Question on 3LO App Usage

[LewsTherin]

We understand that the REST APIs will be governed by Jira permissions as per this article,

https://www.atlassian.com/blog/developer/building-secure-and-scalable-integrations-our-guidance-for-third-party-apps

But if we are registering web hooks in Jira to get events, do these permissions still apply? Or can we assume that these permissions are not relevant in the context of Web hooks?

[Sunny Ape]

Hello @LewsTherin 

It depends on what you mean by registering the web hook "in" Jira.

If you register it "in" Jira's GUI, then it is a Global one that will just send the events to whatever destination URL you designate, without requiring any further permissions or authority to do their job.

If you register it "in" Jira's REST API Register dynamic webhooks endpoint, then is a Dynamic one because that registration process is done from an OAuth 2.0 (3LO) registered app, and it 'belongs' to that app, and it must be refreshed by that app to keep it working after 30 days. However, once registered, Dynamic web hooks also don't need any extra permissions or authority to do their job.