SonarSource/sonarqube · error · IllegalArgumentException

Parameters 'severity' and 'impact' cannot be used at the…

Error message

Parameters 'severity' and 'impact' cannot be used at the same time

What it means

Validation guard in SetSeverityAction.checkParams: the api/issues/set_severity web service accepts either the legacy 'severity' parameter or the newer 'impact' parameter, but not both in a single request, since the two would define conflicting severities for the issue. It fires before any issue is loaded, purely from request parameters, so the fix is purely client-side parameter selection.

Solutions

Remove either 'severity' or 'impact' from the request so exactly one is sent
Update wrapper/automation code to prefer 'impact' (or 'severity') consistently
Document the mutual exclusivity in team tooling that builds these requests

Example fix

// before
post('/api/issues/set_severity', {issue, severity: 'MAJOR', impact: 'RELIABILITY,HIGH'});
// after
post('/api/issues/set_severity', {issue, impact: 'RELIABILITY,HIGH'});

Defensive patterns

Strategy: validation

Validate before calling

if (severity && impact) throw new Error('pass either severity or impact, not both');
if (!severity && !impact) throw new Error('pass one of severity or impact');

Try / catch

try { await post('/api/issues/set_severity', body); } catch (e) { if (e.status === 400 && e.message.includes('cannot be used at the same time')) { /* strip one parameter and retry */ } else throw e; }

Prevention

Build request bodies from a single source of truth for severity model
Strip legacy params when migrating to MQR impacts
Add client-side mutual-exclusion checks

When it happens

Trigger: Calling POST api/issues/set_severity with both severity=MAJOR and impact=RELIABILITY,HIGH in the same request; clients merging query params from old and new integrations.

Common situations: Migrating scripts from the classic severity API to the MQR impact API while keeping old parameters; wrapper libraries that always append both fields; form builders collecting both settings.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/820b8397cea6ab3c. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/issue/ws/SetSeverityAction.java:220

  private static String getProjectKey(DefaultIssue issue, SearchResponseData response) {
    ComponentDto componentByUuid = response.getComponentByUuid(issue.projectUuid());
    if (componentByUuid == null) {
      throw new IllegalStateException("Component with uuid " + issue.projectUuid() + " not found");
    }
    return componentByUuid.getKey();
  }

  private static void createImpactsIfMissing(DefaultIssue issue, Map<SoftwareQuality, org.sonar.api.issue.impact.Severity> effectiveImpacts) {
    if (issue.impacts().isEmpty()) {
      issue.replaceImpacts(effectiveImpacts);
      issue.setChanged(true);
    }
  }

  private static void checkParams(@Nullable String severity, @Nullable String impact) {
    if (severity != null && impact != null) {
      throw new IllegalArgumentException("Parameters 'severity' and 'impact' cannot be used at the same time");
    } else if (severity == null && impact == null) {
      throw new IllegalArgumentException("One of the parameters 'severity' or 'impact' must be provided");
    }
  }
}

View on GitHub (pinned to 184c821202)