SonarSource/sonarqube · error · IllegalArgumentException

Parameters 'severity' and 'impact' cannot be used at the sam

Error message

Parameters 'severity' and 'impact' cannot be used at the same time

What it means

Validation guard in SetSeverityAction.checkParams: the api/issues/set_severity web service accepts either the legacy 'severity' parameter or the newer 'impact' parameter, but not both in a single request, since the two would define conflicting severities for the issue. It fires before any issue is loaded, purely from request parameters, so the fix is purely client-side parameter selection.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/issue/ws/SetSeverityAction.java:220

  private static String getProjectKey(DefaultIssue issue, SearchResponseData response) {
    ComponentDto componentByUuid = response.getComponentByUuid(issue.projectUuid());
    if (componentByUuid == null) {
      throw new IllegalStateException("Component with uuid " + issue.projectUuid() + " not found");
    }
    return componentByUuid.getKey();
  }

  private static void createImpactsIfMissing(DefaultIssue issue, Map<SoftwareQuality, org.sonar.api.issue.impact.Severity> effectiveImpacts) {
    if (issue.impacts().isEmpty()) {
      issue.replaceImpacts(effectiveImpacts);
      issue.setChanged(true);
    }
  }

  private static void checkParams(@Nullable String severity, @Nullable String impact) {
    if (severity != null && impact != null) {
      throw new IllegalArgumentException("Parameters 'severity' and 'impact' cannot be used at the same time");
    } else if (severity == null && impact == null) {
      throw new IllegalArgumentException("One of the parameters 'severity' or 'impact' must be provided");
    }
  }
}

View on GitHub (pinned to 184c821202)

Solutions

Remove either 'severity' or 'impact' from the request so exactly one is sent
Update wrapper/automation code to prefer 'impact' (or 'severity') consistently
Document the mutual exclusivity in team tooling that builds these requests

Example fix

// before
post('/api/issues/set_severity', {issue, severity: 'MAJOR', impact: 'RELIABILITY,HIGH'});
// after
post('/api/issues/set_severity', {issue, impact: 'RELIABILITY,HIGH'});

Defensive patterns

Strategy: validation

Validate before calling

if (severity && impact) throw new Error('pass either severity or impact, not both');
if (!severity && !impact) throw new Error('pass one of severity or impact');

Try / catch

try { await post('/api/issues/set_severity', body); } catch (e) { if (e.status === 400 && e.message.includes('cannot be used at the same time')) { /* strip one parameter and retry */ } else throw e; }

Prevention

Build request bodies from a single source of truth for severity model
Strip legacy params when migrating to MQR impacts
Add client-side mutual-exclusion checks

When it happens

Trigger: Calling POST api/issues/set_severity with both severity=MAJOR and impact=RELIABILITY,HIGH in the same request; clients merging query params from old and new integrations.

Common situations: Migrating scripts from the classic severity API to the MQR impact API while keeping old parameters; wrapper libraries that always append both fields; form builders collecting both settings.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/820b8397cea6ab3c. Report an issue: GitHub.