Azure DevOps PR quality gate stuck in Waiting — cannot clear project-level token (org PAT is valid)

SonarQube Cloud
,
1

We also have a valid organization-level Azure DevOps connectivity PAT.

Observed behavior:

  • Analysis succeeds (Background Tasks = Success for PR analyses)
  • Publish Quality Gate Result succeeds and reports Quality Gate OK
  • Azure DevOps never receives the SonarCloud / quality gate PR status
  • Branch policy status check stays Waiting
  • Affected PR entries in SonarCloud show Quality Gate OK but no Azure DevOps PR URL (url null)

We believe the project-level token is overriding the org-level PAT (and is likely stale), but we cannot clear it.

What we tried / blocked on:

  • Project Administration UI does not expose a usable Pull Requests / token reset control for these projects (setting not available to clear)
  • API attempts to remove/reset sonar.pullrequest.vsts.token.secured did not work for us
  • We do not want to rotate the org PAT blindly or recreate projects

Request:

  1. Please check backend logs for PR decoration / Azure DevOps status posting failures on our org (I can provide org key, project keys, PR IDs, and background task IDs privately).
  2. How can we remove project-level sonar.pullrequest.vsts.token.secured so projects fall back to the valid organization-level Azure DevOps PAT?
  3. Is there a supported API/UI path for bound projects when the Pull Requests token field is not shown?

Workaround
Set Quality gate as optional policy

2

Hey @PexDex, welcome to the Community! This is a known issue: in the past it was possible to edit this token in the UI, now we’ve removed that but these token still remain and still override the org-level ones. We’re tracking this issue internally, I’ll let the devs know that you ran into it.

As a workaround, you can reset this setting via API:

curl --request POST "https://sonarcloud.io/api/settings/reset" \
  -H "Authorization: Bearer $SQC_TOKEN" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "organization=<org_key>&component=<project_key>&keys=sonar.pullrequest.vsts.token.secured"
3

This was helpful, thanks :ok_hand:

One thing worth flagging for others who land here: when I ran the settings/reset call exactly as suggested — with organization, component, and keys together — I got this error back:

{
    "errors": [
        {
            "msg": "Organization can be set, with any of the following parameters: component, branch, pullRequest."
        }
    ]
}

Removing the organization parameter and keeping just component and keys fixed it right away. After that, the reset went through and pull request decoration started working correctly on the next run.

Might be worth a note in the docs (or in your reply above) that organization shouldn’t be combined with component on this specific endpoint.