SonarSource/sonarqube · error · ServerException

HTTP method is not allowed

Error message

HTTP method %s is not allowed

What it means

RequestVerifier.verifyRequest checks that the HTTP method used on a web service endpoint matches the method the action declares. SonarQube web service actions support only GET or POST; any other method (PUT, DELETE, PATCH, OPTIONS, HEAD, etc.) falls to the default branch and throws a 405 ServerException with the actual method name in the message.

Solutions

1. Change the request to GET (for read actions) or POST (for actions declared isPost()), matching the endpoint's documented method
2. Check the web service documentation (web_api or /api_documentation) for the correct HTTP method per endpoint
3. If a proxy/gateway is rewriting the method, configure it to pass GET/POST through unchanged

Example fix

// before
curl -X DELETE https://sonar/api/projects/index
// after
curl -X POST https://sonar/api/projects/delete -d 'project=my_project'

if (method !== 'GET' && method !== 'POST') throw new Error(`Sonar WS endpoints accept only GET/POST, got ${method}`);

const isAllowedMethod = (m) => m === 'GET' || m === 'POST';

When it happens

Trigger: Calling any SonarQube /api/... endpoint with an HTTP method other than GET or POST, e.g. an HTTP DELETE or PUT request against a web service action, or a tool/proxy that rewrites the method.

Common situations: Automated scripts or REST clients using REST verbs not supported by the SonarQube WS API; proxies or API gateways translating GET/POST into other methods; frameworks with method override headers sending PUT/DELETE.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• Connection to Azure marketplace failed. Details
• Could not parse GitLab answer when creating a project…
• Could not validate GitLab write permission. Got an…
• Error on
• Error while executing a call to

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/aa92814422a2abdc. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-ws/src/main/java/org/sonar/server/ws/RequestVerifier.java:46

public class RequestVerifier {
  private RequestVerifier() {
    // static methods only
  }

  public static void verifyRequest(WebService.Action action, Request request) {
    switch (request.method()) {
      case "GET":
        if (action.isPost()) {
          throw new ServerException(SC_METHOD_NOT_ALLOWED, "HTTP method POST is required");
        }
        break;
      case "POST":
        if (!action.isPost()) {
          throw new ServerException(SC_METHOD_NOT_ALLOWED, "HTTP method GET is required");
        }
        break;
      default:
        throw new ServerException(SC_METHOD_NOT_ALLOWED, String.format("HTTP method %s is not allowed", request.method()));
    }
  }
}

View on GitHub (pinned to 184c821202)