Webhooks

Understanding the webhooks in SonarQube Cloud.

This feature is only available in the Team and Enterprise plans.

To configure your webhooks, see:

• Configuring webhooks for your organization

• Configuring webhooks for your project

Webhooks notify external services when:

• A project analysis is complete. This is done regardless of the status of the background task or of the quality gate.

• An issue type, severity, or status is updated, and this update changes the quality gate status. For example:

  • A user marks an issue as False Positive and the quality gate status turns green.

  • The severity of an issue is increased and the quality gate status turns red.

An HTTP(S) call including a JSON payload is sent to each configured URL. URLs may be specified at both the project and global levels. The project-level specification does not replace global-level webhooks. All hooks at both levels are called.

HTTP(S) call

The HTTP(S) call:

• Has an HTTP header X-SonarQube-Project with the project key to allow quick identification of the project involved.

• Includes a JSON document as payload, using the POST method. See below.

• Has a content type of application/json, with UTF-8 encoding.

Payload

The payload is a JSON document that includes:

• analysedAt: when the analysis was performed.

• project: the identification of the project analyzed.

• qualityGate: each quality gate criterion checked and its status.

• qualityGate.status: the quality gate status of the analysis.

• status and taskID: the status and the identifier of the background task.

• properties: user-specified properties.

You can define project parameters to be added to the payload.

Payload example

{
    "serverUrl": "<mySonarqubeURL>",
    "taskId": "AVh21JS2JepAEhwQ-b3u",
    "status": "SUCCESS",
    "analysedAt": "2016-11-18T10:46:28+0100",
    "revision": "c739069ec7105e01303e8b3065a81141aad9f129",
    "project": {
        "key": "myProject",
        "name": "My Project",
        "url": "https://mycompany.com/sonarqube/project/overview?id=myproject"
    },
    "properties": {
    },
    "qualityGate": {
        "conditions": [
            {
                "errorThreshold": "1",
                "metric": "new_security_rating",
                "onLeakPeriod": true,
                "operator": "GREATER_THAN",
                "status": "OK",
                "value": "1"
            },
            {
                "errorThreshold": "1",
                "metric": "new_reliability_rating",
                "onLeakPeriod": true,
                "operator": "GREATER_THAN",
                "status": "OK",
                "value": "1"
            },
            {
                "errorThreshold": "1",
                "metric": "new_maintainability_rating",
                "onLeakPeriod": true,
                "operator": "GREATER_THAN",
                "status": "OK",
                "value": "1"
            },
            {
                "errorThreshold": "80",
                "metric": "new_coverage",
                "onLeakPeriod": true,
                "operator": "LESS_THAN",
                "status": "NO_VALUE"
            }
        ],
        "name": "SonarQube way",
        "status": "OK"
    }
}

Webhook protection with HMAC

SonarQube can generate an HMAC to allow the third party service to verify the integrity and authenticity of the webhook they receive. To do so, it uses the HMAC-SHA256 algorithm and the secret stored in the webhook configuration.

Related pages

• Configuring webhooks for your organization

• Configuring webhooks for your project