Is the SOT management API (token-definitions) usable for server-to-server / CI automation?

SonarQube Cloud
1

Template for a good new topic, formatted with Markdown:

  • ALM used (GitHub, Bitbucket Cloud, Azure DevOps)- Github

  • CI system used (Bitbucket Cloud, Azure DevOps, Travis CI, Circle CI)- Github actions

  • Repository language - Typescript

    What we’re trying to do
    We’ve adopted Scoped Organization Tokens (SOTs) for CI analysis and want to automate their rotation from a CI job (mint a new SOT → update our CI secret → revoke the old one). For that we need to call the SOT management API programmatically.

What works

  • We created an SOT via the UI and it works correctly for analysis.
  • Our service account svc-dot-bot has Administer Organization. Its User Token works fine against the classic API — e.g. GET https://sonarcloud.io/api/permissions/users?organization=<organisation_key>&permission=admin returns 200.

What doesn’t work
Calls to the management API are rejected at the edge regardless of the token:

  • GET https://api.sonarcloud.io/token-definitions with the valid org-admin User Token as Authorization: Bearer <token> returns 403 {"message":"Forbidden"} (x-amzn-errortype: ForbiddenException).

  • The exact same response is returned when no Authorization header is sent — so the header appears to never be evaluated.

    Questions

    1. Is the token-definitions API supported for programmatic / server-to-server (CI) use, or is it currently intended only for the SonarCloud web UI?
    2. If it is supported headlessly, what authentication does it require? (User Token as Bearer doesn’t work for us.) Is there an OAuth client-credentials flow, a specific token type or scope, or required headers we should be using?
    3. What is the correct base URL/host for these calls?
    4. Is access gated by plan tier or a feature/early-access flag that needs enabling for our organization?
    5. If programmatic access isn’t available today, is it on the roadmap, and what is the recommended way to automate SOT rotation for CI in the meantime?
2

Hi there,

Welcome to the Community, and thanks for the detailed diagnosis. To clarify: Scoped Organization Tokens are currently only supported for running analyses (via sonar.token), they aren’t yet supported for programmatic management (creating, rotating, or revoking SOTs via API). That’s why token-definitions rejects your calls at the edge; it’s not exposed for external/server-to-server use at this time. This isn’t tied to your plan or a missing permission, it’s simply not released yet.

For reference:

API-based rotation is on our roadmap, but there’s no committed date yet. In the meantime, SOT rotation needs to stay manual via the UI; a Personal Access Token remains the only
option for fully automated CI rotation today.

Cheers,

Stevan

3

Thanks for the information Stevan. Looking forward to the API-based rotation.