{"record":{"id":"aa92814422a2abdc","repo":"SonarSource/sonarqube","slug":"http-method-s-is-not-allowed","errorCode":null,"errorMessage":"HTTP method %s is not allowed","messagePattern":"HTTP method (.+?) is not allowed","errorType":"http","errorClass":"ServerException","httpStatus":405,"severity":"error","filePath":"server/sonar-webserver-ws/src/main/java/org/sonar/server/ws/RequestVerifier.java","lineNumber":46,"sourceCode":"public class RequestVerifier {\n  private RequestVerifier() {\n    // static methods only\n  }\n\n  public static void verifyRequest(WebService.Action action, Request request) {\n    switch (request.method()) {\n      case \"GET\":\n        if (action.isPost()) {\n          throw new ServerException(SC_METHOD_NOT_ALLOWED, \"HTTP method POST is required\");\n        }\n        break;\n      case \"POST\":\n        if (!action.isPost()) {\n          throw new ServerException(SC_METHOD_NOT_ALLOWED, \"HTTP method GET is required\");\n        }\n        break;\n      default:\n        throw new ServerException(SC_METHOD_NOT_ALLOWED, String.format(\"HTTP method %s is not allowed\", request.method()));\n    }\n  }\n}\n","sourceCodeStart":28,"sourceCodeEnd":50,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-ws/src/main/java/org/sonar/server/ws/RequestVerifier.java#L28-L50","documentation":"RequestVerifier.verifyRequest checks that the HTTP method used on a web service endpoint matches the method the action declares. SonarQube web service actions support only GET or POST; any other method (PUT, DELETE, PATCH, OPTIONS, HEAD, etc.) falls to the default branch and throws a 405 ServerException with the actual method name in the message.","triggerScenarios":"Calling any SonarQube /api/... endpoint with an HTTP method other than GET or POST, e.g. an HTTP DELETE or PUT request against a web service action, or a tool/proxy that rewrites the method.","commonSituations":"Automated scripts or REST clients using REST verbs not supported by the SonarQube WS API; proxies or API gateways translating GET/POST into other methods; frameworks with method override headers sending PUT/DELETE.","solutions":["Change the request to GET (for read actions) or POST (for actions declared isPost()), matching the endpoint's documented method","Check the web service documentation (web_api or /api_documentation) for the correct HTTP method per endpoint","If a proxy/gateway is rewriting the method, configure it to pass GET/POST through unchanged"],"exampleFix":"// before\ncurl -X DELETE https://sonar/api/projects/index\n// after\ncurl -X POST https://sonar/api/projects/delete -d 'project=my_project'","handlingStrategy":"validation","validationCode":"if (method !== 'GET' && method !== 'POST') throw new Error(`Sonar WS endpoints accept only GET/POST, got ${method}`);","typeGuard":"const isAllowedMethod = (m) => m === 'GET' || m === 'POST';","tryCatchPattern":null,"preventionTips":["Consult web_api docs for each endpoint's declared method before calling it","Restrict HTTP clients/proxies from rewriting methods (no method-override headers)","Add integration tests asserting expected 200 for GET/POST calls"],"tags":["http","rest","method-not-allowed"],"backgroundTag":"http-error-response","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}