Jira Service account unable to make Jira Ops API calls

[Tomi Sofowora]

Hi all,

I'm receiving a 403 error below when making a call to Jira Ops using a Jira service account.

{

    "code": 40301,

    "message": "Account does not have access to Opsgenie.",

    "took": 0.015,

    "requestId": "6e1054c5-8828-48c8-99f2-5ebff97aed54"

}

The account has agent access to JSM, read/write:ops-alert:jira-service-management scope permissions and has been added to a team.

Please advise on what the issue could be.

Thanks

[Marc -Devoteam-]

Hi @Tomi Sofowora 

As mentioned by @Trudy Claspill this is only possible with a full API token, as the Jira Service Management ops has no granular scope options for the API.

Until the API gets granular scopes, these options can't be accessed with a scoped token, only a full token can be used.

[Trudy Claspill]

@Marc -Devoteam- 

Where did you find the information that the JSM Operations API doesn't support granular scopes?

[Marc -Devoteam-]

Hi @Trudy Claspill 

API endpoints supported  by scoped tokens have a granular option at each API endpoint. API endpoints which don't mention granular options can't be used by scoped tokens

[Trudy Claspill]

I'm eager to learn about this...

Is this not evidence that the endpoint supports a scoped API?

https://developer.atlassian.com/cloud/jira/service-desk-ops/rest/v2/api-group-alerts/#api-v1-alerts-id-get

[Joseph Chung Yin]

@Tomi Sofowora 

I agreed with what @Trudy Claspill replies.  I would recommend that you contact Atlassian Support team (https://support.atlassian.com) for further assistance on your issues.  They will have further system-side loggings to address your ask.

Best, Joseph

[Trudy Claspill]

Hello @Tomi Sofowora 

Have you granted the service account access to the OpsGenie product? Service accounts need to be granted access to the products where you want the service account to be able to take action.

I don't have OpsGenie myself so I can't verify the steps necessary to accomplish this.

[Tomi Sofowora]

Hi Trudy,
After speaking with our admin we have never had access to the Opsgenie product, we have only ever dealt with Jira Operations within Jira Service Management. 

Thanks

[Trudy Claspill]

What API endpoint are you calling? Can you provide a link to the documentation for it?

[Tomi Sofowora]

GET https://api.atlassian.com/jsm/ops/api/{cloudid}/v1/alerts

The call works fine with my user account but not with the jira service account

https://developer.atlassian.com/cloud/jira/service-desk-ops/rest/v2/api-group-alerts/#api-group-alerts

[Trudy Claspill]

Disclaimer: I have not worked extensively with scoped API tokens nor JSM Operations.

Have you tried with your own account with a API token scoped the same as the one you created for the Service account?

Have you tried using a non-scoped API token with the service account?

I'm trying to ascertain if the problem is related to the scoped API token or some other element of the permissions for the service account.

[Clark Everson]

Hi @Tomi Sofowora 

I have escalated this to Atlassian Support, it can take a couple of days for them to evaluate it just as a heads up. They may ask for a ticket as you may need to share additional account information, which a public forum is not the safest place to do so.

Best,
Clark