Subscribe via the StackOne dashboard

This connector uses Programmatic Webhooks. When you enable webhook events for a connected SonarCloud account, StackOne automatically registers a single organisation-scoped webhook via the SonarCloud Webhooks API (`POST api/webhooks/create`), pointing at your StackOne callback URL. No manual configuration in SonarCloud is required.

The Personal Access Token used to authenticate must belong to a user with Administer permission on the SonarCloud organisation. Webhook creation will fail with a 403 if the token holder is not an org admin.

In the StackOne dashboard, open the SonarCloud connector profile and enable the webhook events you want delivered downstream. StackOne creates a single webhook that receives all event types — you can enable or disable individual event types from the dashboard without modifying the webhook in SonarCloud.

Trigger a matching change in SonarCloud (for example, run an analysis or triage an issue to flip the quality gate) and confirm the event reaches your downstream consumer.

SonarCloud posts each event as a JSON payload; StackOne responds with `200 OK` automatically.
SonarCloud retries failed deliveries a limited number of times. If your endpoint is persistently unavailable, the webhook may be automatically deactivated.

If a Secret is configured when the webhook is created, SonarCloud signs each delivery with an `X-Sonar-Webhook-HMAC-SHA256` header (lowercase-hex HMAC-SHA256 of the raw request body). The full raw payload is forwarded so downstream consumers can verify the signature independently.

Disconnecting the account in StackOne automatically deletes the managed webhook from SonarCloud, stopping all deliveries.

Available Webhook Events

SonarCloud has a single underlying webhook — analysis-result delivery — with no typed discriminator field. StackOne carves the following mutually-exclusive events from the delivery's `status` and `qualityGate.status` fields, so you can subscribe to exactly the outcomes you care about. All events carry the same envelope: `taskId`, `status`, `analysedAt`, `revision`, `project`, `branch`, `qualityGate` (when evaluated), and `properties`.

Fired when a CI/CD analysis background task completes. The webhook fires regardless of task status, so failures and cancellations are delivered too.

Project Analysis Completed (`project_analysis_completed`) — analysis succeeded but no quality gate verdict was present (gate not configured/evaluated). The gate-less completion signal.
Project Analysis Failed (`project_analysis_failed`) — the analysis background task failed (`status: FAILED`). Useful for CI reliability alerting.
Project Analysis Canceled (`project_analysis_canceled`) — the analysis background task was canceled (`status: CANCELED`).

Fired when a successful analysis produces a quality gate verdict.

Quality Gate Passed (`quality_gate_passed`) — analysis succeeded and the quality gate result is `OK` (the code passed the gate). Carries the passing `qualityGate` with all evaluated conditions.
Quality Gate Failed (`quality_gate_failed`) — analysis succeeded but the quality gate result is `ERROR` (the code did not pass the gate). Carries the failing `qualityGate` with all evaluated conditions.

Delivery format

Details of how SonarCloud delivers events to StackOne.

SonarCloud delivers each event as an HTTP POST with `Content-Type: application/json`. Events are NOT batched — one webhook call per event. Both event types share the same JSON envelope shape; StackOne routes them by field presence (`taskId` present → analysis completed; `taskId` absent and `changedAt` present → quality gate changed).

Every delivery includes `X-SonarQube-Project` (the project key). When a webhook secret is configured, `X-Sonar-Webhook-HMAC-SHA256` carries the HMAC-SHA256 hex signature of the raw body.