New "Service Accounts" and Assets / CMDB

[Frank Vandebergh]

Hi,
We are JSM Premium customer and we want to use the newly released Service Accounts feature. One of the actions we want to perform with this account is call the JSM Assets rest API.

On the Assets schema permissions, we are able to add these service accounts as Users and as Apps. However on the service account itself we need to provide the API token scope and it is not possible to select the cmdb scopes needed for the Asset Management feature. 
Is it possible to perform JSM Assets actions using the new service accounts ? And what is the best way to assign permissions, to the App or User representing this SA ? 

[Bartłomiej Borowy]

Same goes to me, selected all the scopes for cmdb and still got 401.
Service account is added to Assets with the JSM license.

[Bartłomiej Borowy]

Found the issue, there are no scopes for Assets:

https://jira.atlassian.com/browse/AX-1613

[Andreas Stumpf]

https://jira.atlassian.com/browse/JSDCLOUD-16715?focusedId=3700609&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-3700609

[Danyal Iqbal]

Update 05.09.25
Tested with multiple REST Endpoints >Both classic and Granular API Token scopes do not work with Service Account for Assets REST API.

This is probably a bug.

GET https://api.atlassian.com/ex/jira/orgid/rest/servicedeskapi/assets/workspace -> Status 401
{"code":401,"message":"Unauthorized; scope does not match"}
 
GET https://api.atlassian.com/jsm/assets/workspace/workspaceid/v1/aql/objects -> Status 401
{"code":401,"message":"Unauthorized; scope does not match"}
 
GET https://api.atlassian.com/jsm/assets/workspace/workspaceid/v1/object/object id -> Status 401
{"code":401,"message":"Unauthorized; scope does not match"}
 
GET https://api.atlassian.com/jsm/assets/workspace/workspaceid/v1/objectconnectedtickets/49838/tickets -> Status 401
{"code":401,"message":"Unauthorized; scope does not match"}
 
GET https://api.atlassian.com/jsm/assets/workspace/workspaceid/v1/objectschema/list -> Status 401
{"code":401,"message":"Unauthorized; scope does not match"}

[Andreas Stumpf]

Now!

https://jira.atlassian.com/browse/JSDCLOUD-16715?focusedId=3700609&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-3700609

[Pedro Olmo]

Hello @Frank Vandebergh ,

You should set Jira as the product in the token and select the classic model. By selecting these tokens, you should be able to retrieve data from Assets through the REST API.

Regards

[Andreas Stumpf]

Hi @Pedro Olmo 

Doesn't work here:

Invoke-RestMethod : {"code":401,"message":"Unauthorized; scope does not match"}

Best Regards
Andreas

[Loïck DE SOUSA]

Hi,

I’m experiencing the same behaviour on my side.
Do you have any updates on this topic?

[Andreas Stumpf]

Seems that now the rights are live:

https://jira.atlassian.com/browse/JSDCLOUD-16715?focusedId=3700609&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-3700609