theonedev/onedev · error · UnauthorizedException

No permission to schedule issue. Remove iterationIds if you

Error message

No permission to schedule issue. Remove iterationIds if you want to create issue without scheduling it.

What it means

POST /issues (createIssue) throws UnauthorizedException when the request data schedules the issue onto iterations (iterationIds is non-empty) but the authenticated user lacks the 'Schedule Issues' permission on the target project (SecurityUtils.canScheduleIssues). The message tells callers to omit iterationIds to create an unscheduled issue instead.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/IssueResource.java:318

	@SuppressWarnings("unused")
	private static List<Map<String, Object>> getIssuesExample() {
		var issues = new ArrayList<Map<String, Object>>();
		issues.add(ApiHelpUtils.getExampleMap(Issue.class, ValueInfo.Origin.READ_BODY));
		return issues;
	}

	@Api(order=1000)
    @POST
    public Long createIssue(@NotNull @Valid IssueOpenData data) {
		var subject = SecurityUtils.getSubject();
    	var user = SecurityUtils.getUser(subject);
    	
    	Project project = projectService.load(data.getProjectId());
    	if (!SecurityUtils.canAccessProject(project))
			throw new UnauthorizedException();

		if (data.getIterationIds() != null && !data.getIterationIds().isEmpty() && !SecurityUtils.canScheduleIssues(project))
			throw new UnauthorizedException("No permission to schedule issue. Remove iterationIds if you want to create issue without scheduling it.");

		if (data.getOwnEstimatedTime() != null) {
 			if (!subscriptionService.isSubscriptionActive())			
				throw new NotAcceptableException("An active subscription is required for this feature");
			if (!project.isTimeTracking())
				throw new NotAcceptableException("Time tracking needs to be enabled for the project");
			if (!SecurityUtils.canScheduleIssues(project))
				throw new UnauthorizedException("Issue schedule permission required to set own estimated time. Remove ownEstimatedTime if you want to create issue without setting own estimated time.");
		}

		var issueSetting = settingService.getIssueSetting();
		
		Issue issue = new Issue();
		issue.setTitle(data.getTitle());
		issue.setDescription(data.getDescription());
		issue.setConfidential(data.isConfidential());
		issue.setProject(project);
		issue.setSubmitDate(new Date());

View on GitHub (pinned to d44925c47c)

Solutions

Grant your user the 'Schedule Issues' permission on the target project.
Remove iterationIds from the request body to create the issue unscheduled, then assign it later via the UI.
Use a token of a user who can schedule issues in that project (e.g. project maintainer).
Split the call: create without iterationIds and set the schedule as an admin afterwards.

Example fix

// before
POST /~api/issues {"projectId":1, "title":"x", "iterationIds":[5]}
// after (no schedule permission)
POST /~api/issues {"projectId":1, "title":"x"}

Defensive patterns

Strategy: validation

Validate before calling

// omit iterationIds unless the user can schedule issues in the project
if (iterationIds != null && !iterationIds.isEmpty() && !securityUtils.canScheduleIssues(project))
    iterationIds = null; // create unscheduled

Try / catch

try { client.createIssue(data); }
catch (UnauthorizedException e) {
    if (e.getMessage().contains("Remove iterationIds")) { data.setIterationIds(null); client.createIssue(data); }
}

Prevention

Only include iterationIds in payloads when the token user has schedule permission.
Grant 'Schedule Issues' to integration accounts that do sprint planning.
Build payloads conditionally based on detected permissions, not statically.

When it happens

Trigger: POST /~api/issues with body containing iterationIds while the token's user cannot schedule issues in data.getProjectId()'s project — even if they can access the project and create issues generally.

Common situations: Automation that copies iteration assignments from another tracker with a token whose user only has 'Create Issues' permission; sprint-planning integrations pointing at projects where the service user wasn't granted scheduling rights.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/43884f2f91b55709. Report an issue: GitHub.