SonarSource/sonarqube · error · IllegalArgumentException

Can't install plugin without accepting firstly plugins risk…

Error message

Can't install plugin without accepting firstly plugins risk consent

What it means

InstallAction implements api/plugins/install. As a safety measure, plugin installation through this Web API is only allowed when the caller explicitly accepted the plugin risk consent, expressed via the sonar.plugins.risk.consent configuration set to ACCEPTED. Without that consent the action fails fast with IllegalArgumentException before touching the update center.

Solutions

Add sonar.plugins.risk.consent=ACCEPTED to sonar.properties (and restart) or set it via the Web API/settings so the consent check passes.
Confirm the value matches the PluginRiskConsent enum exactly (ACCEPTED, uppercase); any other string is ignored.
If the consent dialog is the intended flow, perform the install through the Marketplace UI once, which records the acceptance.

Example fix

// before
# sonar.properties (missing consent)
# sonar.web.systemPasscode=...
// after
# sonar.properties
sonar.plugins.risk.consent=ACCEPTED

Defensive patterns

Strategy: validation

Validate before calling

const consent = settings['sonar.plugins.risk.consent'];
if (consent !== 'ACCEPTED') {
  throw new Error('set sonar.plugins.risk.consent=ACCEPTED before api/plugins/install');
}

Try / catch

try {
  await api.plugins.install({ key });
} catch (e) {
  if (String(e.message).includes('plugins risk consent')) {
    await setSetting('sonar.plugins.risk.consent', 'ACCEPTED');
    await api.plugins.install({ key });
  } else { throw e; }
}

Prevention

Provision sonar.plugins.risk.consent=ACCEPTED in server config for automated installs.
Match the enum value exactly (uppercase ACCEPTED).
Document the consent requirement in deployment runbooks.

When it happens

Trigger: POST api/plugins/install?key=<key> where property sonar.plugins.risk.consent is unset or set to any value other than ACCEPTED, even when the user is a system administrator and the edition check passed.

Common situations: Automation (Ansible, Helm hooks, CI) installing plugins on fresh SonarQube servers where the risk-consent property was never added; upgrading automation written before the consent property was introduced.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/97d95c7718e0c6e5. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/plugins/ws/InstallAction.java:89

        BR_HTML_TAG +
        "Plugin information is retrieved from Update Center." +
        BR_HTML_TAG +
        "Fails if used on commercial editions or plugin risk consent has not been accepted." +
        BR_HTML_TAG +
        "Requires user to be authenticated with Administer System permissions")
      .setHandler(this);

    action.createParam(PARAM_KEY).setRequired(true)
      .setDescription("The key identifying the plugin to install");
  }

  @Override
  public void handle(Request request, Response response) throws Exception {
    userSession.checkIsSystemAdministrator();
    checkEdition();

    if (!hasPluginInstallConsent()) {
      throw new IllegalArgumentException("Can't install plugin without accepting firstly plugins risk consent");
    }

    String key = request.mandatoryParam(PARAM_KEY);
    PluginUpdate pluginUpdate = findAvailablePluginByKey(key);
    pluginDownloader.download(key, pluginUpdate.getRelease().getVersion());
    response.noContent();
  }

  private void checkEdition() {
    Edition edition = editionProvider.get().orElse(Edition.COMMUNITY);
    if (!Edition.COMMUNITY.equals(edition)) {
      throw new IllegalArgumentException("This WS is unsupported in commercial edition. Please install plugin manually.");
    }
  }

  private boolean hasPluginInstallConsent() {
    Optional<String> pluginRiskConsent = configuration.get(PLUGINS_RISK_CONSENT);
    return pluginRiskConsent.filter(s -> PluginRiskConsent.valueOf(s) == PluginRiskConsent.ACCEPTED).isPresent();

View on GitHub (pinned to 184c821202)