{"record":{"id":"e07b24e91c5a9983","repo":"SonarSource/sonarqube","slug":"both-severity-and-impacts-parameters-cannot-be","errorCode":null,"errorMessage":"Both 'severity' and 'impacts' parameters cannot be set at the same time","messagePattern":"Both 'severity' and 'impacts' parameters cannot be set at the same time","errorType":"http","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/rule/ws/UpdateAction.java","lineNumber":203,"sourceCode":"  private RuleUpdate readRequest(DbSession dbSession, Request request) {\n    RuleKey key = RuleKey.parse(request.mandatoryParam(PARAM_KEY));\n    RuleUpdate update = createRuleUpdate(dbSession, key);\n    readTags(request, update);\n    readMarkdownNote(request, update);\n    readDebt(request, update);\n\n    String name = request.param(PARAM_NAME);\n    if (name != null) {\n      update.setName(name);\n    }\n    String description = request.param(PARAM_DESCRIPTION);\n    if (description != null) {\n      update.setMarkdownDescription(description);\n    }\n    String severity = request.param(PARAM_SEVERITY);\n    String impacts = request.param(PARAM_IMPACTS);\n    if (impacts != null && severity != null) {\n      throw new IllegalArgumentException(\"Both 'severity' and 'impacts' parameters cannot be set at the same time\");\n    }\n    if (impacts != null) {\n      Map<SoftwareQuality, org.sonar.api.issue.impact.Severity> parsedImpact = parseImpacts(impacts);\n      update.setImpactSeverities(parsedImpact);\n    }\n    if (severity != null) {\n      update.setSeverity(severity);\n    }\n    String status = request.param(PARAM_STATUS);\n    if (status != null) {\n      update.setStatus(RuleStatus.valueOf(status));\n    }\n    String params = request.param(PARAMS);\n    if (params != null) {\n      update.setParameters(KeyValueFormat.parse(params));\n    }\n    return update;\n  }","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/rule/ws/UpdateAction.java#L185-L221","documentation":"UpdateAction.readRequest rejects requests that supply both the legacy 'severity' parameter and the newer 'impacts' parameter, since the two models conflict. Supplying both throws IllegalArgumentException telling the caller to pick one.","triggerScenarios":"Calling api/rules/update with both severity=... and impacts=... in the query/body, typically when a script was extended to add impacts without removing the old severity parameter.","commonSituations":"Migration-period scripts that grew parameters incrementally; generic rule-update wrappers that always send severity and were extended to forward impacts; retry logic replaying merged payloads.","solutions":["Remove the 'severity' parameter and use only 'impacts' (e.g. impacts=SECURITY>HIGH) for impact-based rules","Or remove 'impacts' and keep 'severity' with a classic value (INFO..BLOCKER)","Audit automation that always includes severity and make it conditional on which model the request uses"],"exampleFix":"// before\nPOST api/rules/update?key=java:S2076&severity=MAJOR&impacts=SECURITY>HIGH\n// after\nPOST api/rules/update?key=java:S2076&impacts=SECURITY>HIGH","handlingStrategy":"validation","validationCode":"if (params.severity != null && params.impacts != null) {\n  throw new Error(\"Pass either 'severity' or 'impacts' to api/rules/update, not both\");\n}","typeGuard":"function usesSingleSeverityModel(p) {\n  return (p.severity == null) !== (p.impacts == null);\n}","tryCatchPattern":"try {\n  await post(\"api/rules/update\", params);\n} catch (e) {\n  if (String(e.message).includes(\"cannot be set at the same time\")) {\n    delete params.severity; // prefer the impacts model\n    await post(\"api/rules/update\", params);\n  }\n}","preventionTips":["Decide per rule whether it uses the classic severity model or the impacts model","Make automation wrappers conditional: forward severity only when impacts is absent","Log the full request payload so conflicting parameters are visible in CI failures"],"tags":["sonarqube","rules","conflicting-parameters","web-api"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}