Get and update some details of automatic rules, and manage custom rules.
openapi: 3.0.3
info:
title: SonarQube Cloud Web authentication rules API
version: v1
description: The SonarQube Cloud Web API, derived faithfully from the machine-readable service catalog the instance publishes at /api/webservices/list.
x-derived-from: https://sonarcloud.io/api/webservices/list
contact:
name: SonarSource
url: https://community.sonarsource.com/
servers:
- url: https://sonarcloud.io
security:
- bearerToken: []
- basicToken: []
tags:
- name: rules
description: Get and update some details of automatic rules, and manage custom rules.
paths:
/api/rules/repositories:
get:
operationId: rulesRepositories
summary: List available rule repositories
description: List available rule repositories
tags:
- rules
parameters:
- name: language
in: query
description: A language key; if provided, only repositories for the given language will be returned
required: false
schema:
type: string
example: java
- name: q
in: query
description: A pattern to match repository keys/names against
required: false
schema:
type: string
example: squid
responses:
'200':
description: OK
'400':
description: Bad Request
'401':
description: Unauthorized - authentication required
'403':
description: Insufficient privileges
'404':
description: Not Found
/api/rules/search:
get:
operationId: rulesSearch
summary: Search for a collection of relevant rules matching a specified query. Since 5.5, following fields in the response hav...
description: Search for a collection of relevant rules matching a specified query. Since 5.5, following fields in the response have been deprecated :"effortToFixDescription" becomes "gapDescription""debtRemFnCoeff" becomes "remFnGapMultiplier""defaultDebtRemFnCoeff" becomes "defaultRemFnGapMultiplier""debtRemFnOffset" becomes "remFnBaseEffort""defaultDebtRemFnOffset" becomes "defaultRemFnBaseEffort""debtOverloaded" becomes "remFnOverloaded"
tags:
- rules
parameters:
- name: activation
in: query
description: Filter rules that are activated or deactivated on the selected Quality profile. Ignored if the parameter 'qprofile' is not set.
required: false
schema:
type: string
enum:
- 'true'
- 'false'
- 'yes'
- 'no'
- name: active_severities
in: query
description: Comma-separated list of activation severities, i.e the severity of rules in Quality profiles.
required: false
schema:
type: string
enum:
- INFO
- MINOR
- MAJOR
- CRITICAL
- BLOCKER
example: CRITICAL,BLOCKER
- name: asc
in: query
description: Ascending sort
required: false
schema:
type: string
enum:
- 'true'
- 'false'
- 'yes'
- 'no'
default: 'true'
- name: available_since
in: query
description: Filters rules added since date. Format is yyyy-MM-dd
required: false
schema:
type: string
example: '2014-06-22'
- name: cleanCodeAttributeCategories
in: query
description: Comma-separated list of Clean Code Attribute Categories
required: false
schema:
type: string
enum:
- ADAPTABLE
- CONSISTENT
- INTENTIONAL
- RESPONSIBLE
example: ADAPTABLE,INTENTIONAL
- name: complianceStandards
in: query
description: Set of compliance standards to filter on. Categories within a standard are comma-separated and behave as an 'or'. Multiple standards are separated by an ampersand and behave as an 'and'.
required: false
schema:
type: string
example: owasp_asvs:urn:sonar-security-standard:owasp:asvs:5.0=15,16&sonar_standard:urn:sonar-security-standard:sonar:standard:unversioned=log-injection
- name: cwe
in: query
description: Comma-separated list of CWE identifiers. Use 'unknown' to select rules not associated to any CWE.
required: false
schema:
type: string
example: 12,125,unknown
- name: f
in: query
description: Comma-separated list of the fields to be returned in response. All the fields are returned by default, except actives.Since 5.5, following fields have been deprecated :"defaultDebtRemFn" becomes "defaultRemFn""debtRemFn" becomes "remFn""effortToFixDescription" becomes "gapDescription""debtOverloaded" becomes "remFnOverloaded"
required: false
schema:
type: string
enum:
- actives
- cleanCodeAttribute
- createdAt
- debtOverloaded
- debtRemFn
- defaultDebtRemFn
- defaultRemFn
- deprecatedKeys
- descriptionSections
- educationPrinciples
- effortToFixDescription
- gapDescription
- htmlDesc
- htmlNote
- impacts
- internalKey
- isExternal
- isTemplate
- lang
- langName
- mdDesc
- mdNote
- name
- noteLogin
- params
- remFn
- remFnOverloaded
- repo
- scope
- securityStandards
- severity
- status
- sysTags
- tags
- templateKey
- updatedAt
example: debtRemFn,mdDesc
- name: facets
in: query
description: Comma-separated list of the facets to be computed. No facet is computed by default.
