SonarSource/sonarqube · error · IllegalArgumentException

One of the parameters 'severity' or 'impact' must be provide

Error message

One of the parameters 'severity' or 'impact' must be provided

What it means

SetSeverityAction requires at least one of 'severity' or 'impact'; a request containing neither cannot express what severity change is intended and is rejected with IllegalArgumentException (HTTP 400).

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/issue/ws/SetSeverityAction.java:222

    ComponentDto componentByUuid = response.getComponentByUuid(issue.projectUuid());
    if (componentByUuid == null) {
      throw new IllegalStateException("Component with uuid " + issue.projectUuid() + " not found");
    }
    return componentByUuid.getKey();
  }

  private static void createImpactsIfMissing(DefaultIssue issue, Map<SoftwareQuality, org.sonar.api.issue.impact.Severity> effectiveImpacts) {
    if (issue.impacts().isEmpty()) {
      issue.replaceImpacts(effectiveImpacts);
      issue.setChanged(true);
    }
  }

  private static void checkParams(@Nullable String severity, @Nullable String impact) {
    if (severity != null && impact != null) {
      throw new IllegalArgumentException("Parameters 'severity' and 'impact' cannot be used at the same time");
    } else if (severity == null && impact == null) {
      throw new IllegalArgumentException("One of the parameters 'severity' or 'impact' must be provided");
    }
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Include either severity=MAJOR (classic) or impact=RELIABILITY,HIGH (MQR) in the request
2. Validate in the client that one of the two values is non-empty before calling
3. Fix variable expansion so the parameter is not dropped

Example fix

// before
const body = {issue}; // severity missing
// after
const body = {issue, severity: 'MAJOR'}; // or {issue, impact: 'RELIABILITY,HIGH'}

if (!severity && !impact) throw new Error('severity or impact is required');

try { await post('/api/issues/set_severity', body); } catch (e) { if (e.status === 400 && e.message.includes('must be provided')) { /* prompt for severity then retry */ } else throw e; }

When it happens

Trigger: Calling POST api/issues/set_severity with only the 'issue' parameter, or where severity/impact params were dropped (empty shell variables, stripped query strings).

Common situations: Scripts with unset variables interpolating to empty; HTTP clients omitting null/empty params; copying a request template and forgetting to fill in the severity field.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Missing parameter : 'comment'
• Issue with key '%s' does not exist
• Cannot sort on field :
• Component of type '%s' is not supported
• Parameters 'severity' and 'impact' cannot be used at the sam

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/777e8d734de7051e. Report an issue: GitHub.