Restriction API access

yassine delil

Hello,

For security reasons, we want to restrict API access. Is there an alternative method other then using "authentication API token" in Jira?
Our goal is to block API access for all users except for generic service accounts. Are there other methods available to enforce secure API access?

Best regards,

Jim Knepley - ReleaseTEAM

You can disable Personal Access Tokens by setting the system property "-Datlassian.pats.enabled" to false, but...

The REST API will also accept session cookies for authenticated users, and the Jira web application makes those calls as part of normal operation.

This feels like you'll need to put some sort of API firewall in the mix if you want more granular filtering without breaking the experience for users.