Sonarqube Webhooks

generated: '2026-11-05'
method: searched
source:
  - https://docs.sonarsource.com/sonarqube-server/discovering/integrations/webhooks.md
  - https://docs.sonarsource.com/sonarqube-server/project-administration/integrations/webhooks.md
name: SonarQube Server webhooks
summary: >-
  SonarQube Server emits outbound webhooks after each project analysis and when an issue change flips the quality
  gate status. Delivery is a POST with a JSON payload, identified by the X-SonarQube-Project header and optionally
  signed with X-Sonar-Webhook-HMAC-SHA256. Webhooks are configured per project (up to 10) or globally, in the UI
  or through the api/webhooks Web API endpoints, which also expose delivery history. No AsyncAPI document is
  published; the payload example below is the provider's own.
asyncapi_document: null
direction: outbound
events:
  - id: analysis-completed
    trigger: "A project analysis is complete. This is done regardless of the status of the background task or of the quality gate."
  - id: quality-gate-status-changed-by-issue-update
    trigger: "An issue type, severity, or status is updated, and this update changes the quality gate status."
delivery:
  method: POST
  content_type: application/json; charset=UTF-8
  headers:
    - name: X-SonarQube-Project
      purpose: project key of the analysed project
    - name: X-Sonar-Webhook-HMAC-SHA256
      purpose: HMAC lower-case SHA-256 hex digest of the request body, keyed with the webhook secret (only when a secret is set)
  signature_verification: >-
    "SonarQube uses a HMAC lower-case SHA256 digest to compute the signature of the request body." Compare the header
    to your own digest; "If the signatures don't match, then the payload should be ignored."
  basic_auth_in_url: "A basic authentication mechanism is supported by providing user/password in the URL of the Webhook such as https://myLogin:myPassword@my_server/foo."
  timeout: "A delivery is marked as failed if the URL doesn't respond within 10 seconds."
  retries: "SonarQube Server doesn't retry to deliver failed webhook deliveries. You may use the Web API to implement an automatic redelivering mechanism."
  delivery_history_retention: "Response records are purged after 30 days."
  max_per_project: 10
  destination_validation: "By default, SonarQube Server rejects webhook URLs that resolve to internal destinations, such as loopback, private network, and cloud metadata addresses."
payload:
  fields:
    - serverUrl
    - taskId
    - status
    - analysedAt
    - revision
    - project.key
    - project.name
    - project.url
    - branch
    - qualityGate.name
    - qualityGate.status
    - qualityGate.conditions[].metric
    - qualityGate.conditions[].operator
    - qualityGate.conditions[].errorThreshold
    - qualityGate.conditions[].onLeakPeriod
    - qualityGate.conditions[].status
    - qualityGate.conditions[].value
    - properties
  custom_properties: "If you provide additional properties to your SonarScanner using the pattern sonar.analysis.*, these properties will be automatically added to the section \"properties\" of the payload."
  example:
    serverUrl: "<mySonarqubeURL>"
    taskId: "AVh21JS2JepAEhwQ-b3u"
    status: "SUCCESS"
    analysedAt: "2016-11-18T10:46:28+0100"
    revision: "c739069ec7105e01303e8b3065a81141aad9f129"
    project:
      key: "myProject"
      name: "My Project"
      url: "https://mycompany.com/sonarqube/project/overview?id=myproject"
    properties: {}
    qualityGate:
      conditions:
        - errorThreshold: "1"
          metric: "new_security_rating"
          onLeakPeriod: true
          operator: "GREATER_THAN"
          status: "OK"
          value: "1"
management_api:
  endpoints: api/webhooks (create, update, delete, list, deliveries, delivery)
  note: The api/webhooks web service is documented inside each SonarQube Server instance and defined in grpc/sonarqube-ws-webhooks.proto; it is not in the 11-operation local OpenAPI.
mcp_tools: [create_webhook, list_webhooks]
gaps:
  - No AsyncAPI document and no JSON Schema for the payload are published; the field list above is read from the provider's prose and example.