canonical: https://jentic.com/apis/sonarqube.org/sonarqube

# SonarQube Web API

SonarQube/SonarCloud Web API for code quality and security analysis. Provides access to projects, issues, measures, users, and more. The API exposes 7 endpoints secured with basic, bearer authentication.

## For AI agents

Programmatically validate credentials, logout. Covers 7 operations with basic, bearer authentication.

## Scope

Does not handle payments, communications, or crm - use for security only.

## Capabilities

- Validate credentials
- Logout
- Search projects
- Get component measures
- List web services

## Use cases

### Security Operations

Use the SonarQube Web API to perform security operations programmatically. The API provides 7 endpoints covering core functionality including validate credentials, logout, search projects.

Example prompt: Call GET `/authentication/validate` to validate credentials

### Automated authentication Management

Automate authentication operations by combining multiple SonarQube Web API endpoints. Agents can logout and then search projects in a single workflow.

Example prompt: Call POST `/authentication/logout` to logout, then verify the result

### AI Agent Integration via Jentic

AI agents discover and call SonarQube Web API endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle basic, bearer tokens manually.

Example prompt: Search Jentic for 'validate credentials', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/authentication/validate` | Validate credentials |
| POST | `/authentication/logout` | Logout |
| GET | `/projects/search` | Search projects |
| GET | `/issues/search` | Search issues |
| GET | `/measures/component` | Get component measures |
| GET | `/ce/activity` | Get compute engine tasks |
| GET | `/webservices/list` | List web services |

## Key resources

- **authentication** — Authentication operations
- **projects** — Project management
- **issues** — Issue tracking and management
- **measures** — Code metrics and measures
- **ce** — Compute Engine tasks

## Why Jentic

- **Setup:** Wiring the SonarQube Web API by hand means choosing between basic and token bearer auth, pointing at either the sonarcloud.io/api host or a local SonarQube host, and handling paging and retries on its search calls yourself. Through Jentic you install once, import the SonarQube Web API from the API Directory, store the token once, and your agent calls it.
- **Permission scoping:** The SonarQube Web API targets projects and issues through query parameters rather than resource ids in the URL path, so scope the agent to the operations it needs, such as searching projects, searching issues, or reading component measures. You choose the operations it may call, so state-changing ones like logging a user out are not included unless you add them.
- **Credential handling:** Your SonarQube token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'search issues in a project' or 'read component measures', and Jentic returns the matching SonarQube Web API operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Snyk** — Alternative security API
- **Crowdstrike** — Alternative security API

## FAQ

### What authentication does the SonarQube Web API use?

The SonarQube Web API uses basic, bearer authentication. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I validate credentials with the SonarQube Web API?

Yes. Use the GET `/authentication/validate` endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the SonarQube Web API?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I validate credentials through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'validate credentials'. Jentic returns the matching SonarQube Web API operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the SonarQube Web API have?

The SonarQube Web API exposes 7 endpoints covering authentication, projects, issues operations.

### Can I limit what my agent is allowed to do with the SonarQube Web API?

Yes. Because you run Jentic One yourself, your own rules decide which SonarQube operations and credentials your agent can use. You can scope it to read-only calls such as searching projects, searching issues, or reading component measures, and leave out state-changing operations like logging a user out unless you explicitly grant them. The stored SonarQube token is injected only for the operations you allow, so the agent can never reach endpoints you have not enabled.