theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

getToken in AgentTokenResource loads an agent token record by id and is restricted to server administrators. Non-admin authenticated users receive UnauthorizedException ('Not authorized'). Agent tokens are secrets used to register agents, hence admin-only.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/AgentTokenResource.java:56

	private final AgentTokenService tokenService;
	
	private final AgentService agentService;
	
	private final AuditService auditService;
	
	@Inject
	public AgentTokenResource(AgentTokenService tokenService, AgentService agentService, AuditService auditService) {
		this.tokenService = tokenService;
		this.agentService = agentService;
		this.auditService = auditService;
	}

	@Api(order=100)
	@Path("/{tokenId}")
    @GET
    public AgentToken getToken(@PathParam("tokenId") Long tokenId) {
    	if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();
    	return tokenService.load(tokenId);
    }

	@Api(order=100, description="Get agent using specified token")
	@Path("/{tokenId}/agent")
    @GET
    public Agent getAgent(@PathParam("tokenId") Long tokenId) {
    	if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();
		AgentToken token = tokenService.load(tokenId);
    	return agentService.findByToken(token);
    }
	
	@Api(order=200)
	@GET
    public List<AgentToken> queryTokens(@QueryParam("value") String value, 
    		@QueryParam("offset") @Api(example="0") int offset, 
    		@QueryParam("count") @Api(example="100") int count) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Use a server administrator token
2. Grant the caller server administrator role
3. Create/manage agent tokens from the administration web UI instead

Example fix

// before
GET /~api/agent-tokens/3  (regular user token)
// after
GET /~api/agent-tokens/3  (Authorization: Bearer <admin-token>)

if (!serverAdmin) throw new IllegalStateException("Fetching agent tokens requires server administrator");

try { AgentToken t = client.getAgentToken(id); } catch (ForbiddenException e) { log.warn("Admin token required"); }

When it happens

Trigger: GET /~api/agent-tokens/{tokenId} with credentials of a non-administrator user.

Common situations: Auditing agent registration tokens with a regular user token; automated scripts whose account lost admin role after a permissions cleanup.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized
• No permission to access build: ${referenceString}
• Count should not be greater than
• Unauthorized
• Unauthorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/cb7c005d428d3694. Report an issue: GitHub.