How to restrict who can call an API Atlassian Service?

[Claudia Ramirez]

Hello all,

I would like information on how to restrict who can call an API in Jira Cloud. The main issue is the we want only developers can make API calls. My understanding is that users that have permissions to do something through the UI, like create an issue, they have permissions to do that via an API call. What we want to prevent is a no-developer who have the ability to create an issue in the UI from being able to invoke that call through the API. 

Any advice on this will be greatly appreciated. 

Best Regards 

Claudia 

[Nic Brough -Adaptavist- · Accepted solution]

There's no way to do this.

Why would you want to?  What's wrong with letting people create issues when they have the permission to?

[Claudia Ramirez]

Thank very much you for your answer @Nic Brough -Adaptavist-

It is a control that the organization's security is asking us to have. They want to prevent non-developers from invoking API calls; they can create an issue via the UI, but they would not be able to invoke the API call in any other way. At the Basic authorization for REST APIs: simple scripts and manual calls; can it be as simple as not sharing an API token and managing the API tokens granted?

Thank you! 

[Nic Brough -Adaptavist-]

I'd question what your security team is saying - what is the logic behind blocking the access?  What security problem would it solve?  Given that the users can do anything in the UI already, it's not going to plug any security holes.

There's still no reason to block your users using the API.  They're using it for some of the activities in Jira (the UI makes REST calls to itself in quite a lot of places)

Yes, you could "not share an API token", but you won't be able to stop people creating theim.

[Claudia Ramirez]

Thank you very much for your response @Nic Brough -Adaptavist-!

It also has to do with some performance situations, as some users can make scripts that can produce performance issues.

One question, Nic, on Jira Data Center you can administer personal access tokens as an admin, and revoke those tokens if it is needed. Do you know if on Jira Cloud you have this feature? 

Thank you very much

Claudia

[Nic Brough -Adaptavist-]

Ah, ok, I had not picked up the main problem.  It's not security, it's performance.

I don't think you can do that on Cloud unless you are using Atlassian Access for the users. 

[Claudia Ramirez]

@Nic Brough -Adaptavist- Thank you very much. I reviewed the Atlassian Access documentation. 

I think that the simplest way to restrict the calls to REST API would be monitoring>revoking the personal tokens.

Thank you for your responses Nic and have a great long weekend!

[Nic Brough -Adaptavist-]

I know it's not what you were hoping for, but I'm glad we got you something that might be useful.

I don't have a long weekend, I'm English.

[Claudia Ramirez]

@Nic Brough -Adaptavist- anyway enjoy your weekend and Thanks :)

Cheers