theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

getAgent in AgentResource is an administration-only REST endpoint: it loads any agent by id, so it is gated behind SecurityUtils.isAdministrator(). Non-administrator authenticated users get UnauthorizedException ('Not authorized').

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/AgentResource.java:54

	private final AgentService agentService;
	
	private final AgentAttributeService agentAttributeService;
	
	private final AuditService auditService;
	
	@Inject
	public AgentResource(AgentService agentService, AgentAttributeService agentAttributeService, AuditService auditService) {
		this.agentService = agentService;
		this.agentAttributeService = agentAttributeService;
		this.auditService = auditService;
	}

	@Api(order=100)
	@Path("/{agentId}")
    @GET
    public Agent getAgent(@PathParam("agentId") Long agentId) {
    	if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();
    	return agentService.load(agentId);
    }

	@Api(order=200)
	@Path("/{agentId}/attributes")
    @GET
    public Map<String, String> getAttributes(@PathParam("agentId") Long agentId) {
    	if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();
    	return agentService.load(agentId).getAttributeMap();
    }
	
	@Api(order=300)
	@GET
    public List<Agent> queryAgents(
    		@QueryParam("query") @Api(description="Syntax of this query is the same as in <a href='/~administration/agents'>agent management page</a>", example="\"Name\" is \"agentName\"") String query, 
    		@QueryParam("offset") @Api(example="0") int offset, 
    		@QueryParam("count") @Api(example="100") int count) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Use credentials (token) of a server administrator for this call
2. Grant the calling account server administrator role in OneDev administration
3. If only your own build's info is needed, use non-admin endpoints or the web UI instead

Example fix

// before
curl -u alice-token: GET /~api/agents/5   // alice is not admin
// after
curl -H "Authorization: Bearer <admin-token>" GET /~api/agents/5

// only call if the account is server admin
boolean isAdmin = userDictatesAdminRole; // check in Admin > Role Management

try { Agent a = client.getAgent(id); } catch (ForbiddenException e) { throw new IllegalStateException("Server administrator required to fetch agent " + id); }

When it happens

Trigger: GET /~api/agents/{agentId} invoked with credentials of a non-administrator user.

Common situations: Regular project members querying agent details via REST with their personal access token; service accounts without server-admin role attempting agent inventory scripts.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized
• No permission to access build: ${referenceString}
• Unable to update attributes as agent is offline
• Unauthorized
• Unauthorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/e32e7f04ed2fe33a. Report an issue: GitHub.