SonarSource/sonarqube · error · NotFoundException

Project '%s' not found

Error message

Project '%s' not found

What it means

Raised by the hotspot search web service when the 'project' parameter resolves to a component whose qualifier is not a supported project/application type (e.g. it is a module, directory, file, or portfolio). SonarQube reports it as NotFound to avoid leaking the existence of non-project components.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/hotspot/ws/SearchAction.java:366

      .setPossibleValues(SANS_TOP_25_INSECURE_INTERACTION, SANS_TOP_25_RISKY_RESOURCE, SANS_TOP_25_POROUS_DEFENSES);
    action.createParam(PARAM_SONARSOURCE_SECURITY)
      .setDescription("Comma-separated list of SonarSource security categories. Use '" + SecurityStandards.SQCategory.OTHERS.getKey() +
        "' to select issues not associated with any category")
      .setSince("8.6")
      .setPossibleValues(Arrays.stream(SecurityStandards.SQCategory.values()).map(SecurityStandards.SQCategory::getKey).toList());
    action.createParam(PARAM_CWE)
      .setDescription("Comma-separated list of CWE numbers")
      .setExampleValue("89,434,352")
      .setSince("8.8");
  }

  private Optional<ProjectAndBranch> getAndValidateProjectOrApplication(DbSession dbSession, WsRequest wsRequest) {
    return wsRequest.getProjectKey().map(projectKey -> {
      ProjectAndBranch appOrProjectAndBranch = componentFinder.getAppOrProjectAndBranch(dbSession, projectKey, wsRequest.getBranch().orElse(null),
        wsRequest.getPullRequest().orElse(null));

      if (!SUPPORTED_QUALIFIERS.contains(appOrProjectAndBranch.getProject().getQualifier())) {
        throw new NotFoundException(format("Project '%s' not found", projectKey));
      }
      userSession.checkEntityPermission(USER, appOrProjectAndBranch.getProject());
      userSession.checkChildProjectsPermission(USER, appOrProjectAndBranch.getProject());
      return appOrProjectAndBranch;
    });
  }

  private SearchResponseData searchHotspots(WsRequest wsRequest, DbSession dbSession, @Nullable ProjectAndBranch projectorApp) {
    SearchResponse<Object> result = doIndexSearch(wsRequest, dbSession, projectorApp);
    List<String> issueKeys = result.hits().hits().stream()
      .map(Hit::id)
      .toList();

    List<IssueDto> hotspots = toIssueDtos(dbSession, issueKeys);

    Paging paging = forPageIndex(wsRequest.getPage()).withPageSize(wsRequest.getIndex()).andTotal((int) getTotalHits(result));
    return new SearchResponseData(paging, hotspots);
  }

View on GitHub (pinned to 184c821202)

Solutions

1. Verify the key with GET api/components/show?component=<key> and use the top-level project key
2. Run GET api/projects/search to list valid project keys and correct the script
3. Remove or fix stale branch/pullRequest parameters
4. Update CI configuration if the project was renamed or deleted

Example fix

// before
curl '.../api/hotspots/search?project=com.example:my-app:module-core'
// after
curl '.../api/hotspots/search?project=com.example:my-app'

const comp = await get('/api/components/show', {component: projectKey});
if (!['TRK','APP'].includes(comp.component.qualifier)) throw new Error('not a project/application');

try { const r = await get('/api/hotspots/search', {project}); } catch (e) { if (e.status === 404) { /* verify key via /api/components/show */ } else throw e; }

When it happens

Trigger: Calling GET api/hotspots/search with project=<key> where the key belongs to a non-PROJECT/APP component (module, folder, file), or to a deleted/renamed component; also when branch/pullRequest parameters are invalid for that key.

Common situations: Using a component key instead of the project key in a CI script; project key renamed or project deleted after pipeline config was written; old keys pointing to modules removed in newer SonarQube versions (module support dropped); typos in the project key.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Provided user with login '%s' does not have 'Browse' permiss
• Issue with key '%s' does not exist
• The following metric keys are not found: %s
• The following metric keys are not found: %s
• Metrics %s are not found

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/c3c628e57c7b0778. Report an issue: GitHub.