OAuth 2.0 Credentials for Deployments API Incorrect Scope

[cvanduyn]

Hi Everyone 👋

I’m setting up an integration from a deployment tool (Capistrano) to Jira Software Cloud using the Deployments API, and I’m running into a strange OAuth 2.0 scope issue.

Here’s what I’ve done:

1. In Jira Cloud Admin, I went to Settings → Marketplace apps → OAuth credentials → Create new credentials.

2. I entered a name, server base URL (https://oursite.atlassian.net), and added an internet-sourced logo.

3. Under Permissions, I only selected Deployments (unchecked Builds, Development information, Feature flags, and Remote links).

4. I saved the credential and copied the Client ID and Secret.

5. I requested a token using the client credentials flow:

   POST https://api.atlassian.com/oauth/token
   {
     "grant_type": "client_credentials",
     "client_id": "<client_id>",
     "client_secret": "<client_secret>",
     "audience": "api.atlassian.com"
   }

6. The request succeeds, but the returned scope is:

   "scope": "manage:jira-data-provider"

   instead of the expected:

   "scope": "write:deployment-info:jira"

When I use that token against the Deployments endpoint:

POST https://api.atlassian.com/jira/deployments/0.1/cloud/<cloudId>/bulk

 I get:

[{"message":"The request failed: Could not get devops record for cloudId <id>"}] 

---

What I’ve Confirmed

• This credential was created through Settings → Marketplace apps → OAuth credentials.

• Only Deployments is checked under permissions.

• The credential is shown as “Installed – done” in the Jira Admin UI.

• The cloudId is correct (confirmed via the /_edge/tenant_info API).

---

My Question

Is this a known issue where OAuth credentials with Deployments permission incorrectly return the manage:jira-data-provider scope?

Or am I missing an additional configuration step?

Ultimately, I’m just trying to report deployments from Capistrano into Jira Software’s Deployments view.

[cvanduyn]

This is resolved, the root cause was an incorrect CLOUD_ID. I was able to confirm the correct cloud ID with the following:

curl -s https://<your-site>.atlassian.net/_edge/tenant_info

 ✅