink getLink(@PathParam("linkId") Long linkId) {
		var link = linkService.load(linkId);
		if (!canAccessIssue(link.getTarget()) && !canAccessIssue(link.getSource()))
			throw new UnauthorizedException();
		return link;
	}
	
	@Api(order=200, description="Create new issue link")
	@POST
	public Long createLink(@NotNull IssueLink link) {
		if (!canAccessIssue(link.getSource()) || !canAccessIssue(link.getTarget()))
			throw new UnauthorizedException("No permission to access specified issues");
		if (!canEditIssueLink(link.getSource().getProject(), link.getSpec())
				|| !canEditIssueLink(link.getTarget().getProject(), link.getSpec())) {
			throw new UnauthorizedException("No permission to add specified link for specified issues");

		}
		link.validate();
						
		linkService.create(link);
		return link.getId();
	}
	
	@Api(order=300)
	@Path("/{linkId}")
	@DELETE
	public Response deleteLink(@PathParam("linkId") Long linkId) {
		var link = linkService.load(linkId);
		if (!canEditIssueLink(link.getSource().getProject(), link.getSpec()) 
				&& !canEditIssueLink(link.getTarget().getProject(), link.getSpec())) {
			throw new UnauthorizedException();
		}
		linkService.delete(link);

View on GitHub (pinned to d44925c47c)

Solutions

1. Ask a project admin to grant your account the permission to edit issue links on both projects.
2. Create the link via the web UI as a user who has the permission.
3. Use an admin token for automation that links issues across projects.
4. Check the link spec's permitted operations — some link types restrict who can create them.

// require edit-issue-links permission on both projects
if (!canEditIssueLink(sourceProject, spec) || !canEditIssueLink(targetProject, spec))
    throw new IllegalStateException("token lacks edit-issue-links permission on both projects");

try { client.createIssueLink(link); }
catch (UnauthorizedException e) { throw new SecurityException("Ask admin for 'edit issue links' permission on " + sourceProject + " and " + targetProject, e); }

When it happens

Trigger: POST /~api/issueLinks where both issues are readable but the authenticated user lacks the edit-issue-links permission on source.getProject() or target.getProject(), or the link spec restricts which projects/roles may create links of that type.

Common situations: Reporter-level users trying to link issues across projects they can only read; link specification (e.g. 'is duplicated by') restricted to certain roles; cross-project links where the user has manage rights on one project but not the other.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Issue schedule permission required to set iterations
• No permission to access issue:
• No permission to access specified issues
• No permission to schedule issue. Remove iterationIds if you
• Issue schedule permission required to set own estimated time

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/9d1003f9e107b311. Report an issue: GitHub.