SonarSource/sonarqube · error · ServerException

HTTP method GET is required

Error message

HTTP method GET is required

What it means

Thrown by RequestVerifier.verifyRequest when a POST request is issued against a web service action declared as GET-only. The server responds with HTTP 405 Method Not Allowed indicating the action requires GET.

Solutions

1. Resend the request as GET (curl without -X, or -X GET).
2. Verify the action's allowed method in the web service documentation.
3. Fix scripts/clients that apply a single HTTP verb to all endpoints.

Example fix

// before
curl -u $TOKEN -X POST "$SONAR/api/system/status" // 405 GET required
// after
curl -u $TOKEN "$SONAR/api/system/status"

# read-only endpoints should default to GET
case "$PATH" in
  */api/system/status|*/api/server/version) METHOD=GET ;;
esac

if (response.code() == 405 && response.message().contains("GET is required")) {
  retryAsGet();
}

When it happens

Trigger: Issuing POST (curl -X POST, or a REST client set to POST) against a GET action such as api/navigation, api/server/version, api/system/status, or any search/show action that only supports GET.

Common situations: Scripts that blanket-use -X POST for every curl call; REST client collections reused across endpoints with the wrong verb; frameworks/tests invoking everything as POST.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• HTTP method POST is required
• Both 'severity' and 'impacts' parameters cannot be set at…
• Cannot change the assignee of this hotspot given its…
• Cannot parse
• ${e.getMessage()}

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/80d2c00ace6805df. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-ws/src/main/java/org/sonar/server/ws/RequestVerifier.java:42

import org.sonar.server.exceptions.ServerException;

import static jakarta.servlet.http.HttpServletResponse.SC_METHOD_NOT_ALLOWED;

public class RequestVerifier {
  private RequestVerifier() {
    // static methods only
  }

  public static void verifyRequest(WebService.Action action, Request request) {
    switch (request.method()) {
      case "GET":
        if (action.isPost()) {
          throw new ServerException(SC_METHOD_NOT_ALLOWED, "HTTP method POST is required");
        }
        break;
      case "POST":
        if (!action.isPost()) {
          throw new ServerException(SC_METHOD_NOT_ALLOWED, "HTTP method GET is required");
        }
        break;
      default:
        throw new ServerException(SC_METHOD_NOT_ALLOWED, String.format("HTTP method %s is not allowed", request.method()));
    }
  }
}

View on GitHub (pinned to 184c821202)