SonarQube package v1.0.0

A SonarQube Server user token, held in the client's own secret manager. Token issuance is external: a user (or, for service accounts, an administrator via the instance's token administration) generates the token under Account > My Account > Security, and the deployment's custody job stores it under this reference. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the token — SonarQube's Web API documentation recommends the bearer scheme and documents that tokens may alternatively be sent as the username half of HTTP Basic with an empty password; this pack registers the Bearer form only.

Token permissions: a USER token carries ALL the permissions of the issuing user (SonarQube states a global admin's user token gives full rights to the instance), so the token must be issued for a dedicated least-privilege service account holding only the permissions the enabled capabilities need (Browse on the bound projects for the reads; Administer Issues on the bound projects for issue transitions; the instance's quality-gate administration permission for gate assignment; the global Create Projects permission for project creation; Administer on a project only where project deletion is enabled — permission names and the supported transition set were verified during the documented review against the machine-readable web services listing on SonarSource's public instance (next.sonarqube.com/api/webservices/list), but instance versions differ, so confirm against the target instance's own /web_api console at deployment) — never a personal admin's token.

Project and global ANALYSIS tokens exist but are scoped to analysis and do not fit these capabilities.

Expiry and revocation: tokens may be created with an expiration or with no expiration; Enterprise editions let an administrator enforce a maximum lifetime; tokens can be revoked at any time under My Account > Security, and a project analysis token stops working if its author loses Execute Analysis permission. SonarQube adds a SonarQube-Authentication-Token-Expiration header to API responses so a custody job can track upcoming expiry; an expired or revoked value fails closed.

Revocation limit: revoking the service account's SESSION or changing its password does not invalidate already-issued tokens — revocation is per-token.

Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

The endpoint host 'sonarqube-server.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's own SonarQube Server base URL before enabling, in every endpoint, in the resource locator and in every egress allowlist entry. The allowlist matches exactly, so endpoints and allowlist must be substituted together, and substitution is a required deployment step. Request parameters: the registered paths are operation paths only — project, issue and gate selection are sent as caller-supplied form parameters (project, issue, gateName per each operation's parameter names), and nothing in this registration binds or records them at installation: they remain caller-controlled on every request unless a separately reviewed control restricts them. POST operations use application/x-www-form-urlencoded bodies per SonarQube's Web API guidance (parameters in the body, not the URI query string, so they are passed securely).

Approval classification: collection reads (projects, issues) and single-resource reads (measures, quality gate status) sit at the minimum R0 tier; issue transitions and quality gate assignment are reversible workflow/configuration updates at the minimum R2 tier — but transitioning a security issue to accepted or false-positive, or changing a project's quality gate, changes what the quality gate reports and can hide a real finding from release controls: the minimum R2 tier is a minimum, and policy should scope these capabilities to named actors and projects.

Project delete sits at the minimum R3 tier: deleting a project removes it and its analysis history, and delete is one of the designated actions requiring human approval.

Documented exclusions: this pack does not register user and group administration (api/users, api/user_groups), permission management (api/permissions — granting permissions is access-granting and needs its own review), token administration endpoints (api/user_tokens — token issuance and revocation are an external custody process, see the credential note), quality gate and quality profile creation/modification beyond project assignment (instance-wide governance settings), webhook management, analysis submission (the scanner's ce endpoints), and the X-Sonar-Passcode system authentication scheme (a server-wide passcode for monitoring endpoints, not a per-user credential — not registered).

Source basis: SonarQube documents its web services in the running server's own /web_api console, which is client-rendered; the HTML console returned only the client shell, but the console's machine-readable listing on SonarSource's public instance (https://next.sonarqube.com/sonarqube/api/webservices/list) was retrieved during the documented review and documents every registered operation — api/projects/search (GET), api/issues/search (GET, Browse on the project), api/measures/component (GET, Browse or Execute Analysis on the project), api/qualitygates/project_status (GET), api/issues/do_transition (POST; transitions confirm/unconfirm/reopen/resolve/falsepositive/wontfix/accept, with accept, wontfix and falsepositive requiring Administer Issues), api/qualitygates/select (POST; Administer Quality Gates or Administer on the project; params gateName and projectKey), api/projects/create (POST; global Create Projects) and api/projects/delete (POST; Administer System or Administer on the project).

Instance versions differ, so each path and parameter set must still be confirmed against the target instance's own /web_api console before enabling.