SonarSource/sonarqube · error · IllegalArgumentException

Provided JSON is invalid

Error message

Provided JSON is invalid : [%s at %s]

What it means

After parseable JSON is confirmed, validateJsonSchema checks security-relevant JSON settings (SECURITY_JSON_PROPERTIES) against a JSON schema using schemaValidator. When validation fails, the first root-cause ValidationFailure's message and instance location are embedded into the message, telling the developer exactly which part of the payload violates the schema.

Solutions

  1. Read the [%s at %s] part of the message to locate the offending field and fix its type/structure
  2. Check the property definition / schema for that setting key and conform to it
  3. Pin and update integration tooling after SonarQube version upgrades that changed the schema

Example fix

// before
{"groups": [1, 2]}          // schema expects strings
// after
{"groups": ["group-a", "group-b"]}
Defensive patterns

Strategy: validation

Validate before calling

// fetch schema from api/settings/definitions and validate client-side before posting
const schema = definitions.find(d => d.key === key)?.jsonSchema;
const errors = schema ? validateAgainstSchema(JSON.parse(value), schema) : [];
if (errors.length) throw new Error('Schema violations: ' + errors.join('; '));

Try / catch

try { await setSetting(key, json); } catch (e) { const m = e.message.match(/\[(.*) at (.*)\]/); if (m) console.error(`Schema violation '${m[1]}' at ${m[2]}`); throw e; }

Prevention

When it happens

Trigger: POST api/settings/set for a key in SECURITY_JSON_PROPERTIES whose JSON parses but violates the schema: wrong property types, missing required fields, unknown fields, or nested objects failing validation.

Common situations: Upgrades that tightened the schema for security settings while older automation still posts the legacy shape; hand-built payloads missing a required field; values copied from third-party integrations with a different structure.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/337e0713bebbca1a. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/setting/ws/SettingValidations.java:214

    private void validateJson(SettingData data, PropertyDefinition definition) {
      Optional<String> jsonContent = data.values.stream().findFirst();
      if (jsonContent.isPresent()) {
        try {
          new Gson().getAdapter(JsonElement.class).fromJson(jsonContent.get());
          validateJsonSchema(jsonContent.get(), definition);
        } catch (JsonParseException | IOException e) {
          throw new IllegalArgumentException("Provided JSON is invalid");
        }
      }
    }

    private void validateJsonSchema(String json, PropertyDefinition definition) {
      if (SECURITY_JSON_PROPERTIES.contains(definition.key())) {
        JsonValue jsonToValidate = new JsonParser(json).parse();
        Optional.ofNullable(schemaValidator.validate(jsonToValidate))
          .ifPresent(validationFailure -> {
            ValidationFailure rootCause = getRootCause(validationFailure);
            throw new IllegalArgumentException(String.format("Provided JSON is invalid : [%s at %s]", rootCause.getMessage(), rootCause.getInstance().getLocation()));
          });
      }
    }

    private static ValidationFailure getRootCause(ValidationFailure base) {
      return base.getCauses().stream()
        .map(ValueTypeValidation::getRootCause)
        .findFirst()
        .orElse(base);
    }
  }
}

View on GitHub (pinned to 184c821202)