theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

Authorization guard in SshKeyResource.deleteKey: the authenticated user is not an administrator and does not own the target SSH key, so deleting another account's key is forbidden; UnauthorizedException is thrown. Fix: delete only keys owned by the authenticated user, or use an administrator account.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/SshKeyResource.java:77

		
		sshKey.setCreatedAt(new Date());
    	sshKey.generateFingerprint();
    	
    	sshKeyService.create(sshKey);
		if (!getAuthUser().equals(sshKey.getOwner())) {
			var newAuditContent = VersionedXmlDoc.fromBean(sshKey).toXML();
			auditService.audit(null, "created ssh key in account \"" + sshKey.getOwner().getName() + "\" via RESTful API", null, newAuditContent);
		}
    	return sshKey.getId();
	}
	
	@Api(order=200)
	@Path("/{sshKeyId}")
	@DELETE
	public Response deleteKey(@PathParam("sshKeyId") Long sshKeyId) {
		SshKey sshKey = sshKeyService.load(sshKeyId);
    	if (!SecurityUtils.isAdministrator() && !sshKey.getOwner().equals(getAuthUser())) 
			throw new UnauthorizedException();
		sshKeyService.delete(sshKey);
		if (!getAuthUser().equals(sshKey.getOwner())) {
			var oldAuditContent = VersionedXmlDoc.fromBean(sshKey).toXML();
			auditService.audit(null, "deleted ssh key from account \"" + sshKey.getOwner().getName() + "\" via RESTful API", oldAuditContent, null);
		}
		return Response.ok().build();
	}
	
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate as the key's owner
2. Use an administrator account to delete other users' keys
3. Verify the sshKeyId belongs to the authenticated user before deleting

// ensure authenticated user is key owner or admin before DELETE

try { await api.deleteSshKey(id); } catch (e) { if (e.status === 401) throw new Error('Only key owner or admin can delete'); }

When it happens

Trigger: Deleting another user's SSH key without administrator rights; key id refers to a key owned by a different account than the authenticated user.

Common situations: Scripts iterating all SSH keys and deleting them with a regular user token; id mismatch after key recreation.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to add specified link for specified issues
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• Not authorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/ccb428b4e5694c49. Report an issue: GitHub.