Is there an API endpoint to introspect Jira API token scopes (independent of user permissions)?

[sagi karach]

Hi,

We are working with Jira Cloud API tokens that use scopes (both Classic and Granular), and we would like to clarify whether there is any way to introspect the permissions of the token itself, rather than the permissions of the underlying user.

Specifically, is there any REST API endpoint or supported mechanism that allows us to:

• Retrieve the list of scopes granted to the current API token, or

• Determine which REST API capabilities are allowed based on the token’s scopes, independently of the user’s project roles, groups, or permission schemes?

At the moment, it appears that:

• Endpoints like /mypermissions only reflect the user’s Jira permissions, not the token’s scopes.

• There is no obvious endpoint similar to OAuth introspection that returns the token’s granted scopes.

• The only practical way to verify scope-related access is by probing endpoints and observing 401 “scope does not match” responses.

We would like to confirm whether this understanding is correct, or if there is an official or recommended way to inspect or validate API token scopes directly.

Thanks in advance for the clarification.

Best regards,
Sagi Karach

[Sayali Alhad]

Hi @sagi karach 

Welcome to Atlassian Community!

See if below endpoint helps - Get all API tokens in an org 

Regards,

Sayali Alhad

[sagi karach]

The suggested organization level endpoint does not answer our question. We are only trying to confirm whether token access can be determined separately from the user who created it.