Invalid project key error from SonarQube Project Creation API

Answer to the Questions

1. Does SonarQube 10.x enforce a strict lowercase‑only pattern for project keys?

   Confirmed: In current 10.x snapshots the validator rejects uppercase letters and underscores, returning a 400 Bad Request with "Invalid project key". The rule follows the documented pattern ^[a-z0-9]+(?:-[a-z0-9]+)*$.

2. Is there a programmatic way to retrieve the exact validation regex or constraint list from the API?

   Confirmed: The REST API does not expose a dedicated endpoint for the regex. The only observable behaviour is the generic 400 response; any further detail would require inspecting server‑side code or logs.

3. How can integration test suites reliably validate project key formats without coupling tests to a specific SonarQube version?

   Recommended: Validate the key locally against the documented pattern, then attempt project creation on a controlled instance. Capture the full error payload to detect any version‑specific quirks.

Likely Explanation vs Confirmed Facts

• Likely: Earlier releases (7.x–9.x) tolerated uppercase or underscores in some deployments, but 10.x has tightened enforcement.
• Confirmed: 10.x rejects non‑lowercase alphanumerics and hyphens, as observed in our local Docker tests.

Practical Steps for an Integration Test

1. Define the regex in test code:

   const KEY_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
   

2. Generate a candidate key and assert it matches:

   const key = `test-${Date.now()}`;
   if (!KEY_REGEX.test(key)) throw new Error('Key format invalid');
   

3. Create the project via the API with a short‑lived token that includes the projects:create scope:

   curl -u <token> \
        -X POST \
        -d "name=Test Project" \
        -d "projectKey=${key}" \
        http://localhost:9000/api/projects/create
   

4. Check the HTTP status:
   • 200 – success.
   • 400 – "Invalid project key" – indicates a server‑side constraint violation.
5. Log the full response body for any additional clues and adjust the key or test logic as needed.

Next Diagnostic Detail Needed

To tailor the guidance precisely, please provide the SonarQube major/minor version you are targeting (e.g., 10.0, 10.1). Validation behaviour can vary slightly across releases.