403 Forbidden when calling token-resource-links API to link project to scoped token

SonarQube Cloud
1
  • ALM used (GitHub, Bitbucket Cloud, Azure DevOps): Azure DevOps
  • CI system used (Bitbucket Cloud, Azure DevOps, Travis CI, Circle CI): Azure DevOps
  • Languages of the repository: Bash/Powershell script, Sonarcloud REST API
  • What we are trying to achieve:
    • Trying to automate the creation and management of Sonarcloud scoped tokens through Azure DevOps pipelines
  • Error observed: Forbidden: SonarCloud rejected token-resource-links API access. The token is valid, but this endpoint is not accessible with the current SonarCloud permissions/API access
  • Steps to reproduce

    • Execute following API call using from an Azure DevOps pipeline using a token generated from a sonarcloud Administrator account:

      task: Bash@3

displayName: 'Link project to scoped token'

inputs:

targetType: 'inline'

script: |

curl --request POST \

--url https://api.sonarcloud.io/token-resource-links \

--header "Authorization: Bearer $(SONAR_ADMIN_TOKEN)" \

--header "Content-Type: application/json" \

--data "{

   \"tokenDefinitionId\":\$(TOKEN_UUID)\",

   \"resourceId\":\"$(PROJECT_UUID)\",

   \"resourceType\":\"PROJECT\"

}"
  • Additional Information:
    • Sonarcloud organization uses Enterprise Plan
    • The project and token definition already exists
    • No proxy or network related errors observed
  • Questions:
    • Is the above rest api call correct?
    • Are there any additional permissions or roles required to use the POST / token-resource-links endpoint?
    • Are there any restrictions on using this endpoint from Azure DevOps pipelines?
2

Hey @akumbhar, the endpoint is POST https://api.sonarcloud.io/authentication/token-resource-links, not POST https://api.sonarcloud.io/token-resource-links. However, I cannot really blame you for not realizing this, as the Swagger API reference omits the /authentication path slug. This is a known issue in our API reference (that I personally also find very painful) and I will let the team know that users like you are running into it.

4

@andres - thank you for the help