SonarSource/sonarqube · error · IllegalArgumentException

The severity is invalid

Error message

The severity is invalid

What it means

RuleUpdater.updateSeverity checks that the severity string is non-empty and one of the values in Severity.ALL; any other value (or null) throws IllegalArgumentException('The severity is invalid'). This protects RuleDto from storing an unrecognized severity.

Solutions

  1. Use exactly one of INFO, MINOR, MAJOR, CRITICAL, BLOCKER (uppercase)
  2. If you intend impact-based severities, use the 'impacts' parameter (e.g. impacts=SECURITY>HIGH) instead of 'severity'
  3. Normalize/uppercase the severity in client code and validate against the allowed set before sending

Example fix

// before
POST api/rules/update?key=java:S2076&severity=high
// after
POST api/rules/update?key=java:S2076&severity=CRITICAL
Defensive patterns

Strategy: validation

Validate before calling

const VALID = ["INFO","MINOR","MAJOR","CRITICAL","BLOCKER"];
if (severity != null && !VALID.includes(String(severity).toUpperCase())) {
  throw new Error(`Invalid severity '${severity}'. Use one of ${VALID.join(",")}`);
}

Type guard

function isValidSeverity(s) {
  return ["INFO","MINOR","MAJOR","CRITICAL","BLOCKER"].includes(s);
}

Try / catch

try {
  await post("api/rules/update", { key, severity });
} catch (e) {
  if (String(e.message).includes("The severity is invalid")) {
    console.error(`'${severity}' is not a classic severity; use INFO..BLOCKER or the impacts parameter`);
  }
}

Prevention

When it happens

Trigger: Calling api/rules/update with 'severity' set to a value outside INFO/MINOR/MAJOR/CRITICAL/BLOCKER (e.g. lowercase 'major', 'HIGH', or an impact-style severity like 'LOW').

Common situations: Confusing old-style severities with impact severities (MEDIUM/HIGH/LOW) after migrating to the impacts model; case sensitivity mistakes; scripts using severity names from other tools (Checkmarx, Fortify).

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/1d05f025c144c729. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/rule/RuleUpdater.java:182

      throw new IllegalArgumentException("The name is missing");
    }
    rule.setName(name);
  }

  private void updateDescription(RuleUpdate update, RuleDto rule) {
    String description = update.getMarkdownDescription();
    if (isNullOrEmpty(description)) {
      throw new IllegalArgumentException("The description is missing");
    }
    RuleDescriptionSectionDto descriptionSectionDto = createDefaultRuleDescriptionSection(uuidFactory.create(), description);
    rule.setDescriptionFormat(RuleDto.Format.MARKDOWN);
    rule.replaceRuleDescriptionSectionDtos(List.of(descriptionSectionDto));
  }

  private static void updateSeverity(RuleUpdate update, RuleDto rule) {
    String severity = update.getSeverity();
    if (isNullOrEmpty(severity) || !Severity.ALL.contains(severity)) {
      throw new IllegalArgumentException("The severity is invalid");
    }
    rule.setSeverity(severity);
    updateImpactSeverity(rule, severity);
  }

  private static void updateStatus(RuleUpdate update, RuleDto rule) {
    RuleStatus status = update.getStatus();
    if (status == null) {
      throw new IllegalArgumentException("The status is missing");
    }
    rule.setStatus(status);
  }

  private static void updateTags(RuleUpdate update, RuleDto rule) {
    Set<String> tags = update.getTags();
    if (tags == null || tags.isEmpty()) {
      rule.setTags(Collections.emptySet());
    } else {

View on GitHub (pinned to 184c821202)