Required scopes and permissions for /rest/api/3/issue/{issueIdOrKey

[Nivi Mor]

I want to use the /rest/api/3/issue/{issueIdOrKey endpoint to query issues. I followed the docs and created a token with classic read:jira-work scope. 

When I query an existing issue I get:

{"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}%

I even tried granular permissions but got the same result.

If I create non-scoped API token the API works and returns the issue.

As the user who created this token, I have permission to browse the project where the issue is.

What am I missing here?

[Gor Greyan · Accepted solution]

Hi @Nivi Mor

Yes, you are right, Nivi — that behavior happens because API tokens used with Basic authentication don’t use scopes at all.

Scopes are only enforced when you’re using OAuth 2.0 authentication (for example, when an external app integrates with Jira Cloud via the Atlassian platform). In that case, the access token’s scopes (like read:jira-work, write:jira-work, etc.) determine what the app can do.

However, when you use Basic auth with an email + API token, Jira treats the request as if it’s coming directly from your user account, so:

• It completely ignores OAuth scopes.

• Your request’s permissions depend only on your Jira account permissions (project browse rights, issue security, etc.).

• That’s why the non-scoped API token worked, while the scoped OAuth token failed — the latter was missing the required OAuth context or proper cloud ID in the API URL.

[Nivi Mor]

OK I figured it out. Scopes are only relevant for OAuth 2, not for basic auth.

[Jesper Evo Matthiesen]

deleted.. I asked a question and then realized I was posting an answer..