What causes "HTTP method POST is required" in SonarSource/sonarqube?

Resend the request with -X POST (plus required params as form/body parameters).

SonarSource/sonarqube · error · ServerException

HTTP method POST is required

Error message

HTTP method POST is required

What it means

Thrown by RequestVerifier.verifyRequest when a GET request is issued against a web service action declared as POST-only. The server responds with HTTP 405 Method Not Allowed telling the client the action requires POST.

Solutions

Resend the request with -X POST (plus required params as form/body parameters).
Check the endpoint's declared method in the web service documentation and use the listed verb.
If a GET variant exists, use the appropriate action rather than forcing GET on the POST one.

Example fix

// before
curl -u $TOKEN "$SONAR/api/user_tokens/generate?name=ci" // 405 POST required
// after
curl -u $TOKEN -X POST "$SONAR/api/user_tokens/generate?name=ci"

Defensive patterns

Strategy: validation

Validate before calling

# enforce the verb before calling
VERB=$(grep -o 'POST' <<< "$ENDPOINT_SPEC" || echo GET)
[ "$HTTP_METHOD" = "$VERB" ] || { echo "Use $VERB for $PATH"; exit 1; }

Try / catch

if (response.code() == 405 && response.message().contains("POST is required")) {
  retryAsPost();
}

Prevention

Check the HTTP verb in the API docs for every endpoint used in scripts.
Never 'test' POST endpoints in the browser address bar.
Encode the verb alongside the URL in shared request collections.

When it happens

Trigger: Issuing GET (e.g. in a browser address bar or curl without -X POST) to a POST action such as api/webhooks/create, api/issues/do_transition, api/user_tokens/generate (POST-declared actions).

Common situations: Pasting a POST-only API URL into a browser to 'test' it; scripts using the default curl GET; REST clients defaulting to GET; copying a URL from docs without matching the documented HTTP verb.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/568e18e4a8f1c7b0. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-ws/src/main/java/org/sonar/server/ws/RequestVerifier.java:37

 */
package org.sonar.server.ws;

import org.sonar.api.server.ws.Request;
import org.sonar.api.server.ws.WebService;
import org.sonar.server.exceptions.ServerException;

import static jakarta.servlet.http.HttpServletResponse.SC_METHOD_NOT_ALLOWED;

public class RequestVerifier {
  private RequestVerifier() {
    // static methods only
  }

  public static void verifyRequest(WebService.Action action, Request request) {
    switch (request.method()) {
      case "GET":
        if (action.isPost()) {
          throw new ServerException(SC_METHOD_NOT_ALLOWED, "HTTP method POST is required");
        }
        break;
      case "POST":
        if (!action.isPost()) {
          throw new ServerException(SC_METHOD_NOT_ALLOWED, "HTTP method GET is required");
        }
        break;
      default:
        throw new ServerException(SC_METHOD_NOT_ALLOWED, String.format("HTTP method %s is not allowed", request.method()));
    }
  }
}

View on GitHub (pinned to 184c821202)