🚀 New: Expanded Scope Organization Tokens for Automation in SonarQube Cloud!

SonarQube Cloud Announcements
1

Hello everyone,

We’re excited to announce that Scoped Organization Tokens (SOT) in SonarQube Cloud now support expanded permissions for deep automation, CI/CD provisioning, and reporting!

While Scoped Organization Tokens previously focused on code analysis, admins can now grant tokens org-level or project-level access with expanded permissions covering project creation, and reporting needs—all through the same auditable, expiring-token model you use today.

What’s new?

  • Granular Scope Selection: Define permissions across Organization-wide or Selected projects scopes, with clear visibility into available API endpoints.

  • Project Lifecycle Management: Programmatically create new projects and apply project tags directly during onboarding or pipeline execution, browse and administer created projects..

  • Expanded API Endpoint Support: Programmatically interact with API endpoints for issues, quality gate statuses, measures, project branches, pull requests, and webhooks without relying on personal user accounts (PATs).

  • API Updates & Migration: To support these expanded capabilities, a set of new SOT-native endpoints has been introduced, and previous legacy endpoints are now deprecated. Please refer to our API Migration Guide to transition your automation scripts.

Where to find it:

  • Organization administrators navigate to Scoped Tokens to create or configure Scoped Organizations Tokens, view or adjust token-specific permissions.

image
image2048Ă—1681 303 KB

image
image2048Ă—1260 311 KB

Check out our Scoped Organization Tokens Documentation and API Migration Guide for a breakdown of available permissions and migration instructions.

We’d love to hear your thoughts on how your teams are leveraging SOTs for CI/CD automation and external dashboard integrations. Share your feedback in the comments!

- Chris

2

I’ve looking at using this new support with the Backstage plugin for SonarQube. However, based on what I see in the UI there isn’t a way to make a read-only scoped token for all current and future projects. Is that correct?

3

Hi Jonathan,

You read it right: there’s currently no way to create a read-only token that covers all current and future projects.

Organization-wide tokens do apply to new projects automatically, but they only come with Administer, Create projects, and Execute analysis. Browse is only available with “Selected projects”, which means adding new projects to the token yourself.

For Backstage, the cleanest option today is a “Selected projects” token with Browse. You can keep its project list in sync with a small script against the API when you onboard projects. An org-wide Execute analysis token covers quality gate status and component search for all projects. It won’t return measures or analyses on private projects, though, and it’s not really read-only.

Org-wide read access is a fair ask. I’ll pass it on to the team.

Thanks for the feedback!