theonedev/onedev · error · UnauthenticatedException

Not authenticated

Error message

Not authenticated

What it means

Thrown by UserResource.getUserId when the request carries no authenticated user at all. Unlike other user endpoints, resolving a login name to an id only requires authentication (any user), but anonymous calls are rejected with UnauthenticatedException ('Not authenticated').

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java:344

	
	@Api(order=1800)
	@GET
    public List<UserData> queryUsers(
    		@QueryParam("term") @Api(description="Any string in login name, full name or email address") String term, 
    		@QueryParam("offset") @Api(example="0") int offset, 
    		@QueryParam("count") @Api(example="100") int count) {
		if (!SecurityUtils.isAdministrator())
			throw new UnauthorizedException();

    	return userService.query(term, offset, count).stream().map(this::getData).collect(toList());
    }
	
	@Api(order=1850)
	@Path("/ids/{name}")
	@GET
	public Long getUserId(@PathParam("name") @Api(description = "Login name of user") String name) {
		if (SecurityUtils.getAuthUser() == null)
			throw new UnauthenticatedException();

		var user = userService.findByName(name);
		if (user != null)
			return user.getId();
		else 
			throw new NotFoundException();
	}
	
	@Api(order=1900, description="Create new user")
    @POST
    public Long createUser(@NotNull @Valid UserCreateData data) {
		if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();

		if (userService.findByName(data.getName()) != null)
			throw new NotAcceptableException("Login name is already used by another user");
		if (data.getType() == ORDINARY && emailAddressService.findByValue(data.getEmailAddress()) != null)
			throw new NotAcceptableException("Email address is already used by another user");

View on GitHub (pinned to d44925c47c)

Solutions

1. Add valid authentication to the request (access token or basic auth).
2. Regenerate the access token if it expired or was revoked.
3. Verify credentials with a cheap authenticated call before this one.
4. Check that the REST server URL targets the authenticated context, not an anonymous proxy.

Example fix

// before
curl http://onedev/api/rest/users/ids/alice
// after
curl -H "Authorization: Bearer <access-token>" http://onedev/api/rest/users/ids/alice

if (accessToken == null || accessToken.isBlank())
    throw new IllegalStateException("Access token required for /users/ids endpoint");

try { return client.getUserId(name); }
catch (NotAuthorizedException e) { throw new NotAuthenticatedException("Supply a valid access token"); }
catch (NotFoundException e) { return null; }

When it happens

Trigger: GET /rest/users/ids/{name} without Authorization header/session cookie, or with invalid/expired credentials so SecurityUtils.getAuthUser() returns null.

Common situations: Missing REST access token; token expired or revoked; calling the endpoint from an anonymous script or curl without -u/--header.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthenticated
• Not authenticated
• "Please login to perform this query"
• Authentication required
• Multiple users found: ${userName}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/604245163248bd7b. Report an issue: GitHub.