SonarQube Server ↔ CI Scanner: Can a Scoped Project Token Replace User Credentials for Full Pipeline Analysis and Quality-Gate Checks?

We want to validate that a CI pipeline can authenticate to SonarQube and complete the full analysis cycle—including project creation or selection, branch/PR parameter handling, and quality-gate polling—using only a scoped project analysis token instead of a broad user token. The SonarQube documentation indicates project tokens are intended for least-privilege analysis submission, but it is unclear whether they also cover project provisioning, ALM-linked branch parameters, and the quality-gate status endpoint that some scanner wait properties rely on. Behavior varies by edition (Community vs. Developer/Enterprise) and server version, so a local test against a disposable instance may not reproduce production capability gaps. We must avoid using any production tokens, personal credentials, or real source code during verification.

1. Does a project analysis token permit project creation and branch/PR parameter submission, or are those operations restricted to user tokens with higher permissions?

2. Can the scanner's quality-gate wait property (or an equivalent Web API call) succeed with only a project token across supported editions?

3. What is the minimal token scope that satisfies an end-to-end pipeline run without elevating to a user token?