Service Account cannot browse projects despite being in administrators group and having correct API

Francesca Fuentes

Problem:

Our Service Account cannot access any Jira projects despite:

• Being a member of the administrators group
• Having correct API token scopes (read:project:jira, read:jira-user....)
• API endpoints returning HTTP 200 (scopes are working)
• All project access attempts returning HTTP 404 (permission issue, not scope issue)
  

Current Group Memberships:

• administrators
• jira-software-users
• and an internal one

API Token Scopes (Active):

• read:project:jira (confirmed working - endpoint /rest/api/3/project returns HTTP 200)
• read:jira-user (confirmed working - current_user() works)
• Multiple other read/write scopes

Error Evidence:

• jira.projects() returns 0 projects (empty list)
• Direct API calls to /rest/api/2/project/{PROJECT_KEY} return HTTP 404
• Direct API calls to /rest/api/3/project/{PROJECT_KEY} return HTTP 404
• JQL searches work but return 0 issues (can use endpoint, cannot see resources)
• Projects tested: BIZ, PRODISSUES, PM, TAGGING, NEWSLETTERS (all return 404)

Important Distinction:

• HTTP 401 would indicate scope issues → We get HTTP 200 for scope endpoints
• HTTP 404 indicates permission issues → We get HTTP 404 for project access
• This confirms scopes are correct, but project-level permissions are missing

 

So, if we get HTTP 404 instead of HTTP 401, which indicates that the problem is not one of scope but of permissions at the project level, a scope issue, but rather a permission issue at the project level. In addition, jira.projects() returns an empty list, and  although we can execute JQL searches, we cannot find any issues because we do not have access to the projects. Our next question is:

• Why can't the  Service Account cannot accessprojectsdespite being in the group administrators?
• Is there a difference in how Jira handles permissions for Service Accounts compared to regular users?
• Do we need to configure anything additional in the Permission Schemes for each project, or should we add the Service Account directly to the Project Roles in the Permission Schemes?
• Service Account directly to the Project Roles instead of configuring it only in the group membership?
• What is the recommended way to grant access to projects to a Service Account that needs to work with multiple projects?

---

Thanks in advance.
Francesca Fuentes. 

Mikael Sandberg

You should submit a ticket to Atlassian Support, I ran into the same issue on the Confluence side. the API token works correctly if used in Postman, but via automation it returns a 401 error. This worked as of last Friday, so something has changed in Automations since then.