Hi,
We are working with Jira Cloud API tokens that use scopes (both Classic and Granular), and we would like to clarify whether there is any way to introspect the permissions of the token itself, rather than the permissions of the underlying user.
Specifically, is there any REST API endpoint or supported mechanism that allows us to:
Retrieve the list of scopes granted to the current API token, or
Determine which REST API capabilities are allowed based on the token’s scopes, independently of the user’s project roles, groups, or permission schemes?
At the moment, it appears that:
Endpoints like /mypermissions only reflect the user’s Jira permissions, not the token’s scopes.
There is no obvious endpoint similar to OAuth introspection that returns the token’s granted scopes.
The only practical way to verify scope-related access is by probing endpoints and observing 401 “scope does not match” responses.
We would like to confirm whether this understanding is correct, or if there is an official or recommended way to inspect or validate API token scopes directly.
Thanks in advance for the clarification.
Best regards,
Sagi Karach