required: false
schema:
type: string
enum:
- languages
- repositories
- tags
- severities
- active_severities
- statuses
- types
- 'true'
- cwe
- owaspMobileTop10-2024
- owaspTop10
- owaspTop10-2021
- sonarsourceSecurity
- cleanCodeAttributeCategories
- impactSeverities
- impactSoftwareQualities
- complianceStandards
example: languages,repositories
- name: impactSeverities
in: query
description: Comma-separated list of Software Quality Severities
required: false
schema:
type: string
enum:
- INFO
- LOW
- MEDIUM
- HIGH
- BLOCKER
example: HIGH,MEDIUM
- name: impactSoftwareQualities
in: query
description: Comma-separated list of Software Qualities
required: false
schema:
type: string
enum:
- MAINTAINABILITY
- RELIABILITY
- SECURITY
example: MAINTAINABILITY,RELIABILITY
- name: include_external
in: query
description: Include external engine rules in the results
required: false
schema:
type: string
enum:
- 'true'
- 'false'
- 'yes'
- 'no'
default: 'false'
- name: inheritance
in: query
description: Comma-separated list of values of inheritance for a rule within a quality profile. Used only if the parameter 'activation' is set.
required: false
schema:
type: string
enum:
- NONE
- INHERITED
- OVERRIDES
example: INHERITED,OVERRIDES
- name: is_template
in: query
description: Filter template rules
required: false
schema:
type: string
enum:
- 'true'
- 'false'
- 'yes'
- 'no'
- name: languages
in: query
description: Comma-separated list of languages
required: false
schema:
type: string
example: java,js
- name: organization
in: query
description: Organization key
required: false
schema:
type: string
example: my-org
- name: owaspMobileTop10-2024
in: query
description: Comma-separated list of OWASP Mobile Top 10 (2024) lowercase categories.
required: false
schema:
type: string
enum:
- m1
- m2
- m3
- m4
- m5
- m6
- m7
- m8
- m9
- m10
- name: owaspTop10
in: query
description: Comma-separated list of OWASP Top 10 lowercase categories.
required: false
schema:
type: string
enum:
- a1
- a2
- a3
- a4
- a5
- a6
- a7
- a8
- a9
- a10
- name: owaspTop10-2021
in: query
description: Comma-separated list of OWASP Top 10 (2021) lowercase categories.
required: false
schema:
type: string
enum:
- a1
- a2
- a3
- a4
- a5
- a6
- a7
- a8
- a9
- a10
- name: p
in: query
description: 1-based page number
required: false
schema:
type: string
default: '1'
example: '42'
- name: ps
in: query
description: Page size. Must be greater than 0 and less or equal than 500
required: false
schema:
type: string
default: '100'
example: '20'
- name: q
in: query
description: UTF-8 search query
required: false
schema:
type: string
example: xpath
- name: qprofile
in: query
description: Quality profile key to filter on. Used only if the parameter 'activation' is set.
required: false
schema:
type: string
example: AU-Tpxb--iU5OvuD2FLy
- name: repositories
in: query
description: Comma-separated list of repositories
required: false
schema:
type: string
example: checkstyle,findbugs
- name: rule_key
in: query
description: Key of rule to search for
required: false
schema:
type: string
example: squid:S001
- name: rule_keys
in: query
description: Rule keys
required: false
schema:
type: string
example: squid:S1002,squid:S1003
- name: s
in: query
description: Sort field
required: false
schema:
type: string
enum:
- name
- updatedAt
- createdAt
- key
example: name
- name: severities
in: query
description: Comma-separated list of default severities. Not the same than severity of rules in Quality profiles.
required: false
schema:
type: string
enum:
- INFO
- MINOR
- MAJOR
- CRITICAL
- BLOCKER
example: CRITICAL,BLOCKER
- name: sonarsourceSecurity
in: query
description: Comma-separated list of SonarSource security categories. Use 'others' to select rules not associated with any category
required: false
schema:
type: string
enum:
- buffer-overflow
- permission
- sql-injection
- command-injection
- path-traversal-injection
- ldap-injection
- xpath-injection
- rce
- dos
- ssrf
- csrf
- xss
- log-injection
- http-response-splitting
- open-redirect
- xxe
- object-injection
- weak-cryptography
- auth
- insecure-conf
- encrypt-data
- traceability
- file-manipulation
- others
example: sql-injection,command-injection,others
- name: statuses
in: query
description: Comma-separated list of status codes
required: false
schema:
type: string
enum:
- BETA
- DEPRECATED
- READY
- REMOVED
example: READY
- name: tags
in: query
description: Comma-separated list of tags. Returned rules match any of the tags (OR operator)
required: false
schema:
type: string
example: security,java8
- name: template_key
in: query
description: Key of the template rule to filter on. Used to search for the custom rules based on this template.
