OAuth 3LO Access Token Returns 401 "Unauthorized; scope does not match" for Jira Software APIs

Hemadri_d51x3n

 

I am unable to access Jira Software APIs using OAuth 3LO despite having what appear to be the correct scopes. The token works for platform APIs but fails for all Jira Software endpoints.

Environment:
- Jira Cloud Instance: [REDACTED]
- Authentication Method: OAuth 3LO (Authorization Code Flow)
- OAuth App Client ID: [REDACTED]

Current OAuth Scopes Granted:
- read:jira-work
- read:board-scope:jira-software
- read:board-scope.admin:jira-software
- read:sprint:jira-software
- read:jira-user
- write:jira-work
- manage:jira-webhook
- offline_access

API Test Results:

WORKING APIs:
- GET /oauth/token/accessible-resources → 200 OK
- GET /rest/api/3/myself → 200 OK

FAILING APIs:
- GET /rest/agile/1.0/board → 401 "Unauthorized; scope does not match"
- GET /rest/agile/1.0/project → 401 "Unauthorized; scope does not match"

GET https://api.atlassian.com/ex/jira/{cloudId}/rest/agile/1.0/board
Authorization: Bearer [valid_oauth_token]
Accept: application/json

 

Actual Behavior:
All Jira Software APIs return 401 "Unauthorized; scope does not match" while platform APIs work correctly with the same token.

Request:
Please clarify the correct OAuth scopes needed for Jira Software APIs and confirm if there are additional requirements beyond scopes (such as product licensing or user permissions).

Anandhi Arumugam _Cprime_

Hi @Hemadri Welcome to the community!

Could you check if you have Product access to Jira software? If yes, please check the board settings to ensure that the board is accessible via UI?