theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

MembershipResource.deleteMembership (DELETE /memberships/{membershipId}) is restricted to server administrators: it throws UnauthorizedException (HTTP 401) when SecurityUtils.isAdministrator() is false. Non-admin users cannot remove project/space memberships via the REST API regardless of project-level permissions.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/MembershipResource.java:66

	}
	
	@Api(order=200, description="Create new membership")
	@POST
	public Long createMembership(@NotNull Membership membership) {
		if (!SecurityUtils.isAdministrator())
			throw new UnauthorizedException();
		membershipService.create(membership);
		var newAuditContent = VersionedXmlDoc.fromBean(membership).toXML();
		auditService.audit(null, "created membership via RESTful API", null, newAuditContent);
		return membership.getId();
	}
	
	@Api(order=300)
	@Path("/{membershipId}")
	@DELETE
	public Response deleteMembership(@PathParam("membershipId") Long membershipId) {
		if (!SecurityUtils.isAdministrator())
			throw new UnauthorizedException();
		var membership = membershipService.load(membershipId);
		membershipService.delete(membership);
		var oldAuditContent = VersionedXmlDoc.fromBean(membership).toXML();
		auditService.audit(null, "deleted membership via RESTful API", oldAuditContent, null);
		return Response.ok().build();
	}
	
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate the request as a server administrator (admin user or admin-scoped token)
2. Remove the membership via the UI as an administrator instead of the API
3. If membership self-service is needed, use project-level permission management endpoints the user is authorized for

Example fix

// before
curl -u devuser:token -X DELETE /~api/memberships/42  -> 401 Not authorized
// after
curl -u adminuser:adminToken -X DELETE /~api/memberships/42  -> 200

// confirm the token's user is a server administrator before calling
if (!currentUserIsServerAdmin()) useAdminCredential();

try { deleteMembership(id); } catch (WebApplicationException e) { if (e.getResponse().getStatus() == 401) escalateToAdmin(); else throw e; }

When it happens

Trigger: DELETE request on /~api/memberships/{id} authenticated as a non-administrator user or token.

Common situations: Integration bots with only project admin rights trying to manage memberships; personal access token of a regular developer; expecting project-level admin to suffice.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• Code write permission is required to edit auto merge
• Not authorized
• Access token owner should have permission to manage authoriz

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/e3467819775e3177. Report an issue: GitHub.