Jenkins: "ERROR: anonymous is missing the Overall/Read permission"
Jenkins took the request as coming from no one (anonymous), and its security settings do not let anonymous users read anything. The fix is rarely a permission change: it is getting your user ID and API token to Jenkins with the request.
What Jenkins answered
A Jenkins 2.580.1 on our machine, set to require a login with nothing readable anonymously, on October 24, 2026. The Jenkins CLI with no credentials, for list-jobs and for build alike (exit code 6):
java -jar jenkins-cli.jar -s https://jenkins.example.com/ -http list-jobs ERROR: anonymous is missing the Overall/Read permission
The REST API, with no credentials:
curl -i 'https://jenkins.example.com/api/json' HTTP 403 X-You-Are-Authenticated-As: anonymous X-Required-Permission: hudson.model.Hudson.Read
Its body is an HTML page, "Authentication required", that sends a browser to /login, with a comment: Permission you need to have (but didn't): hudson.model.Hudson.Read. A script that expects JSON gets this page instead.
Why the credentials did not arrive
- They were not sent. The CLI without
-auth, curl without-u, or a tool whose user ID or token field is empty. - The client waits to be asked. Jenkins answers anonymous with 403, and that 403 has no
WWW-Authenticateheader, so a client that sends a password only after a challenge never sends it. With the same user ID and token,curl --anyauth -u …got 403, whilecurl -u …, which sends Basic authentication up front, got 200. - A wrong token gets a different answer: HTTP 401 with
WWW-Authenticate: Basic realm="Jenkins", both for a real user with a wrong token and for a user ID that does not exist. So "anonymous" means the credentials never reached Jenkins, and 401 means they did and were wrong ("401 Unauthorized"). - If the client does send them up front and Jenkins still says anonymous, something between the two removed the
Authorizationheader. Compare with the same curl run on the Jenkins machine itself.
To see who Jenkins thinks you are, ask /whoAmI/api/json. It answered even to anonymous: {"name":"anonymous","anonymous":true,…}, and with a user ID and API token, that user's name.
Pass a user ID and an API token
Make the token on your Jenkins: your user page (your name at the top right), Security, API Token, Add new Token. Jenkins shows it once. Each of these worked on the same Jenkins:
# the CLI java -jar jenkins-cli.jar -s https://jenkins.example.com/ -http -auth your-user-id:your-api-token list-jobs java -jar jenkins-cli.jar -s https://jenkins.example.com/ -http -auth @credentials.txt list-jobs # the file holds your-user-id:your-api-token JENKINS_USER_ID=your-user-id JENKINS_API_TOKEN=your-api-token java -jar jenkins-cli.jar -s https://jenkins.example.com/ -http list-jobs # the REST API curl -u 'your-user-id:your-api-token' 'https://jenkins.example.com/api/json'
A request signed in with an API token also needs no CSRF crumb: "403 No valid crumb was included in the request".
When the name is not anonymous
"<user> is missing the Overall/Read permission" means Jenkins accepted that user's credentials, and the authorization settings do not give that user Overall/Read. Then it is a permission: an administrator grants it under Manage Jenkins, Security.
Jenkins builds in IntelliJ IDEA and other JetBrains IDEs
Pipeline Inbox for Jenkins, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, sends your user ID and API token with every request to each Jenkins server, up front. With no token set for a server that requires a sign-in, it says so and points to the settings; a user ID or token that Jenkins rejects is named as such. The build list, Pipeline stages, failed tests and console logs are free; build with parameters, rebuild, stop and input steps are Pro (US$1.50 a month, with a 30-day trial).
Jenkins® is a registered trademark of LF Charities Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by the Jenkins project or JetBrains.