nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to restrict who can call an API Atlassian Service?

Claudia Ramirez_50q08y

Hello all,

I would like information on how to restrict who can call an API in Jira Cloud. The main issue is the we want only developers can make API calls. My understanding is that users that have permissions to do something through the UI, like create an issue, they have permissions to do that via an API call. What we want to prevent is a no-developer who have the ability to create an issue in the UI from being able to invoke that call through the API.

Any advice on this will be greatly appreciated.

Best Regards

Claudia

Accepted answers

Nic Brough -Adaptavist-

There's no way to do this.

Why would you want to? What's wrong with letting people create issues when they have the permission to?

All comments

Nic Brough -Adaptavist-

There's no way to do this.

Why would you want to? What's wrong with letting people create issues when they have the permission to?

Claudia Ramirez_50q08y

Thank very much you for your answer @Nic Brough -Adaptavist-

It is a control that the organization's security is asking us to have. They want to prevent non-developers from invoking API calls; they can create an issue via the UI, but they would not be able to invoke the API call in any other way. At the Basic authorization for REST APIs: simple scripts and manual calls; can it be as simple as not sharing an API token and managing the API tokens granted?

Thank you!

Nic Brough -Adaptavist-

I'd question what your security team is saying - what is the logic behind blocking the access? What security problem would it solve? Given that the users can do anything in the UI already, it's not going to plug any security holes.

There's still no reason to block your users using the API. They're using it for some of the activities in Jira (the UI makes REST calls to itself in quite a lot of places)

Yes, you could "not share an API token", but you won't be able to stop people creating theim.

Claudia Ramirez_50q08y

Thank you very much for your response @Nic Brough -Adaptavist-!

It also has to do with some performance situations, as some users can make scripts that can produce performance issues.

One question, Nic, on Jira Data Center you can administer personal access tokens as an admin, and revoke those tokens if it is needed. Do you know if on Jira Cloud you have this feature?

Thank you very much

Claudia

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

rest-api

jira-cloud