Atlassian connect authenticatedAsAddon returns 403 (Missing user picker permission)

Question

Hi,

We are using the atlassian-connect library to call a REST that should give us a list of all users that are reporters in a certain project.  We need to use authenticatedAsAddon (and not authenticatedAsHostActor) from the code because not all users will have permissions. The code is very simple:

String reportersJson = atlassianHostRestClients.authenticatedAsAddon()
                    .exchange("/rest/api/3/user/search/query/key?query=is reporter of " + projectKey, 
                HttpMethod.GET, new HttpEntity<>(new HttpHeaders()), String.class).getBody();

However, for some instances the code returns a 403 error (the REST is fine if we execute it in the browser from the current admin user):

class org.springframework.web.client.HttpClientErrorException$Forbidden - 403 Forbidden: [{"errorMessages":["Missing user picker permission"],"errors":{}}]

We can't find how to figure out what permissions have been changed in order to get this error. We have a user created for our app but we can't seem to find where to see its permissions as it is of type "app" and does not appear in the Users section. Or maybe it is related to the global permissions of Jira.

Does anyone know how to fix this on these instances? All kinds of help are greatly appreciated.

Thanks,
Georgi

Clemente · Answer

Great Atlassian support :)

dberrutti · Answer

Having the same error, need urgent response.

The addon has the above scope authorized by atlassian. The unauthorized exception gets in some environments only

ACCESS_EMAIL_ADDRESSES

The code is:

restClient.authenticatedAsAddon()
        .getForEntity("/rest/api/3/user/email?accountId=" + userAccountId, Object.class)

Ulysse Mizrahi_39f73e · Answer

We are having the same issue, except with Confluence on one of our customers accounts (trying to access /rest/api/group) - works fine on our own dev/prod atlassian sites.