SonarSource/sonarqube · error · IllegalArgumentException

Only http and https schemes are supported

Error message

Only http and https schemes are supported

What it means

checkApiEndpoint() validates the GitHub App apiEndpoint URL before any HTTP call is made. URI.create must succeed and the resulting URI must have an http or https scheme; anything else (ftp, no scheme, custom schemes) triggers this IllegalArgumentException. It is an early fail-fast guard so requests are never attempted against an unsupported endpoint.

Source

Thrown at server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/GithubApplicationClientImpl.java:164

      return Optional.empty();
    }
  }

  @Override
  public void checkApiEndpoint(GithubAppConfiguration githubAppConfiguration) {
    if (StringUtils.isBlank(githubAppConfiguration.getApiEndpoint())) {
      throw new IllegalArgumentException("Missing URL");
    }

    URI apiEndpoint;
    try {
      apiEndpoint = URI.create(githubAppConfiguration.getApiEndpoint());
    } catch (IllegalArgumentException e) {
      throw new IllegalArgumentException("Invalid URL, " + e.getMessage());
    }

    if (!"http".equalsIgnoreCase(apiEndpoint.getScheme()) && !"https".equalsIgnoreCase(apiEndpoint.getScheme())) {
      throw new IllegalArgumentException("Only http and https schemes are supported");
    } else if (!isValidGitHubUrl(apiEndpoint)) {
      throw new IllegalArgumentException("Invalid GitHub URL");
    }
  }

  private static boolean isValidGitHubUrl(URI apiEndpoint) {
    String host = apiEndpoint.getHost();
    String path = apiEndpoint.getPath();
    if (host == null) {
      return false;
    }

    String lowerCaseHost = host.toLowerCase(Locale.ENGLISH);
    // GitHub.com (official public GitHub)
    if ("api.github.com".equals(lowerCaseHost)) {
      return true;
    }

View on GitHub (pinned to 184c821202)

Solutions

  1. Add the scheme to the api endpoint, e.g. https://api.github.com or https://github.example.com/api/v3
  2. Verify the scheme casing is irrelevant but spelling must be exactly http or https
  3. Check the alm setting sonar.auth.github.apiUrl / GitHub App api endpoint value in SonarQube configuration

Example fix

// before
.setApiEndpoint("api.github.com")
// after
.setApiEndpoint("https://api.github.com")
Defensive patterns

Strategy: validation

Validate before calling

try {
  URI uri = new URI(apiEndpoint);
  String scheme = uri.getScheme();
  if (scheme == null || !(scheme.equalsIgnoreCase("http") || scheme.equalsIgnoreCase("https"))) {
    throw new IllegalArgumentException("apiEndpoint must start with http:// or https://");
  }
} catch (URISyntaxException e) {
  throw new IllegalArgumentException("apiEndpoint is not a valid URI", e);
}

Type guard

static boolean hasHttpScheme(URI uri) {
  return uri != null && uri.getScheme() != null
    && (uri.getScheme().equalsIgnoreCase("http") || uri.getScheme().equalsIgnoreCase("https"));
}

Try / catch

try {
  githubApplicationClient.validateConfig(githubAppConfiguration);
} catch (IllegalArgumentException e) {
  if (e.getMessage().contains("Only http and https schemes")) {
    // show user a message requiring an http(s) endpoint
  }
}

Prevention

When it happens

Trigger: Setting a GitHub App apiEndpoint without an http/https scheme, e.g. 'github.example.com/api' or 'ftp://github.example.com', then calling validateConfig/findMissingAppPermissions which invoke checkApiEndpoint.

Common situations: Copy-pasting an api endpoint from docs without the https:// prefix; typo like 'htps://'; on-prem GitHub Enterprise configs using a custom scheme; URL built by string concatenation dropping the scheme.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/24ecf637aff968b9. Report an issue: GitHub.