Ctrlk
Sprinto DashboardAPI Reference
For the complete documentation index, see llms.txt. This page is also available as Markdown.

SonarCloud Integration

Integrate SonarCloud with Sprinto to automatically import and monitor code vulnerabilities for compliance.

The SonarCloud integration enables Sprinto to automatically import vulnerability data from your code repositories. This helps you monitor security issues, track remediation, and maintain compliance with security frameworks.

Once connected, Sprinto continuously fetches vulnerability data and maps it to relevant controls and checks, eliminating the need for manual evidence collection.

How It Works

Sprinto connects to SonarCloud using API-based authentication. After the integration is established:

  • Sprinto retrieves a list of projects within your SonarCloud organisation.

  • Vulnerabilities are fetched and filtered based on issue type.

  • Branch-level data is used to evaluate relevant code states.

  • The data is mapped to controls and checks within Sprinto.

The integration runs periodically to ensure that vulnerability data remains up to date.

Sprinto checks for Halo Security

Following are the Sprinto checks available for SonarCloud:

Sprinto check
Required action

SonarCloud vulnerability alert should be resolved within SLA

A vulnerability currently exists in the 'Open' status on your integrated Halo Security account. Please address the vulnerability from its source and close it on your Halo Security account.

Features

  • Automated vulnerability tracking from SonarCloud.

  • Continuous monitoring of code security issues.

  • Automatic evidence collection for compliance controls.

  • Centralised visibility into vulnerabilities across projects.

  • Reduced manual effort during audits.

Use Cases

Use Case
Description

Continuous Compliance

Automatically track vulnerabilities as part of compliance checks.

Audit Readiness

Provide auditors with up-to-date vulnerability evidence.

Security Monitoring

Identify and monitor risks across code repositories.

Reduced Manual Effort

Eliminate manual uploads of vulnerability reports.

Prerequisites

Before setting up the SonarCloud integration, ensure the following requirements are met.

Access Requirements

  • You must have admin access to your SonarCloud account.

  • The account used to generate the API token must have Administer Organization permission.

  • Ensure the account has Browse Project access to all projects you want to monitor.

Credentials Required

  • A valid SonarCloud API token.

  • The Organisation Key for your SonarCloud account.

Project Readiness

  • Ensure that your SonarCloud organisation contains active projects.

  • Projects should have completed scans with available vulnerability data.

  • The main branch (or relevant branches) should be configured and accessible.

Network and Access Considerations

  • Ensure there are no network restrictions blocking communication with SonarCloud APIs.

  • API access should not be restricted by IP allowlists or firewall rules.

Recommended Setup

  • Use a dedicated service account for generating API tokens.

  • Ensure the token remains active and is not rotated without updating it in Sprinto.

Permissions Required

Sprinto uses SonarCloud APIs to discover projects, fetch vulnerabilities, and monitor code branches. The integration requires both organisation-level and project-level permissions.

APIs Used by Sprinto

API Endpoint
Purpose

GET /api/projects/search

Lists all projects in the organisation.

GET /api/issues/search

Fetches vulnerabilities (issues of type VULNERABILITY).

GET /api/project_branches/list

Retrieves project branches.

Required Permissions by API

API Endpoint
Permission Required
Scope

/api/projects/search

Administer Organization

Organisation-level

/api/issues/search

Browse

Project-level

/api/project_branches/list

Browse Project

Project-level

Minimum Required Role

The minimum organisation-level role required is:

  • Administer Organization.

This is required because Sprinto must:

  • Discover and list all projects in your organisation.

  • Enable project selection for vulnerability tracking.

Without this permission, Sprinto cannot initialise the integration.

Additional Requirements

  • Ensure Browse Project access for all projects to be monitored.

  • API tokens inherit the permissions of the user who generates them.

  • Use a dedicated service account where possible.

Plan Considerations

  • Free plans: Access is limited to projects owned by the token user.

  • Team / Enterprise plans: Project access can be managed using permission templates.

Get SonarCloud Credentials

Before connecting the integration, generate the required credentials from SonarCloud.

Generate API Token

  1. Log in to your SonarCloud account.

  2. Click your profile icon in the top-right corner.

  3. Select My Account.

  4. Navigate to the Security tab.

  5. Enter a name for the token.

  6. Click Generate Token.

  7. Copy the API token and store it securely.

Get Organisation Key

  1. Navigate to the Organisations tab in SonarCloud.

  2. Locate your organisation.

  3. Copy the organisation key displayed next to the organisation name.

Setup SonarCloud Integration

Step 1: Navigate to Integrations

  1. Log in to the Sprinto dashboard.

  2. Go to Settings → Integrations.

  3. Search for SonarCloud.

  4. Click Connect.

Step 2: Review Permissions

  1. In the connection drawer, review:

    • Permissions required.

    • Data accessed by Sprinto.

  2. Click Next.

Step 3: Enter Connection Details

  1. Select Connection type: API Key.

  2. Enter:

    • API Token.

    • Organisation Key.

  3. Refer to the inline instructions in the drawer to generate these credentials.

  4. Click Connect.

Post-Connection Behaviour

After connecting:

  • SonarCloud appears as Connected in the Integrations page.

  • Sprinto begins importing vulnerability data.

  • Controls and checks are automatically populated.

  • Vulnerability data is continuously refreshed.

Enable Vulnerability Monitoring

To start tracking vulnerabilities:

  1. Go to Data Library → Vulnerabilities → Overview.

  2. Click + Add monitoring source.

  3. Select SonarCloud.

  4. Click Add SonarCloud.

  • By default, all projects are selected.

  • Use Manage to customise project selection.

Sync and Evaluation

  • Initial sync takes approximately 15–20 minutes.

  • Full evaluation may take a few hours.

  • Sprinto continues to sync data periodically.

Manage the Integration

Update Connection

  • Navigate to Settings → Integrations → SonarCloud.

  • Update credentials if required.

Disconnect Integration

  • Click Disconnect to remove the integration.

  • Automated evidence collection will stop.

Troubleshooting

Unable to connect to SonarCloud

  • Ensure the API token is valid and has not expired.

  • Verify that the token belongs to a user with Administer Organization permission.

  • Confirm that the organisation key is correct.

Projects are not visible in Sprinto

  • Check if the user has Administer Organization permission.

  • Ensure the organisation contains active projects.

  • Verify that the API token is generated from the correct organisation.

Vulnerabilities are not syncing

  • Ensure the user has Browse Project access to the relevant projects.

  • Confirm that vulnerabilities exist in SonarCloud for the selected projects.

  • Allow time for the next sync cycle to complete.

Integration connected but no data appears

  • Check if projects are correctly configured within SonarCloud.

  • Verify branch availability, especially the main branch.

  • Ensure there are no permission restrictions at the project level.

Invalid API token or authentication errors

  • Regenerate the API token from SonarCloud.

  • Avoid using expired or revoked tokens.

  • Ensure there are no extra spaces while pasting the token.

Support

If you face any issues while setting up or using the SonarCloud integration, contact the Sprinto support team for assistance.

PreviousSocket IntegrationNextSonarQube Integration

Last updated