theonedev/onedev · error · NotAcceptableException

Unable to remove mandatory reviewers:

Error message

Unable to remove mandatory reviewers: 

What it means

After excluding reviews for the requested reviewers, pullRequestService.checkReviews() re-evaluates mandatory reviewer requirements. Reviewers that the check re-instates (restored from EXCLUDED) are listed in the error: the PR's branch protection/review requirement rules make them mandatory, so they cannot be removed via this endpoint.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:1424

                throw new NotAcceptableException("Pull request is closed");
            var excludedReviews = new ArrayList<PullRequestReview>();
            for (var reviewerName : removeReviewerNames) {
                User reviewer = userService.findByName(reviewerName);
                if (reviewer == null)
                    throw new NotFoundException("Reviewer not found: " + reviewerName);
                var review = request.getReview(reviewer);
                if (review != null && review.getStatus() != PullRequestReview.Status.EXCLUDED) {
                    review.setStatus(PullRequestReview.Status.EXCLUDED);
                    excludedReviews.add(review);
                }
            }
            pullRequestService.checkReviews(request, false);
            var requiredReviewers = excludedReviews.stream()
                    .filter(it -> it.getStatus() != PullRequestReview.Status.EXCLUDED)
                    .map(it -> it.getUser().getName())
                    .collect(Collectors.toList());
            if (!requiredReviewers.isEmpty())
                throw new NotAcceptableException("Unable to remove mandatory reviewers: " + String.join(", ", requiredReviewers));
            for (var review : excludedReviews) 
                pullRequestReviewService.createOrUpdate(user, review);
        }

        var autoMergeEnabled = (Boolean) data.remove("autoMerge");
        if (autoMergeEnabled != null) {
            if (!SecurityUtils.canWriteCode(request.getProject()))
                throw new UnauthorizedException("Code write permission is required to edit auto merge");
            if (!request.isOpen())
                throw new NotAcceptableException("Pull request is closed");

            if (autoMergeEnabled && request.checkMergeCondition() == null) 
                throw new NotAcceptableException("This pull request is not eligible for auto-merge, as it can be merged directly now");

            var autoMerge = new AutoMerge();
            autoMerge.setEnabled(autoMergeEnabled);
            autoMerge.setCommitMessage(trimToNull((String) data.remove("autoMergeCommitMessage")));
            var errorMessage = request.checkMergeCommitMessage(user, autoMerge.getCommitMessage());

View on GitHub (pinned to d44925c47c)

Solutions

1. Remove the named reviewers from 'removeReviewers' — they are required by review policy.
2. Change the project's review requirement settings (branch protection / required reviewers) if removal is legitimately needed.
3. Have an administrator adjust the mandatory-reviewer rule, then retry the removal.
4. Escalate instead of removing: request the mandatory reviewer's sign-off rather than dropping them.

Example fix

// before
{"removeReviewers": ["alice"]}  // alice is a mandatory reviewer
// after
{"removeReviewers": ["bob"]}  // only non-mandatory reviewers
// or: update project required-reviewer settings first

try {
  await editPullRequest(ref, { removeReviewers: names });
} catch (e) {
  if (e.status === 406 && e.message.startsWith('Unable to remove mandatory reviewers')) {
    const mandatory = e.message.split(': ')[1]?.split(', ').map(s => s.trim()) ?? [];
    // retry with only non-mandatory names, or escalate for policy change
  }
}

When it happens

Trigger: POST /edit-pull-request with 'removeReviewers' naming a reviewer whom project review requirements (e.g. required reviewer settings or CODEOWNERS-like rules) mandate for this pull request.

Common situations: Trying to remove a project owner or a reviewer mandated by branch protection rules; automation stripping all reviewers indiscriminately; changing target branch or project review settings that made a reviewer mandatory.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Reviewer should have code read permission:
• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• Code write permission is required to edit auto merge
• Not authorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/92b8d140d301ec8b. Report an issue: GitHub.