# Is is possible to determine the hashref for the code via the API? **URL:** \ **Category:** SonarQube Server / Community Build\ **Tags:** git, branches, sonarqube\ **Created:** [July 28, 2023, 11:11pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535 "2023-07-28T23:11:34Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [July 28, 2023, 11:11pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/1 "2023-07-28T23:11:34Z")
I’ve been digging through the API for version 9 and I can’t figure out how to determine the git hashref (or other SCM system identifier metadata) for the code scanned by sonarqube. The branch name is retrieved but branches move so knowing exactly what hashref was scanned is quite important. Is there potentially another method for storing this information during the scan for later retrieval or an endpoint that I’ve missed? ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [July 31, 2023, 4:00pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/2 "2023-07-31T16:00:02Z")
Hi, Welcome to the community! I think you’re probably looking for `sonar.analysis.[yourKey]`, which [allows you](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/analysis-parameters/) to store extra information with any given analysis. I don’t _think_ the data is shown in the UI…? Maybe on mouseover of the analysis in the Activity tab? But it’s available in the web services.   HTH, Ann ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [July 31, 2023, 4:14pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/3 "2023-07-31T16:14:10Z")
Thanks. That would certainly work. I had assumed that this would be standard information since it’s the only way to concretely correlate the scan results to the scanned item and that I was missing something. ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [July 31, 2023, 7:31pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/4 "2023-07-31T19:31:00Z")
Well, after setting some custom keys, I haven’t found a way to actually get them back out of the system via API queries. A search of the API docs hasn’t really gotten me very far either. Do you know which endpoint would be used to fetch the contents of a custom setting? ---
**Author:** ![anon67236913](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@anon67236913](https://community.sonarsource.com/u/anon67236913)\ **Post date:** [July 31, 2023, 8:40pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/5 "2023-07-31T20:40:42Z")
Hi, never used custom properties so far, means just a guess at first glance The docs for `GET api/webhooks/deliveries` have > Get the recent deliveries for a specified project or Compute Engine task. > Require ‘Administer’ permission on the related project. > **Note that additional information are returned by api/webhooks/delivery**. Gilbert ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [July 31, 2023, 8:56pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/6 "2023-07-31T20:56:12Z")
Thanks for the guess Gilbert but that unfortunately didn’t return anything relevant. ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [August 1, 2023, 1:26pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/7 "2023-08-01T13:26:23Z")
Hi, Okay, I was wrong. I was able to find the original spec, and these properties were only intended to be passed through to webhook payloads. And I’ve verified that they are there: ![Selection_1263](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/4/0/40f66f6a7813fbad56d8c0a49b2bc3478b5bfe70.png)   HTH, Ann ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [August 1, 2023, 1:50pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/8 "2023-08-01T13:50:12Z")
If I’m understanding this correctly, then there is no way to determine the hashref of the scanned branch via the API at this time. Or is there some way to use an internal Sonarqube webhook to inject this information back into the scan? ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [August 1, 2023, 2:07pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/9 "2023-08-01T14:07:00Z")
Hi, Did you look at `api/project_analyses/search`?   Ann ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [August 1, 2023, 2:34pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/10 "2023-08-01T14:34:57Z")
OK, that does provide a revision but it’s the revision that the CI system sees and not necessarily the revision of the actual thing being scanned. So, this would work for a limited use case but still doesn’t correlate the actual artifact and the data in the actual git checkout being analyzed. There’s also no way (that I can see) to correlate the event data with component data (didn’t dig super hard though). ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [August 1, 2023, 2:38pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/11 "2023-08-01T14:38:19Z")
Hi, > [@trevor-vaughan](#): > > There’s also no way (that I can see) to correlate the event data with component data (didn’t dig super hard though). I’m not sure what that means. > [@trevor-vaughan](#): > > it’s the revision that the CI system sees Uhm. Yeah. It’s the revision that SonarQube analyzed. You do also have the ability to [pass in](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/analysis-parameters/) - and this _is_ stored with the analysis - `sonar.buildString`.   HTH, Ann ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [August 1, 2023, 3:43pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/12 "2023-08-01T15:43:59Z")
OK, since `api/project_analyses/set_baseline` is deprecated, that seems to be pretty harmless as a data passthrough. How do you concretely tie an analysis to a report though? Would it be pulling the `analysisDate` out and using that as the search parameter? While this should work, it does seem to have a potential for race conditions. I’ll give it a go though. ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [August 1, 2023, 7:01pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/13 "2023-08-01T19:01:12Z")
This almost worked the way I expected but the `project_analyses/search` endpoint only seems to be returning results for the default branch which means that the correlation still isn’t possible. ---
**Author:** ![anon67236913](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@anon67236913](https://community.sonarsource.com/u/anon67236913)\ **Post date:** [August 2, 2023, 9:18am UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/14 "2023-08-02T09:18:47Z")
The branch parameter for `GET api/project_analyses/search` is internal, means use `https://yoursonarhost/web_api/api/project_analyses?internal=true` et voilà ![internal](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/7/f/7f092889b13372655998012b24fc72c1d1bc06b5.png) To see all use ![web_api](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/c/1/c197aa7f6a6c524704dd72baf9b60cec685789c1.png) ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [August 2, 2023, 1:12pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/15 "2023-08-02T13:12:54Z")
Ahh, yep, that will do it, thanks. I had kept that unchecked assuming that they were unstable interfaces. So, in summary, the information can be gotten using: - A time-based “best effort” match - On an unstable interface - With a user-defined override of the `sonar.buildString` setting which could already be used by one or more webhooks I’m happy calling this one answered since there is technically a solution but ☝ really doesn’t seem like a “good” solution. ---
**Author:** ![trevor-vaughan](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/trevor-vaughan/32/47738_2.png) [@trevor-vaughan](https://community.sonarsource.com/u/trevor-vaughan)\ **Post date:** [August 2, 2023, 1:15pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/16 "2023-08-02T13:15:58Z")
> [@ganncamp](#): > > Uhm. Yeah. It’s the revision that SonarQube analyzed. I just wanted to cover this point really quick. In some scenarios, you have a build system that will run sonarqube from a different checkout altogether. For instance: - Job from Repo `scan_my_stuff` runs - `scan_my_suff` checks out the target repository - `sonar` is used to scan the target directory (which is a repository) - This means that the hashref should be of the thing scanned (target repository) _not_ the checked out repo I find this interesting because sonar is definitely pulling in the correct blame information from the target repository. It just seems like some metadata should be exposed from the thing being scanned that just isn’t. ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [August 9, 2023, 1:16pm UTC](https://community.sonarsource.com/t/is-is-possible-to-determine-the-hashref-for-the-code-via-the-api/96535/17 "2023-08-09T13:16:25Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.