Azure DevOps Services · REST API · Checked October 23, 2026

Azure DevOps: "TF400813: The user '…' is not authorized to access this resource."

Azure DevOps refused the request with HTTP 401. Look at the ID in the quotes first: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa means Azure DevOps accepted no credentials at all and treated the call as anonymous. The token is missing, mistyped, expired or revoked, or not sent the way Azure DevOps expects.

The whole answer

What dev.azure.com answered on October 23, 2026 to a call on a private organization, both with no token and with an invalid one:

curl -u ':not-a-valid-token' -H 'X-TFS-FedAuthRedirect: Suppress' \
  'https://dev.azure.com/<organization>/_apis/projects?api-version=7.1'

HTTP 401
{"$id":"1","innerException":null,
 "message":"TF400813: The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' is not authorized to access this resource.",
 "typeName":"Microsoft.TeamFoundation.Framework.Server.UnauthorizedRequestException, Microsoft.TeamFoundation.Framework.Server",
 "typeKey":"UnauthorizedRequestException","errorCode":0,"eventId":3000}

Without the X-TFS-FedAuthRedirect: Suppress header, the same calls got HTTP 302 to the sign-in page (…vssps.visualstudio.com/_signin…, an HTML "Object moved" page) instead. A tool that follows redirects then ends with a sign-in page where it expected JSON, and no TF400813 at all.
In an organization with a public project, the organization's own project list (_apis/projects) still answered TF400813 with no token, while the repository list inside the public project (<project>/_apis/git/repositories) answered 200, with no token and with the invalid one alike. Calls on a public project can work without a token; calls on the organization cannot.
An organization name that does not exist got HTTP 404 and an HTML "Page not found" page, with or without a token.
Public bug reports also show the wording TF400813: Resource not available for anonymous access. Client authentication required.

When the ID is aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa

The request counted as anonymous. Check, in this order:

Is a token sent at all? With a personal access token, Azure DevOps takes Basic authentication with an empty user name and the token as the password: curl -u ':<token>', or the header Authorization: Basic + Base64 of :<token>.
Is it the whole token? A space, a line break or a missing character from copying is enough to make it invalid.
Has it expired or been revoked? Check its expiry under User settings (top right), Personal access tokens.
A Microsoft Entra token? They last one hour (Microsoft), so a tool that keeps one without renewing it starts failing after that. A public report shows this anonymous ID from an IDE plugin whose session stopped working after several hours.
A token for "All accessible organizations"? Microsoft is retiring those on Azure DevOps Services (the date, first December 1, 2026, was postponed on October 23, 2026): make one for the organization.

When it is another ID

Then Azure DevOps accepted the credentials for that identity, and says that identity may not open this resource. Check that the account is a member of this organization and can open the project in the browser. A repository the account may not read answers differently, with HTTP 404 and TF401019.

Check a token by hand

curl -u ':<token>' -H 'X-TFS-FedAuthRedirect: Suppress' \
  'https://dev.azure.com/<organization>/_apis/git/repositories?api-version=7.1'

JSON with your repositories means the token works for that organization with at least Code (Read). TF400813 with the anonymous ID means it does not.

Azure DevOps pull requests in IntelliJ IDEA and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, turns these answers into one line in the IDE: a 401, a 302 to the sign-in page or an HTML page all read as "Azure DevOps rejected the personal access token", with what to check and an Open settings link. It can also use your Azure CLI sign-in instead of a token, and asks the Azure CLI again a few minutes before that short-lived token runs out. The review inbox is free; voting, commenting and completing are Pro, with a 30-day trial.

Get it on JetBrains Marketplace

Azure DevOps and Microsoft Entra are trademarks of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.

More: "203 Non-Authoritative Information": the sign-in page instead of JSON · VS30063: the same refusal in the .NET client's words · Azure DevOps plugins for IntelliJ IDEA 2025.2 and later · 日本語