Troubleshooting SonarQube API token

SonarQube Server / Community Build
1

Hey @andres ,

Thanks for the guidence,

I followed you instructions from above.

I am observing different behavior between two SonarQube Community Build instances when querying the API using a Global Analysis Token (sqa_...):

Environment Details:

  • Server A: SonarQube Community Build v25.5.0.107428 (MQR Mode)
  • Server B: SonarQube Community Build v25.2.0.102705 (MQR Mode)

Configuration (Identical on both servers):

  1. Both instances have a Global Analysis Token (sqa_...) generated under the admin user account.
  2. The admin user has Administer System.
  3. The projects on both servers are set to Private.
  4. Both servers use this tokens in a CI/CD pipeline for:

    • Running sonar-scanner analysis (works on both)

    • Fetching project metrics via REST API after Quality Gate evaluation:

      GET /api/measures/component?component=<PROJECT_KEY>&metricKeys=alert_status,bugs,vulnerabilities,code_smells,coverage

Problem / Behavior:

  • On Server A (v25.5.0): The API call with the Global Analysis Token returns HTTP 200 OK with all requested measures as expected.

  • On Server B (v25.2.0): The exact same API call with the Global Analysis Token fails with HTTP 403 Forbidden:

    {

    “errors”: [

    {

    “msg”: “Insufficient privileges”

    }

    ]

    }

Questions:

  1. Was there an intentional change in permission scoping for Global Analysis Tokens between v25.2 and v25.5 that allows them to query /api/measures/component on private projects in newer builds?
  2. For v25.2, is there a specific permission setting required to allow a Global Analysis Token to read measures, or is a User Token (squ_...) strictly required in that version?
    Please let me known how can i troubleshoot this problem

Thank you

2

Hey @andres ,

can you help me out in this or else any other can help me in this

3

Hey @KUSHAL, I took the liberty to split your reply in the other thread into a new post, because it was unrelated to your original question. We prefer to keep topics (meaning, Community posts) focused around a single subject.

That being said, regarding this question: I’m not aware of that specific change between those 2 versions, but in principle, analysis tokens should only be valid for analysis-related endpoints. GET /api/measures/component should not succeed. Could you double-check that you’re using an analysis token for that one? Could you try generating a branch new analysis token and retrying the request, perhaps from your machine instead of the CI?

In any case, you’re running an outdated version of SonarQube Community Build in both servers, so in the event that there was indeed a bug and not simply a misconfiguration, we would only investigate it if you are able to reproduce it on the latest version (26.9). I recommend you update the instance.