read issue rest api returns "Issue does not exist or you do not have permission to see it."

[Jesper Evo Matthiesen]

This is a question for the closed issue https://community.atlassian.com/forums/Jira-questions/Required-scopes-and-permissions-for-rest-api-3-issue/qaq-p/3135981#M1179779

Was there a recent regression on this problem? It looks like tokens with scopes and basic auth stopped working somewhere between April 25th and today.

My scoped token was created on April 9th and worked at least until April 25th.

If I use a new token without scopes, I can retrieve issues again..

The answer from Gor on the linked issue indicates that scoped tokens are supposed to work with basic auth!?

[Andy Rusnak]

Hi @Jesper Evo Matthiesen , 

Thanks for using the Atlassian Community!  Scoped tokens do work with Basic Authentication via the REST API.  However, they need to go to a different endpoint.  The <baseURL>/rest/api/3/issue/{key} will not work with scoped tokens, only non scoped tokens.  If you use this endpoint with a scope token you will get the message you noted.  

If you would like to use a scoped token you would want to use https://api.atlassian.com/ex/jira/{cloudID}/rest/api/3/issue/{key}.  I tested this locally and confirmed it will return a 200 response provided the account has the proper permissions to resource being requested of course.  

Additional information around this can be found within Manage API Tokens for your Atlassian Account.   

Can you confirm if you are using the proper endpoint with scoped tokens?  

Best, 
Andy

[Jesper Evo Matthiesen]

I cannot confirm the endpoint as the problem is with the Jira Jenkins plugin. I created a new scoped token (old one expired) on April 9th, and the plugin worked with that. We have proof that it worked at least until April 25th, then it stopped working somewhere between then and now. Trying that token with curl:

curl -D- \
   -u fred@example.com:freds_api_token \
   -X GET \
   -H "Content-Type: application/json" \
   https://your-domain.atlassian.net/rest/api/2/issue/<issue key>

did not work (404 and the message I mentioned). Using a non-scoped token does work with the above though, and I hardly believe that the plugin suddenly switched api.

Anyway, the wording in the accepted answer to the linked issue ("worked"/"failed") and that my scoped token worked for a while led be to think it referred to a bug which has been fixed, but that was me misunderstanding I guess. Maybe the basic auth for rest api page should mention that it only works for non-scoped tokens!?

[Andy Rusnak]

Jesper, 

Thanks for the follow up.  I would expect the CURL you referenced there to fail with a scoped token as that is not the correct endpoint to use with scoped tokens.  In order to use scoped tokens with the REST API you have to go to endpoint like this:  https://api.atlassian.com/ex/jira/{cloudID}/rest/api/3/issue/{key}.  The <baseURL>/rest... endpoints will not work with scoped tokens.  This expected behavior.  

Scope tokens do work with basic auth within the REST API, but they need to directed to the https://api.atlassian.com/ex/jira/{cloudID} endpoint rather than the base URL endpoint.  

In terms of the Jenkin's integration, I am not sure what endpoint they are hitting.  But if they are reaching out to the base URL endpoint rather than the https://api.atlassian.com/ex/jira/{cloudID} endpoints then I would expect that to fail with a scoped token.  

Best, 
Andy

[Jesper Evo Matthiesen]

yes, the curl I quoted indeed doesn't currently work with scoped tokens, but it seems it did sometime in April at least. Anyway, I can use a non-scoped token with the plugin just fine, it was just annoying that it stopped working out of the blue without us updating any of the software, or changing configuration.

Regarding the endpoint using the cloud id, I was under the impression this only worked using oauth, but good to know it also works with basic, should we need it.