theonedev/onedev · error · NotAcceptableException

Reviewer should have code read permission:

Error message

Reviewer should have code read permission: 

What it means

When creating a pull request with reviewerIds, OneDev throws NotAcceptableException if a listed reviewer does not have code-read permission on the request's project (reviewers must be able to see the code they review). The message includes the offending reviewer's name.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/PullRequestResource.java:292

		if (!SecurityUtils.canReadCode(target.getProject()) || !SecurityUtils.canReadCode(source.getProject()))
			throw new UnauthorizedException();

		PullRequest request = new PullRequest();
		request.setSubmitter(user);
		request.setTarget(target);
		request.setSource(source);
		request.setTitle(data.getTitle());
		request.setDescription(data.getDescription());
		if (data.getMergeStrategy() != null)
			request.setMergeStrategy(data.getMergeStrategy());

		if (data.getReviewerIds() != null) {
			for (Long reviewerId: data.getReviewerIds()) {
				User reviewer = userService.load(reviewerId);
				if (reviewer.equals(request.getSubmitter()))
					return Response.status(NOT_ACCEPTABLE).entity("Pull request submitter cannot be reviewer").build();
				if (!SecurityUtils.canReadCode(request.getProject()))
					throw new NotAcceptableException("Reviewer should have code read permission: " + reviewer.getName());

				if (request.getReview(reviewer) == null) {
					PullRequestReview review = new PullRequestReview();
					review.setRequest(request);
					review.setUser(reviewer);
					request.getReviews().add(review);
				}
			}
		}

		if (data.getAssigneeIds() != null && !data.getAssigneeIds().isEmpty()) {
			for (Long assigneeId : data.getAssigneeIds()) {
				PullRequestAssignment assignment = new PullRequestAssignment();
				assignment.setRequest(request);
				var assignee = userService.load(assigneeId);
				if (!SecurityUtils.canWriteCode(request.getProject()))
					throw new NotAcceptableException("Assignee should have code write permission: " + assignee.getName());
				assignment.setUser(assignee);

View on GitHub (pinned to d44925c47c)

Solutions

1. Remove users without project code-read from reviewerIds.
2. Grant each intended reviewer a role with code-read on the project before submitting.
3. Use users who can already open the project in the web UI as reviewers.
4. Split the flow: create the PR first, then add reviewers as their access is granted.

Example fix

// before
{"reviewerIds":[12,33]}   // user 33 has no access to the project
// after
{"reviewerIds":[12]}      // or grant user 33 code-read first

const reviewers = await Promise.all(ids.map(async id => {
  const u = await (await fetch(`/~api/users/${id}`)).json()
  return u
}))
// only pass reviewers who are project members with code-read
const eligible = reviewers.filter(u => projectMembers.some(m => m.id === u.id))

try {
  await api.post('/pull-requests', {...data, reviewerIds: ids})
} catch (e) {
  if (e.status === 400 && e.message.includes('Reviewer should have code read permission')) {
    // strip the named reviewer and retry or surface to user
  } else throw e
}

When it happens

Trigger: POST /~api/pull-requests with a reviewerIds entry for a user who is not a project member or lacks code-read; adding reviewers from another project/organization; reviewer account disabled or role downgraded.

Common situations: Auto-assigning default reviewer lists containing users outside the project; cross-team reviews where reviewers were never granted repo access; scripts copying reviewer sets from PRs in other projects.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Unable to remove mandatory reviewers:
• Assignee should have code write permission:
• Pull request submitter cannot be reviewer
• Count should not be greater than ${RestConstants.MAX_PAGE_SI
• No permission to access issue: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/0757b740c98b2f59. Report an issue: GitHub.