get data of projects to which only a certain user has access (API)

[Iacob_ Vincențiu Mihail]

I'm trying to get information about all projects to which a certain user has access. I'm starting with this endpoint:

https://api.atlassian.com/ex/jira/{tenant_id}/rest/api/3/project/search

Then iterating over all project roles:

https://api.atlassian.com/ex/jira/{tenant_id}/rest/api/3/project/{project_key}/role

And then retrieving the individual project roles and checking if that user (called "actor" in the API) belongs to any of these roles:

https://api.atlassian.com/ex/jira/{tenant_id}/rest/api/3/project/{project_key}/role/{project_role_id}

The problem is that there are around 1800 projects and iterating over all this takes a really, really long time (maybe 30 minutes or so), because jira cloud doesn't respond so quickly. Is there any way I can access this faster, maybe using some bulk requests of some sort?

[Petru Simion _Simitech Ltd__]

Hi @Iacob_ Vincențiu Mihail ,

What you are trying to answer is a bit more complex than just checking whether a user appears directly in a project role.

In Jira Cloud, a user can effectively have access to a project in multiple ways, for example:

• by being assigned directly as an actor in a project role
• by being part of a group that is assigned to that role
• sometimes through broader permission configuration, depending on what exact “has access” means in your case

So if your goal is “all projects this user can access”, iterating through every project, every role, and every role actor is not only slow at scale, but also incomplete unless you expand group membership as well.

With around 1800 projects, your current approach is unfortunately the kind of thing that becomes very expensive in Jira Cloud because there is no single bulk endpoint that says “give me all projects accessible to user X together with the exact role path.” At least not in a way that avoids a lot of traversal.

A few practical points:

1. Direct role membership alone is not enough
   You also need to resolve group actors and then determine whether the target user belongs to those groups.
2. There is no great bulk shortcut for this specific relationship
   The project search and role APIs are fine, but they are not optimized for this kind of reverse lookup across a large site.
3. Caching / precomputation is usually the only scalable route
   If you need this often, the realistic solution is to build and maintain an indexed relationship map instead of resolving it live each time.

The reason this gets tricky is that there are really two useful ways to look at the same data:

• Project → Role → User
  Good when you want to inspect who has access inside a given project.
• User → Role → Project
  Good when you want to answer exactly the question you asked: where does this user have access, and through which role.

That second perspective is especially useful once group-based role assignments are involved.

Disclosure: I’m part of the team that built Roles Usage for Jira. It was designed specifically for this kind of visibility problem, including both the Project → Role → User relationship view and the User → Role → Project relationship view, and it also takes into account access paths through groups, not just direct role actors.

Results are exportable in CSV format.

So if this is something you need regularly rather than as a one-off script, it may be worth looking at a tool that precomputes those relationships instead of walking the REST API live every time.

Regards, 

Petru

[Iacob_ Vincențiu Mihail]

Hi,

Thank you for your detailed answer!

In our case I think the roles should be enough. The actor/user I'm looking for is actually an Active Directory group, but Jira sees it as a user along with the other standard users. Has only been assigned by associating it with a role.

As a non-org-admin I'm not sure I have access to seeing the groups in the UI or maybe I'm missing something. When I go to projects, I can see the 'People' section.

In the 'Permissions' section I can see some Jira groups assigned to some projects, but those are different from the AD-Group. On the other hand, if Jira sees the AD-Group as a user, then I'm guessing the AD-Group could be part of a Jira-Group.

I think this is actually going to be a one-off script, yes. I would like to make it faster so I can test things more easily. Maybe concurrency could help to some extent :)

[Iacob_ Vincențiu Mihail]

No, I guess I was wrong. The AD-Group is seen also as a Jira group. So I should have mentioned that from the very beginning. I guess that makes things simpler. Just searching for that group in the roles API endpoint I guess should be enough, at least in our case.

[David Nickell]

I don't know if these user search endpoints are any faster  - but at least you could do multiple projects at one time.  (or so it appears).

Note -- this screenshot came from my REST API Browser I share with the community from time to time. (free).   It may be hard to spot, but I started with a query paramter search.

REST Browser 

[Staffan Redelius]

Hi @Iacob_ Vincențiu Mihail and welcome

It depends on your usecase.

Do you have the same permission schema for all projects? If the user have the browse project permission they will be able to at least see the project and its content. If this permission is assigned to one or several groups you need to investigate what groups the user is member of and cross-reference that with the permission schemas.

If you only want to know which project roles a specific user has in different projects you can look up the user under Administration -> Directory -> Users and click on the three dots to the right of the application access and choose "View Jira project roles"

This requires you to have Org-admin permission to be able to access the user administration.

I hope this helps!

Best regards,
/Staffan