SonarSource/sonarqube · error · IllegalArgumentException

Supplied date format for parameter %s is wrong. Please suppl

Error message

Supplied date format for parameter %s is wrong. Please supply date in the ISO 8601 date format (YYYY-MM-DD)

What it means

GenerateAction (api/user_tokens/generate) parses the optional expiration date with DateTimeFormatter.ISO_DATE and converts any DateTimeParseException into this IllegalArgumentException, telling the caller to supply an ISO 8601 date (YYYY-MM-DD). The raw parse failure detail is discarded in favor of this uniform message naming the offending parameter.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/usertoken/ws/GenerateAction.java:164

      .setName(request.mandatoryParam(PARAM_NAME).trim())
      .setCreatedAt(system.now())
      .setType(getTokenTypeFromRequest(request).name());
    if (expirationDate != null) {
      userTokenDtoFromRequest.setExpirationDate(expirationDate.atStartOfDay(ZoneOffset.UTC).toInstant().toEpochMilli());
    }
    setProjectFromRequest(dbSession, userTokenDtoFromRequest, request);
    return userTokenDtoFromRequest;
  }

  @Nullable
  private static LocalDate getExpirationDateFromRequest(Request request) {
    String expirationDateString = request.param(PARAM_EXPIRATION_DATE);

    if (expirationDateString != null) {
      try {
        return LocalDate.parse(expirationDateString, DateTimeFormatter.ISO_DATE);
      } catch (DateTimeParseException e) {
        throw new IllegalArgumentException(String.format("Supplied date format for parameter %s is wrong. Please supply date in the ISO 8601 " +
          "date format (YYYY-MM-DD)", PARAM_EXPIRATION_DATE));
      }
    }

    return null;
  }

  private String generateToken(Request request, DbSession dbSession) {
    TokenType tokenType = getTokenTypeFromRequest(request);
    validateParametersCombination(userTokenSupport, dbSession, request, tokenType);
    return tokenGenerator.generate(tokenType);
  }

  public void setProjectFromRequest(DbSession session, UserTokenDto token, Request request) {
    if (!PROJECT_ANALYSIS_TOKEN.equals(getTokenTypeFromRequest(request))) {
      return;
    }

View on GitHub (pinned to 184c821202)

Solutions

1. Send the date strictly as YYYY-MM-DD, e.g. expiration_date=2026-12-31.
2. Strip time and timezone parts if your source data is a timestamp (take the date portion).
3. Normalize in the calling script: date -d "$raw" +%F on GNU date, or DateTimeFormatter.ofPattern input handling before the call.
4. Omit the parameter entirely if no expiration is required (unless a max token lifetime policy forces one).

Example fix

// before
curl -su "$TOKEN:" -X POST 'https://sonar/api/user_tokens/generate?name=ci&expiration_date=12/31/2026'
// after: ISO 8601 date only
EXP=$(date -d '+30 days' +%F)
curl -su "$TOKEN:" -X POST "https://sonar/api/user_tokens/generate?name=ci&expiration_date=$EXP"

function isoDateOrNull(s) {
  if (s == null) return null;
  return /^\d{4}-\d{2}-\d{2}$/.test(s.trim()) && !isNaN(Date.parse(s)) ? s.trim() : null;
}
const exp = isoDateOrNull(rawExpirationDate);
if (rawExpirationDate != null && exp === null) throw new Error(`expiration_date must be YYYY-MM-DD, got: ${rawExpirationDate}`);

function isValidIsoDate(v) {
  return typeof v === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(v) && !isNaN(Date.parse(v));
}

try {
  await generateToken(name, exp);
} catch (e) {
  if (e.status === 400 && /ISO 8601 date format/.test(e.message)) {
    throw new Error(`expiration_date '${exp}' not ISO YYYY-MM-DD`);
  }
  throw e;
}

When it happens

Trigger: POST api/user_tokens/generate with expiration_date values like '12/31/2026', '31-12-2026', '2026-12-31T00:00:00Z', 'next month', or containing whitespace.

Common situations: Shell scripts building dates with locale-dependent formats (MM/DD/YYYY); passing full timestamps instead of date-only; Excel/CSV exported dates; timezone-suffixed strings from other tools; JSON serializers emitting ISO datetime rather than ISO date.

Related errors

• Tokens expiring after %s are not allowed. Please use a valid
• Command-line argument must start with -D, for example -Dsona
• Bad format of JDBC URL: %s
• Unknown severity: %s
• Message '%s' cannot be dismissed.

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/9ca315c4a53f37c1. Report an issue: GitHub.