Forge app cannot access Jira Assets API – always receives 401 (NEEDS_AUTHENTICATION_ERR)

[sparkmindai]

Hi Atlassian Support team,

I’m building a Forge Custom UI app that needs to read Jira Assets data.
Environment: Jira Service Management Cloud (Premium trial), site URL: https://sparkmindintelligentip.atlassian.net
App ID: ari:cloud:ecosystem::app/a17f7bb6-52d7-47a6-ad0f-79526f0f5116
Cloud ID: 2370b4f5-abe5-44da-8268-1c27e3f73784
Workspace ID: 772f51ac-5c5e-41f6-8442-39cb8c134a80

Problem:
No matter which Assets endpoint I call via `@forge/api` (e.g. `/jsm/assets/workspace/{workspaceId}/v1/object/aql` or `/gateway/api/jsm/assets/...`), Forge always returns:
`[NEEDS_AUTHENTICATION_ERR: Authentication Required] status=401, serviceKey=atlassian-token-service-key`

What I have tried:
1. Upgraded the site to JSM Premium and created an Assets workspace + schema + sample objects.
2. Confirmed my user is in the `jira-servicemanagement-users` (agent) group and can use Assets UI normally.
3. Manifest scopes include `read:servicedesk-request`, `read:jira-work`, `read:servicemanagement-insight-objects`, `read:cmdb-object:jira`, `read:cmdb-type:jira`, `read:cmdb-attribute:jira`, `read:cmdb-schema:jira`, etc.
4. Ran `forge deploy` + `forge install --upgrade` each time scopes changed; uninstall/reinstall also tried.
5. Restarted tunnel, tested both `api.asUser()` and `api.asApp()`. All attempts still return the same 401.

Sample log snippet:

[Marc -Devoteam-]

HI @sparkmindai 

Have you created an API token for the user using the API calls?