required: false
schema:
type: string
example: java:S001
- name: types
in: query
description: Comma-separated list of types. Returned rules match any of the tags (OR operator)
required: false
schema:
type: string
enum:
- CODE_SMELL
- BUG
- VULNERABILITY
- SECURITY_HOTSPOT
example: BUG
responses:
'200':
description: OK
'400':
description: Bad Request
'401':
description: Unauthorized - authentication required
'403':
description: Insufficient privileges
'404':
description: Not Found
deprecated: true
/api/rules/show:
get:
operationId: rulesShow
summary: Get detailed information about a rule Since 5.5, following fields in the response have been deprecated :"effortToFixD...
description: Get detailed information about a rule Since 5.5, following fields in the response have been deprecated :"effortToFixDescription" becomes "gapDescription""debtRemFnCoeff" becomes "remFnGapMultiplier""defaultDebtRemFnCoeff" becomes "defaultRemFnGapMultiplier""debtRemFnOffset" becomes "remFnBaseEffort""defaultDebtRemFnOffset" becomes "defaultRemFnBaseEffort""debtOverloaded" becomes "remFnOverloaded"In 7.1, the field 'scope' has been added.
tags:
- rules
parameters:
- name: actives
in: query
description: Show rule's activations for all profiles ("active rules")
required: false
schema:
type: string
enum:
- 'true'
- 'false'
- 'yes'
- 'no'
default: 'false'
- name: key
in: query
description: Rule key
required: true
schema:
type: string
example: javascript:EmptyBlock
- name: organization
in: query
description: Organization key
required: true
schema:
type: string
example: my-org
responses:
'200':
description: OK
'400':
description: Bad Request
'401':
description: Unauthorized - authentication required
'403':
description: Insufficient privileges
'404':
description: Not Found
deprecated: true
/api/rules/tags:
get:
operationId: rulesTags
summary: List rule tags
description: List rule tags
tags:
- rules
parameters:
- name: organization
in: query
description: Organization key
required: true
schema:
type: string
example: my-org
- name: ps
in: query
description: Page size. Must be greater than 0 and less or equal than 100
required: false
schema:
type: string
default: '10'
example: '20'
- name: q
in: query
description: Limit search to tags that contain the supplied string.
required: false
schema:
type: string
example: misra
responses:
'200':
description: OK
'400':
description: Bad Request
'401':
description: Unauthorized - authentication required
'403':
description: Insufficient privileges
'404':
description: Not Found
/api/rules/update:
post:
operationId: rulesUpdate
summary: Update an existing rule. Requires the 'Administer Quality Profiles' permission
description: Update an existing rule. Requires the 'Administer Quality Profiles' permission
tags:
- rules
parameters:
- name: debt_sub_characteristic
in: query
description: Debt characteristics are no more supported. This parameter is ignored.
required: false
schema:
type: string
- name: key
in: query
description: Key of the rule to update
required: true
schema:
type: string
maxLength: 200
example: javascript:NullCheck
- name: markdown_description
in: query
description: Rule description (mandatory for custom rule and manual rule)
required: false
schema:
type: string
example: Description of my custom rule
- name: markdown_note
in: query
description: Optional note in markdown format. Use empty value to remove current note. Note is not changed if the parameter is not set.
required: false
schema:
type: string
example: my *note*
- name: name
in: query
description: Rule name (mandatory for custom rule)
required: false
schema:
type: string
maxLength: 200
example: My custom rule
- name: organization
in: query
description: Organization key
required: true
schema:
type: string
example: my-org
- name: params
in: query
description: Parameters as semi-colon list of =, for example 'params=key1=v1;key2=v2' (Only when updating a custom rule)
required: false
schema:
type: string
- name: remediation_fn_base_effort
in: query
description: Base effort of the remediation function of the rule
required: false
schema:
type: string
example: 1d
- name: remediation_fn_type
in: query
description: Type of the remediation function of the rule
required: false
schema:
type: string
enum:
- LINEAR
- LINEAR_OFFSET
- CONSTANT_ISSUE
- name: remediation_fy_gap_multiplier
in: query
description: Gap multiplier of the remediation function of the rule
required: false
schema:
type: string
example: 3min
- name: severity
in: query
description: Rule severity (Only when updating a custom rule)
required: false
schema:
type: string
enum:
- INFO
- MINOR
- MAJOR
- CRITICAL
- BLOCKER
- name: status
in: query
description: Rule status (Only when updating a custom rule)
required: false
schema:
type: string
enum:
- BETA
- DEPRECATED
- READY
- REMOVED
- name: tags
in: query
description: Optional comma-separated list of tags to set. Use blank value to remove current tags. Tags are not changed if the parameter is not set.
required: false
schema:
type: string
example: java8,security
responses:
'200':
description: OK
'400':
description: Bad Request
'401':
description: Unauthorized - authentication required
'403':
description: Insufficient privileges
'404':
description: Not Found
components:
securitySchemes:
bearerToken:
type: http
scheme: bearer
description: User token as Bearer token.
basicToken:
type: http
scheme: basic
description: User token as HTTP Basic username with empty password.