{"record":{"id":"80d2c00ace6805df","repo":"SonarSource/sonarqube","slug":"http-method-get-is-required","errorCode":null,"errorMessage":"HTTP method GET is required","messagePattern":"HTTP method GET is required","errorType":"http","errorClass":"ServerException","httpStatus":405,"severity":"error","filePath":"server/sonar-webserver-ws/src/main/java/org/sonar/server/ws/RequestVerifier.java","lineNumber":42,"sourceCode":"import org.sonar.server.exceptions.ServerException;\n\nimport static jakarta.servlet.http.HttpServletResponse.SC_METHOD_NOT_ALLOWED;\n\npublic class RequestVerifier {\n  private RequestVerifier() {\n    // static methods only\n  }\n\n  public static void verifyRequest(WebService.Action action, Request request) {\n    switch (request.method()) {\n      case \"GET\":\n        if (action.isPost()) {\n          throw new ServerException(SC_METHOD_NOT_ALLOWED, \"HTTP method POST is required\");\n        }\n        break;\n      case \"POST\":\n        if (!action.isPost()) {\n          throw new ServerException(SC_METHOD_NOT_ALLOWED, \"HTTP method GET is required\");\n        }\n        break;\n      default:\n        throw new ServerException(SC_METHOD_NOT_ALLOWED, String.format(\"HTTP method %s is not allowed\", request.method()));\n    }\n  }\n}\n","sourceCodeStart":24,"sourceCodeEnd":50,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-ws/src/main/java/org/sonar/server/ws/RequestVerifier.java#L24-L50","documentation":"Thrown by RequestVerifier.verifyRequest when a POST request is issued against a web service action declared as GET-only. The server responds with HTTP 405 Method Not Allowed indicating the action requires GET.","triggerScenarios":"Issuing POST (curl -X POST, or a REST client set to POST) against a GET action such as api/navigation, api/server/version, api/system/status, or any search/show action that only supports GET.","commonSituations":"Scripts that blanket-use -X POST for every curl call; REST client collections reused across endpoints with the wrong verb; frameworks/tests invoking everything as POST.","solutions":["Resend the request as GET (curl without -X, or -X GET).","Verify the action's allowed method in the web service documentation.","Fix scripts/clients that apply a single HTTP verb to all endpoints."],"exampleFix":"// before\ncurl -u $TOKEN -X POST \"$SONAR/api/system/status\" // 405 GET required\n// after\ncurl -u $TOKEN \"$SONAR/api/system/status\"","handlingStrategy":"validation","validationCode":"# read-only endpoints should default to GET\ncase \"$PATH\" in\n  */api/system/status|*/api/server/version) METHOD=GET ;;\nesac","typeGuard":null,"tryCatchPattern":"if (response.code() == 405 && response.message().contains(\"GET is required\")) {\n  retryAsGet();\n}","preventionTips":["Avoid blanket -X POST in scripts; set the verb per endpoint.","Treat status/version/search endpoints as GET-only.","Keep a client wrapper that declares the verb per action."],"tags":["http-405","method-not-allowed","web-api","http-verb"],"backgroundTag":"http-error-response","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}