SonarCloud API

Overview

SonarCloud provides two API versions for programmatic access:

• Web API v2 - Modern REST API with OpenAPI specifications at https://api.sonarcloud.io/api/v2/
• Web API v1 - Legacy API at https://sonarcloud.io/api/ with comprehensive endpoint coverage

Quick start

# Get project metrics
curl -X GET "https://sonarcloud.io/api/measures/component?component=my_project&metricKeys=bugs,vulnerabilities,code_smells" \
  -H "Authorization: Bearer YOUR_TOKEN"

Authentication

Use bearer token authentication for all requests:

Authorization: Bearer <token>

Token types

Token Type	Plan	Scope	Use Case
Personal Access Token	Free	User-level	Individual API access
Organisation Token	Team	Organisation-scoped	CI/CD, automation

Generate tokens at Account > Security > Generate Tokens in SonarCloud UI.

Base URLs

API Version	Base URL
Web API v1	https://sonarcloud.io/api/
Web API v2	https://api.sonarcloud.io/api/v2/

Request format

Content-Type: application/x-www-form-urlencoded (v1) or application/json (v2)

For POST requests, use form data parameters rather than URI query parameters.

Rate limiting

Requests are rate-limited. When exceeded, the API returns HTTP 429. Wait several minutes before retrying.

Pagination

Most list endpoints support pagination with p (page number) and ps (page size) parameters.

Common tasks

Get project quality gate status

curl -X GET "https://sonarcloud.io/api/qualitygates/project_status?projectKey=my_project" \
  -H "Authorization: Bearer YOUR_TOKEN"

Search issues

curl -X GET "https://sonarcloud.io/api/issues/search?componentKeys=my_project&types=BUG,VULNERABILITY" \
  -H "Authorization: Bearer YOUR_TOKEN"

Get component measures

curl -X GET "https://sonarcloud.io/api/measures/component?component=my_project&metricKeys=ncloc,coverage,duplicated_lines_density" \
  -H "Authorization: Bearer YOUR_TOKEN"

List projects

# v2 API
curl -X GET "https://api.sonarcloud.io/api/v2/projects?organization=my_org" \
  -H "Authorization: Bearer YOUR_TOKEN"

API reference

For detailed endpoint documentation, see the reference files:

• v2-api.md - Modern v2 API endpoints (Projects, Quality Gates, Analysis, Organisations)
• v1-api.md - Legacy v1 API endpoints (Issues, Measures, Components, Rules)
• metrics.md - Available metric keys and their meanings

Error handling

Status Code	Meaning
400	Bad request - check parameters
401	Unauthorised - invalid or missing token
403	Forbidden - insufficient permissions
404	Not found - resource does not exist
429	Rate limited - wait and retry
500	Server error

CI/CD integration examples

GitHub Actions

- name: Check Quality Gate
  run: |
      STATUS=$(curl -s -H "Authorization: Bearer ${{ secrets.SONAR_TOKEN }}" \
        "https://sonarcloud.io/api/qualitygates/project_status?projectKey=${{ vars.SONAR_PROJECT_KEY }}" \
        | jq -r '.projectStatus.status')
      if [ "$STATUS" != "OK" ]; then
        echo "Quality Gate failed"
        exit 1
      fi

GitLab CI

check_quality_gate:
    script:
        - |
            STATUS=$(curl -s -H "Authorization: Bearer $SONAR_TOKEN" \
              "https://sonarcloud.io/api/qualitygates/project_status?projectKey=$SONAR_PROJECT_KEY" \
              | jq -r '.projectStatus.status')
            if [ "$STATUS" != "OK" ]; then exit 1; fi