SonarCloud Integration

Base: https://sonarcloud.io/api | Auth: Bearer $SONARCLOUD_TOKEN

Configuration

Environment Variables: Required for authentication

SONARCLOUD_TOKEN - Generate at sonarcloud.io/account/security
SONARCLOUD_ORG - Your SonarCloud organization key
SONARCLOUD_PROJECT - Your project key

Option 1: Use .env.local (Recommended) Add to your project's .env.local:

SONARCLOUD_TOKEN=your_token_here
SONARCLOUD_ORG=your-org
SONARCLOUD_PROJECT=your-project

Before querying, load environment variables:

# Load .env.local into current environment
export $(grep -v '^#' .env.local | xargs)

Option 2: Export directly

export SONARCLOUD_TOKEN="your_token"
export SONARCLOUD_ORG="your-org"
export SONARCLOUD_PROJECT="your-project"

# Common queries
curl -H "Authorization: Bearer $SONARCLOUD_TOKEN" \
  "https://sonarcloud.io/api/issues/search?organization=$SONARCLOUD_ORG&componentKeys=$SONARCLOUD_PROJECT&resolved=false"
curl -H "Authorization: Bearer $SONARCLOUD_TOKEN" \
  "https://sonarcloud.io/api/measures/component?component=$SONARCLOUD_PROJECT&metricKeys=bugs,coverage"
curl -H "Authorization: Bearer $SONARCLOUD_TOKEN" \
  "https://sonarcloud.io/api/qualitygates/project_status?projectKey=$SONARCLOUD_PROJECT"

Endpoints

Endpoint	Purpose	Key Params
`/api/issues/search`	Bugs, vulnerabilities	`types`, `severities`, `branch`, `pullRequest`
`/api/measures/component`	Coverage, complexity	`metricKeys`, `branch`, `pullRequest`
`/api/qualitygates/project_status`	Pass/fail status	`projectKey`, `branch`, `pullRequest`
`/api/hotspots/search`	Security hotspots	`projectKey`, `status`
`/api/projects/search`	List projects	`organization`, `q`
`/api/project_analyses/search`	Analysis history	`project`, `from`, `to`
`/api/measures/search_history`	Metrics over time	`component`, `metrics`, `from`
`/api/components/tree`	Files with metrics	`qualifiers=FIL`, `metricKeys`
`/api/duplications/show`	Duplicate code blocks	`key` (file key), `branch`
`/api/sources/raw`	Raw source code	`key` (file key), `branch`
`/api/sources/scm`	SCM blame info	`key`, `from`, `to`
`/api/ce/activity`	Background tasks	`component`, `status`, `type`
`/api/qualityprofiles/search`	Quality profiles	`language`, `project`
`/api/languages/list`	Supported languages	-
`/api/project_branches/list`	Project branches	`project`
`/api/project_badges/measure`	SVG badge	`project`, `metric`, `branch`
`/api/rules/search`	Coding rules	`languages`, `severities`, `types`

Common Filters

Issues: types=BUG,VULNERABILITY,CODE_SMELL | severities=BLOCKER,CRITICAL,MAJOR | resolved=false | inNewCodePeriod=true

Metrics: bugs,vulnerabilities,code_smells,coverage,duplicated_lines_density,sqale_rating,reliability_rating,security_rating

New Code: new_bugs,new_vulnerabilities,new_coverage,new_duplicated_lines_density

Workflows

Health Check

curl ... "/api/qualitygates/project_status?projectKey=$PROJECT"
curl ... "/api/measures/component?component=$PROJECT&metricKeys=bugs,vulnerabilities,coverage,sqale_rating"
curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&resolved=false&facets=severities,types&ps=1"

PR Analysis

curl ... "/api/qualitygates/project_status?projectKey=$PROJECT&pullRequest=123"
curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&pullRequest=123&resolved=false"
curl ... "/api/measures/component?component=$PROJECT&pullRequest=123&metricKeys=new_bugs,new_coverage"

Security Audit

curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&types=VULNERABILITY&resolved=false"
curl ... "/api/hotspots/search?projectKey=$PROJECT&status=TO_REVIEW"

Duplication Analysis

# Get duplication metrics
curl ... "/api/measures/component?component=$PROJECT&metricKeys=duplicated_lines,duplicated_lines_density,duplicated_blocks,duplicated_files"

# Get files with most duplication
curl ... "/api/components/tree?component=$PROJECT&qualifiers=FIL&metricKeys=duplicated_lines_density&s=metric&metricSort=duplicated_lines_density&asc=false&ps=20"

# Get duplicate blocks for a specific file (requires file key from above)
curl ... "/api/duplications/show?key=my-project:src/utils/helpers.ts"

Response Processing

# Count by severity
curl ... | jq '.issues | group_by(.severity) | map({severity: .[0].severity, count: length})'

# Failed quality gate conditions
curl ... | jq '.projectStatus.conditions | map(select(.status == "ERROR"))'

# Metrics as key-value
curl ... | jq '.component.measures | map({(.metric): .value}) | add'

Detailed Reference

For complete API parameters and response schemas, see references/api-reference.md.

sonarcloud-analysis