Is there a way to bypass Captcha for API requests?

[bhulka]

Currenty, I have a stack of automation in place, that revolves around Jira API. Managing tickets, getting updates, commenting, etc.

Now it seems that Atlassian has enforced captcha checks for API's that are meant (?) to be used by other non-human systems. I'm receiving `HTTP/2 405 Not Allowed` for all requests, even to get diagnostic information from the cloud instance. For me it makes little sense, as well as indicates a bit of possible AWS WAF / Cloudfront misconfiguration on Atlassian side.

Example request:
```

curl -H 'Authorization: Bearer <JIRA_API_TOKEN>' 'https://acme.atlassian.net/rest/api/3/search?jql=project%3D%22AB%22+ORDER+BY+created+DESC&startAt=0&maxResults=100' -vv
```

and get the following (truncated due to verbosity):
```

> Host: acme.atlassian.net
> User-Agent: curl/8.12.1
> Authorization: Bearer <JIRA_API_TOKEN>
< HTTP/2 405
< server: CloudFront
< x-amzn-waf-action: captcha
< access-control-allow-headers: x-amzn-waf-action
< x-cache: Error from cloudfront
< via: 1.1 ff9802edfc33ac761711281d7826a1f8.cloudfront.net (CloudFront)
< x-amz-cf-pop: BUD50-P1
< x-amz-cf-id: ft02DRubTu_Tf-YbBFyVCdZTe40GJTOcBOAw7iqwICaLzm59rI3AKQ==
...
<title>Human Verification</title>
...
script src="https://99a173f17960.7e8ef487.eu-north-1.token.awswaf.com/99a173f17960/52be4ea59000/39cb15f4a9e2/challenge.js"
script src="https://99a173f17960.7e8ef487.eu-north-1.captcha.awswaf.com/99a173f17960/52be4ea59000/39cb15f4a9e2/captcha.js"
...
```

This change, virtually has cut off all the users and companies automation built on top of Jira APIs, greatly decreasing productivity, because now all the automated things need to be done manually via Jira web app.

Should I ask my jira product admin to raise an official support ticket, or is there any documentation that unequivocally states that even M2M API requests need to pass AWS WAF / AWS Cloudfront CAPTCHA checks? 

[Dick · Accepted solution]

Hi @bhulka Welcome to the Atlassian Community

To the best of my knowledge, the bearer token and the user's email should be combined to a set of credentials first, as described by @Pramodh M in this answer. 

The captcha's only kick-in when there's too much false logins occurring (which would be triggered by your approach). Resetting the account's login failures by your admin and using the method above would rid you of the captcha's.

Kind regards,
Dick

[bhulka]

@Dick, thank you for your reply and suggestions. The base64('email:PAT') is not working as well, and looks like it ceased to work around 25th of April (due to captcha enforcement).

I'll poke my jira admin and will get back here if the issue persists after resetting account login failures (if there are any).

Best regards,
BH

[bhulka]

UPD: Answer from 2017, where API requests are not supposed to be covered by CAPTCHA.
I'm leaning into misconfiguration theory further, unless no developer.atlassian.net documentation provided.

[bhulka]

Jira admin shown that my account was not blocked.

Running requests via tor works 50/50, I'll establish a proxy somewhere inside AWS and get rid of this behavior.

TL;DR: AWS WAF marked my IP into a blacklist, enforcing captcha to pass each and every time run a request. Atlassian is only using this piece of software as a service, so they're not directly accountable for this behaviour, fortunately or not.

If someone faces a similar issue from their home IP - try a VPN or a known and safe proxy.

[Dick]

Thank you for the update, @bhulka it's really appreciated.

Kind regards,
Dick