How to add product access (Now called "App access") to groups via a REST API?

[Chelluri Durga, Venkata Sai Keshav]

Hi guys,

We are developing a Jira cloud Auto provisioning service, and in the process, we want to add product access (now called "App access") to groups for Jira and Confluence sites via a REST API on both App access and administration access. These groups are created in Azure AD and then got synced to Jira through Enterprise Applications. These groups are visible in the App Access UI in both App access and administration access in the Add group dialog box.

We found an API to grant access to the group
Here the link: https://developer.atlassian.com/cloud/admin/organization/rest/api-group-groups/#api-v2-orgs-orgid-directories-directoryid-groups-groupid-role-assignments-assign-post

We are not sure about the roleId parameter here. We want to confirm whether this is the API we are looking to grant access to the groups.

Just for your reference, I've attached the UI page where we normally used to add product access earlier. Thanks in advance.

[Nikola Perisic]

Hello @Chelluri Durga, Venkata Sai Keshav 

Which part is confusing regarding the roleid? 

Explanation for each roleid:

• atlassian/user: A standard user with access to specific Atlassian applications (e.g., Jira Software, Confluence). They are typically billable and can create, edit, and interact with content and issues within the permissions granted to them in projects or spaces.
• atlassian/user-access-admin: This role manages user access to a specific application (e.g., a Confluence user access admin manages who can use Confluence). This admin does not automatically get access to the content within the app they administer, and only an organization admin can assign this role.
• atlassian/admin: This is a broad term that can refer to several admin levels, from a project/space admin to an Organization admin, the highest level of admin.
  • Organization Admin: Manages users, groups, security (like SSO and user provisioning), and apps across the entire organization.
  • Site Admin: Manages users, groups, and apps for a specific site within an organization.
  • App Admin: Administers the settings within a specific product (e.g., Jira settings), but generally doesn't have access to Atlassian Administration.
• atlassian/guest: A Confluence-specific role designed for external users who need access to exactly one space with limited permissions (viewing and commenting). They are often free users and must be explicitly invited to that single space.
• atlassian/contributor: A free user role specific to certain products like Jira Product Discovery. Contributors can provide feedback, comment, and vote on ideas, but cannot create or manage the product roadmap or administer the project (those are "Creator" tasks).
• atlassian/customer: Specific to Jira Service Management (JSM). Customers are typically external users who interact with the service desk via a help center portal to raise and track requests. They generally do not count as billable JSM users and cannot access Jira internally.
• atlassian/basic: This is not a standard Atlassian role name. User access is usually defined by specific roles (like user, stakeholder, etc.) or the plan level (Free, Standard, Premium).
• atlassian/stakeholder: In Jira Product Discovery, this is a free, non-licensed user who can view published, read-only roadmaps and provide limited input, but does not count towards the product license and is not a project member. In other contexts like Opsgenie, they have view-only access to status pages.
• atlassian/viewer: A read-only role in products like Confluence or Jira, allowing users to view content or issues but not necessarily edit, create, or manage them. They are sometimes non-licensed users