# Sonarqube

> Access SonarQube or SonarCloud issues and quality gate data via API using tokens. Use when fetching PR/branch issue lists, leak-period problems, or quality gate status for a project.

- Skill: `hansjm10/sonarqube` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hansjm10/sonarqube`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hansjm10/sonarqube/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: hansjm10 (https://skillmd.com/u/hansjm10)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/hansjm10/sonarqube

---


# SonarQube Access

## Token setup
- Prefer `SONAR_TOKEN` in the environment.
- Optional fallback: a local file like `.env.sonarcloud` containing `SONAR_TOKEN=...` (do not commit; add to `.gitignore`).
- Optional host override: `SONAR_HOST_URL` (default `https://sonarcloud.io`).

Example env file:

```bash
SONAR_TOKEN=your_token_here
```

Load from file when needed:

```bash
SONAR_TOKEN=$(sed -n 's/^SONAR_TOKEN=//p' .env.sonarcloud)
```

## Auth and base URL
- SonarCloud recommends bearer auth; basic auth with an empty password also works.
- Base URL defaults to SonarCloud: `SONAR_HOST_URL=${SONAR_HOST_URL:-https://sonarcloud.io}`.

Bearer auth:

```bash
curl -sSf -H "Authorization: Bearer $SONAR_TOKEN" \
  "$SONAR_HOST_URL/api/authentication/validate"
```

Basic auth:

```bash
curl -sSf -u "$SONAR_TOKEN:" \
  "$SONAR_HOST_URL/api/authentication/validate"
```

## Common API calls

Issues for a PR (SonarCloud):

```bash
SONAR_HOST_URL=${SONAR_HOST_URL:-https://sonarcloud.io}
curl -sSf -u "$SONAR_TOKEN:" \
  "$SONAR_HOST_URL/api/issues/search?organization=<org>&projectKeys=<projectKey>&pullRequest=<pr>&statuses=OPEN,CONFIRMED"
```

If the API returns 400, retry without `statuses` and ensure the `organization` parameter is set:

```bash
curl -sSf -u "$SONAR_TOKEN:" \
  "$SONAR_HOST_URL/api/issues/search?organization=<org>&projectKeys=<projectKey>&pullRequest=<pr>"
```

Issues for a branch:

```bash
curl -sSf -u "$SONAR_TOKEN:" \
  "$SONAR_HOST_URL/api/issues/search?organization=<org>&projectKeys=<projectKey>&branch=<branch>&statuses=OPEN,CONFIRMED"
```

Leak-period filter (may require a component key; remove if it 400s):

```bash
curl -sSf -u "$SONAR_TOKEN:" \
  "$SONAR_HOST_URL/api/issues/search?organization=<org>&componentKeys=<componentKey>&sinceLeakPeriod=true"
```

Quality gate status:

```bash
curl -sSf -u "$SONAR_TOKEN:" \
  "$SONAR_HOST_URL/api/qualitygates/project_status?organization=<org>&projectKey=<projectKey>&pullRequest=<pr>"
```

Issue details (SonarCloud may 404 on `issues/show`; use search by issue key):

```bash
curl -sSf -u "$SONAR_TOKEN:" \
  "$SONAR_HOST_URL/api/issues/search?organization=<org>&projectKeys=<projectKey>&issues=<issueKey>"
```

## Mapping issues to files
- `component` fields are typically `org_projectKey:path/to/file`.
- Strip the project prefix to map to local paths, then jump to `line`.

Quick jq view:

```bash
jq -r '.issues[] | {key,rule,severity,type,component,line,message} | @json'
```

## Troubleshooting
- `401/403`: token missing or insufficient permissions (needs Browse access to the project/org).
- `400`: remove optional query params or confirm `organization` and `projectKeys` values; `sinceLeakPeriod` can require `componentKeys`.
- Empty results: ensure the PR/branch has a completed Sonar analysis run.