SonarSource/sonarqube · error · IllegalArgumentException

Both 'severity' and 'impacts' parameters cannot be set at…

Error message

Both 'severity' and 'impacts' parameters cannot be set at the same time

What it means

UpdateAction.readRequest rejects requests that supply both the legacy 'severity' parameter and the newer 'impacts' parameter, since the two models conflict. Supplying both throws IllegalArgumentException telling the caller to pick one.

Solutions

1. Remove the 'severity' parameter and use only 'impacts' (e.g. impacts=SECURITY>HIGH) for impact-based rules
2. Or remove 'impacts' and keep 'severity' with a classic value (INFO..BLOCKER)
3. Audit automation that always includes severity and make it conditional on which model the request uses

Example fix

// before
POST api/rules/update?key=java:S2076&severity=MAJOR&impacts=SECURITY>HIGH
// after
POST api/rules/update?key=java:S2076&impacts=SECURITY>HIGH

if (params.severity != null && params.impacts != null) {
  throw new Error("Pass either 'severity' or 'impacts' to api/rules/update, not both");
}

function usesSingleSeverityModel(p) {
  return (p.severity == null) !== (p.impacts == null);
}

try {
  await post("api/rules/update", params);
} catch (e) {
  if (String(e.message).includes("cannot be set at the same time")) {
    delete params.severity; // prefer the impacts model
    await post("api/rules/update", params);
  }
}

When it happens

Trigger: Calling api/rules/update with both severity=... and impacts=... in the query/body, typically when a script was extended to add impacts without removing the old severity parameter.

Common situations: Migration-period scripts that grew parameters incrementally; generic rule-update wrappers that always send severity and were extended to forward impacts; retry logic replaying merged payloads.

Related errors

• Cannot change the assignee of this hotspot given its…
• Cannot parse
• ${e.getMessage()}
• Impacts are is missing
• Invalid message type:

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/e07b24e91c5a9983. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/rule/ws/UpdateAction.java:203

  private RuleUpdate readRequest(DbSession dbSession, Request request) {
    RuleKey key = RuleKey.parse(request.mandatoryParam(PARAM_KEY));
    RuleUpdate update = createRuleUpdate(dbSession, key);
    readTags(request, update);
    readMarkdownNote(request, update);
    readDebt(request, update);

    String name = request.param(PARAM_NAME);
    if (name != null) {
      update.setName(name);
    }
    String description = request.param(PARAM_DESCRIPTION);
    if (description != null) {
      update.setMarkdownDescription(description);
    }
    String severity = request.param(PARAM_SEVERITY);
    String impacts = request.param(PARAM_IMPACTS);
    if (impacts != null && severity != null) {
      throw new IllegalArgumentException("Both 'severity' and 'impacts' parameters cannot be set at the same time");
    }
    if (impacts != null) {
      Map<SoftwareQuality, org.sonar.api.issue.impact.Severity> parsedImpact = parseImpacts(impacts);
      update.setImpactSeverities(parsedImpact);
    }
    if (severity != null) {
      update.setSeverity(severity);
    }
    String status = request.param(PARAM_STATUS);
    if (status != null) {
      update.setStatus(RuleStatus.valueOf(status));
    }
    String params = request.param(PARAMS);
    if (params != null) {
      update.setParameters(KeyValueFormat.parse(params));
    }
    return update;
  }

View on GitHub (pinned to 184c821202)