Hello and thank You kindly for your time!
I was tasked to make a system where:
- a JIRA ticket would be assigned an approver
-the ticket would be set to an "Awaiting Approval" status
-the assigned approver would receive a Teams card letting them know they have a JIRA Ticket to approve
-the Teams card would have *active buttons* to click to "Approve" or "Decline"
-the user's Teams card response would be sent back to JIRA and the appropriate JIRA approval status would be updated.
I am using:
- a JSM Space, and an API created in Atlassian on my account.
- JSM Automation
- Microsoft Power Automate (with Webhook)
- Teams
- *Note: JIRA Cloud App Integration in Teams WAS NOT Necessary for this to work
Thanks to the JIRA Community and some AI help, I am able to get this system working in Teams!
YAY!
...but ONLY when I'm the Approver.
Awwww.
Seems like the API I created in JIRA (Atlassian)) works perfectly fine when I am the Approver: sending the Teams card to my Teams, registering my button press in the Teams card, sending the answer back to JIRA via the API I created on my account, and successfully updating the ticket's Approval status with "Approved" or "Declined".
BUT.
When making another test user an approver? He gets the Teams card with the buttons OK. and can click his response, OK; But Power Automate, using my credentials to authenticate the API to send his response back gives a 403 Forbidden error in Power Automate (or maybe from JIRA that Power Automate is relaying?)
If I can somehow get the other user's answer, then use my authenticated API to upload their answer, that's pretty much the last task to fix. Or get that user's answer to use my API (that I'm authenticating in Power Automate correctly) would also work.
I did read that the JIRA security for one user using another user's API is the sticking point here. Is this the issue? Can It be worked around? I'm not a developer by trade, and am just learning about API's (JIRA's specifically), but I can code well enough.
I'm THIS CLOSE to making this work for the staff, so any thoughts are greatly appreciated.
Take care and be well!
The reason it only works when you're the approver is the token, not Power Automate. The JSM approvals endpoint records a decision as whoever owns the API token, and Jira will only accept a decision from someone who's actually a pending approver on that request. Your webhook carries your token, so yours are the only clicks that can ever land.
A service account runs into the same thing, unless the service account is itself the approver on every request - there's deliberately no "approve on behalf of" in the API, otherwise the approval audit trail would mean nothing.
For true in-card buttons for every approver, the only route is per-user auth: an OAuth 2.0 (3LO) app each approver consents to once, tokens stored per person, and the flow picking the right token based on who clicked. It works, but you'd be building token storage, refresh and revocation handling around it.
What I'd actually do: keep the Teams card as the nudge, and make the Approve/Decline buttons deep links to the approval view in Jira or the portal. The approver arrives as themselves, decides, and the audit trail stays honest - one extra click versus your dream flow.
One more thing in your favour: Jira's own approval notification email already has per-user Approve/Decline buttons with none of this complexity, so some teams treat email as the action channel and Teams as the attention channel.
Maybe try using an Atlassian service account instead of your personal account and API token? Note that if you use a service account the URL you use changes, for Jira it would look something like this: https://api.atlassian.com/ex/jira/{cloudId}/rest/api/3/project/{project_key}
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Thank You kindly for your time and answer.
As I was pressed for time on this project, I reverted to KISS (keep it simple, silly).
I decided to remove the buttons in the card and provide a bit more detail In the Teams Card letting the target user know to go to the web portal and Approve/Decline the ticket there instead.
I will continue looking into the JIRA service accounts for possible future projects thanks to You.
Take care and be well!
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.