{"record":{"id":"24ecf637aff968b9","repo":"SonarSource/sonarqube","slug":"only-http-and-https-schemes-are-supported","errorCode":null,"errorMessage":"Only http and https schemes are supported","messagePattern":"Only http and https schemes are supported","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/GithubApplicationClientImpl.java","lineNumber":164,"sourceCode":"      return Optional.empty();\n    }\n  }\n\n  @Override\n  public void checkApiEndpoint(GithubAppConfiguration githubAppConfiguration) {\n    if (StringUtils.isBlank(githubAppConfiguration.getApiEndpoint())) {\n      throw new IllegalArgumentException(\"Missing URL\");\n    }\n\n    URI apiEndpoint;\n    try {\n      apiEndpoint = URI.create(githubAppConfiguration.getApiEndpoint());\n    } catch (IllegalArgumentException e) {\n      throw new IllegalArgumentException(\"Invalid URL, \" + e.getMessage());\n    }\n\n    if (!\"http\".equalsIgnoreCase(apiEndpoint.getScheme()) && !\"https\".equalsIgnoreCase(apiEndpoint.getScheme())) {\n      throw new IllegalArgumentException(\"Only http and https schemes are supported\");\n    } else if (!isValidGitHubUrl(apiEndpoint)) {\n      throw new IllegalArgumentException(\"Invalid GitHub URL\");\n    }\n  }\n\n  private static boolean isValidGitHubUrl(URI apiEndpoint) {\n    String host = apiEndpoint.getHost();\n    String path = apiEndpoint.getPath();\n    if (host == null) {\n      return false;\n    }\n\n    String lowerCaseHost = host.toLowerCase(Locale.ENGLISH);\n    // GitHub.com (official public GitHub)\n    if (\"api.github.com\".equals(lowerCaseHost)) {\n      return true;\n    }\n","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/GithubApplicationClientImpl.java#L146-L182","documentation":"checkApiEndpoint() validates the GitHub App apiEndpoint URL before any HTTP call is made. URI.create must succeed and the resulting URI must have an http or https scheme; anything else (ftp, no scheme, custom schemes) triggers this IllegalArgumentException. It is an early fail-fast guard so requests are never attempted against an unsupported endpoint.","triggerScenarios":"Setting a GitHub App apiEndpoint without an http/https scheme, e.g. 'github.example.com/api' or 'ftp://github.example.com', then calling validateConfig/findMissingAppPermissions which invoke checkApiEndpoint.","commonSituations":"Copy-pasting an api endpoint from docs without the https:// prefix; typo like 'htps://'; on-prem GitHub Enterprise configs using a custom scheme; URL built by string concatenation dropping the scheme.","solutions":["Add the scheme to the api endpoint, e.g. https://api.github.com or https://github.example.com/api/v3","Verify the scheme casing is irrelevant but spelling must be exactly http or https","Check the alm setting sonar.auth.github.apiUrl / GitHub App api endpoint value in SonarQube configuration"],"exampleFix":"// before\n.setApiEndpoint(\"api.github.com\")\n// after\n.setApiEndpoint(\"https://api.github.com\")","handlingStrategy":"validation","validationCode":"try {\n  URI uri = new URI(apiEndpoint);\n  String scheme = uri.getScheme();\n  if (scheme == null || !(scheme.equalsIgnoreCase(\"http\") || scheme.equalsIgnoreCase(\"https\"))) {\n    throw new IllegalArgumentException(\"apiEndpoint must start with http:// or https://\");\n  }\n} catch (URISyntaxException e) {\n  throw new IllegalArgumentException(\"apiEndpoint is not a valid URI\", e);\n}","typeGuard":"static boolean hasHttpScheme(URI uri) {\n  return uri != null && uri.getScheme() != null\n    && (uri.getScheme().equalsIgnoreCase(\"http\") || uri.getScheme().equalsIgnoreCase(\"https\"));\n}","tryCatchPattern":"try {\n  githubApplicationClient.validateConfig(githubAppConfiguration);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"Only http and https schemes\")) {\n    // show user a message requiring an http(s) endpoint\n  }\n}","preventionTips":["Always prefix endpoints with https:// in configuration","Normalize user input by prepending https:// when the scheme is missing (for known hosts)","Add a form-level URL validator before saving the setting"],"tags":["github","configuration","url-validation","illegal-argument"],"backgroundTag":"invalid-url","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}