API Management

[Bohlale Mashalaba]

Manage API tokens for the organization. I want to block members from creating API tokens but want to centralize creation to allow members to use APIs created for them by Admin

[Bohlale Mashalaba · Accepted solution]

Might help someone who wants to limit API creation and Usage to specific users in org 
Best work around I can think of:

Have more than one Authentication policy

- First default one where you block API token access 

- 2nd would be for the specific users who actually need API access

This way you can have some semblance of control

[Jeroen Poismans]

Hi,

In addition to the previous answer, you might want to take a look at Service Accounts:

https://support.atlassian.com/user-management/docs/manage-your-service-accounts/

This feature is exactly to be able to manage the API tokens without having a user taking up a license.

[Manne Kjærby - ProProces]

Welcome to the community.

Maybe this is what you are searching: https://support.atlassian.com/security-and-access-policies/docs/set-api-token-access/

It requires atlassian guard.

[Bohlale Mashalaba]

so I read this https://support.atlassian.com/security-and-access-policies/docs/authentication-policy-settings-for-your-organizations/#User-API-tokens

but it isn't exactly what I am trying to achieve, with authentication policies I can block members from creating API tokens, but I want to centralize creation and usage to make sure they comply with company standards 

we have approval processes that need to take place before APIs are created and used so that standard block would also block usage which would hinder dev work flow with like jenkins for example. 

[Karan Sachdev]

Hey @Bohlale Mashalaba ,

Welcome to Atlassian Community!

Any user can create API tokens under their Atlassian account: https://id.atlassian.com/manage-profile/security/api-tokens

This is a user level functionality, and admins can't restrict users from creating API tokens under their personal accounts.

However, as @Manne Kjærby - ProProces shared, if you have a Guard subscription, you can control if external users can use their API tokens to access the information from your site.

If allowed, they will only be able to access the information that they have access to. For example, if I don't have the project level permission to view a work item in Jira, I won't be able to access it via API as well.

I hope this helps!

Thanks!