Has anyone successfully executed an Assets AQL API call using a service account in Jira Service Mana

[Melbrin]

I’m trying to run the following endpoint:

POST /ex/jira/{cloudId}/jsm/assets/workspace/{workspaceId}/v1/object/aql

The call works perfectly when authenticated with my personal user account.
But when using a service/technical account, the exact same request fails (401 : insufficient_scope):

{
    "code": 401,
    "message": "Unauthorized; scope does not match"
}
To rule out permission issues, I already ensured that the service account has:

All JSM project permissions, including Create issue, Edit issue, Browse project, Service Desk Agent, etc.

Full Assets access on the workspace/schema (viewer + admin roles tested).

The OAuth scopes required for Assets, including:

read:cmdb-object:jira

read:cmdb-config:jira

Despite this, the AQL call still fails, while it succeeds for a normal user.

So my question is:

👉 Has anyone actually managed to make an AQL API call work with a service account on JSM Cloud?

If yes, could you share:

Which authentication method you used (API token, OAuth 3LO, Forge, Connect app, etc.)

Which scopes or permissions were required beyond read:cmdb

Whether a service account needs additional, undocumented permissions

Any limitations you’ve encountered with the new Assets API when using non-human accounts

Any working example (curl/Postman + config) would be extremely helpful.

Thanks a lot!

PS : I can create issues through API and read issues but can't still perform AQL.

[Andrea Robbins · Accepted solution]

Hello!

I got this to work in Postman. Please read the following steps I used and see if there's anything missing on your side:

1. Created an Atlassian service account.

2. Created an API token (Authentication Type API token)

3. I added all cmdb read scopes:

4. I added my URL into Postman as a POST request

https://api.atlassian.com/ex/jira/{cloudId}/jsm/assets/workspace/{workspaceId}/v1/object/aql?startAt=0&maxResults=50&includeAttributes=true - where the cloudId and workspaceId are the actual values

5. I used Basic Authentication with the email address of the service account and the api token value created.

6. Added the JSON body and added the required headers (Accept/Content-Type)

{

"qlQuery": "objectType = Cloud"

}

7. Went back to the schema and added the service account under Apps within the schema I want it to be able to access as an Object Schema Manager:

8. Ran it without any issues:

My guess is yours doesn't work because by default the includeAttributes query parameter is true, and if you don't have the scope to read that, it would fail.

[Marc -Devoteam-]

Hi @Andrea Robbins 

Thank you for correcting me.

[Melbrin]

This is great ! It works perfectly !

Thanks a lot !

[Andrea Robbins]

Happy to know it worked! Thanks also for accepting the answer. I will say it is a very new feature both the service accounts and the ability to use it with assets (like the asset scopes).

[Marc -Devoteam-]

Hi @Melbrin and @Matthias Gaiser _K15t_ 

Based on the API reference and the documentation around service accounts, in general.

The scope options on an API endpoint need the have defined granular scopes.

To my knowledge only the Jira Cloud platform, Jira Software and Jira Service Management API have these options

Not all API's or even API endpoints are usable with a scoped token.

[Matthias Gaiser _K15t_]

Hey @Melbrin

welcome to the Atlassian Community. I tried to do the same - and also failed right now. I'll ping some people to get more eyes on it.

Cheers,
Matthias.

[Andrea Robbins]

Thanks for pinging!