Skip to main content

​
Prerequisites

Before continuing, you should have already completed the following for this connector:
1

Configure the Connector

Enable the connector and set up its connector profile in your project. See Managing Connectors.

Connector Profile

SonarQube Cloud - Personal Access Token (Bearer)
2

Link an Account

Connect an account using StackOne Hub or Auth Link.

Link Account

SonarQube Cloud - Personal Access Token (Bearer)

​
Subscribe via the StackOne dashboard

This connector uses Programmatic Webhooks. When you enable webhook events for a connected SonarCloud account, StackOne automatically registers a single organisation-scoped webhook via the SonarCloud Webhooks API (POST api/webhooks/create), pointing at your StackOne callback URL. No manual configuration in SonarCloud is required.

1

Confirm permissions

The Personal Access Token used to authenticate must belong to a user with Administer permission on the SonarCloud organisation. Webhook creation will fail with a 403 if the token holder is not an org admin.

2

Enable events in the StackOne dashboard

In the StackOne dashboard, open the SonarCloud connector profile and enable the webhook events you want delivered downstream. StackOne creates a single webhook that receives all event types — you can enable or disable individual event types from the dashboard without modifying the webhook in SonarCloud.

3

Verify delivery

Trigger a matching change in SonarCloud (for example, run an analysis or triage an issue to flip the quality gate) and confirm the event reaches your downstream consumer.

  • SonarCloud posts each event as a JSON payload; StackOne responds with 200 OK automatically.
  • SonarCloud retries failed deliveries a limited number of times. If your endpoint is persistently unavailable, the webhook may be automatically deactivated.
4

Webhook signature verification

If a Secret is configured when the webhook is created, SonarCloud signs each delivery with an X-Sonar-Webhook-HMAC-SHA256 header (lowercase-hex HMAC-SHA256 of the raw request body). The full raw payload is forwarded so downstream consumers can verify the signature independently.

5

Unsubscribe

Disconnecting the account in StackOne automatically deletes the managed webhook from SonarCloud, stopping all deliveries.

​
Available Webhook Events

SonarCloud has a single underlying webhook — analysis-result delivery — with no typed discriminator field. StackOne carves the following mutually-exclusive events from the delivery’s status and qualityGate.status fields, so you can subscribe to exactly the outcomes you care about. All events carry the same envelope: taskId, status, analysedAt, revision, project, branch, qualityGate (when evaluated), and properties.

1

Analysis outcome events

Fired when a CI/CD analysis background task completes. The webhook fires regardless of task status, so failures and cancellations are delivered too.

  • Project Analysis Completed (project_analysis_completed) — analysis succeeded but no quality gate verdict was present (gate not configured/evaluated). The gate-less completion signal.
  • Project Analysis Failed (project_analysis_failed) — the analysis background task failed (status: FAILED). Useful for CI reliability alerting.
  • Project Analysis Canceled (project_analysis_canceled) — the analysis background task was canceled (status: CANCELED).
2

Quality gate events

Fired when a successful analysis produces a quality gate verdict.

  • Quality Gate Passed (quality_gate_passed) — analysis succeeded and the quality gate result is OK (the code passed the gate). Carries the passing qualityGate with all evaluated conditions.
  • Quality Gate Failed (quality_gate_failed) — analysis succeeded but the quality gate result is ERROR (the code did not pass the gate). Carries the failing qualityGate with all evaluated conditions.

​
Delivery format

Details of how SonarCloud delivers events to StackOne.

1

JSON payloads, one event per request

SonarCloud delivers each event as an HTTP POST with Content-Type: application/json. Events are NOT batched — one webhook call per event. Both event types share the same JSON envelope shape; StackOne routes them by field presence (taskId present → analysis completed; taskId absent and changedAt present → quality gate changed).

2

Additional headers

Every delivery includes X-SonarQube-Project (the project key). When a webhook secret is configured, X-Sonar-Webhook-HMAC-SHA256 carries the HMAC-SHA256 hex signature of the raw body.

​
Verify

Your Connector should now be able to receive and process events. Try triggering an event and you should see an Event appear in the Connector logs.