Environment: Jira Cloud I’ve found a hidden group named “system-administrators.” It does not appear in User management → Groups and is only returned by GET /rest/api/3/group/bulk. What happens * I can add a user with POST /rest/api/3/group/user (using the group name or groupId). * I cannot remove the user with DELETE /rest/api/3/group/user (using the same groupId and accountId). This is the errorMessage:"An error occurred: com.atlassian.idp.client.exceptions.BadRequestException: {\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:Error\"],\"status\":\"400\",\"detail\":\"Group not modifiable\",\"errorType\":\"InvalidSchema\",\"message\":\"Group not modifiable\"}" * The group is not searchable or manageable in the admin UI. How can I remove a user from this "system-administrators" group ? Currently when I add any user to this group, they can not be removed from this group unless I remove them totally from my environment

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How can I remove a user from group "system-administrators"

Duy Anh Do

Environment: Jira Cloud

I’ve found a hidden group named “system-administrators.” It does not appear in User management → Groups and is only returned by GET /rest/api/3/group/bulk.

What happens

I can add a user with POST /rest/api/3/group/user (using the group name or groupId).
I cannot remove the user with DELETE /rest/api/3/group/user (using the same groupId and accountId). This is the errorMessage:
"An error occurred: com.atlassian.idp.client.exceptions.BadRequestException: {\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:Error\"],\"status\":\"400\",\"detail\":\"Group not modifiable\",\"errorType\":\"InvalidSchema\",\"message\":\"Group not modifiable\"}"
The group is not searchable or manageable in the admin UI.

How can I remove a user from this "system-administrators" group ? Currently when I add any user to this group, they can not be removed from this group unless I remove them totally from my environment

Accepted answers

James Gamble

Hola Duy Anh,

@Alexandre Pezzini’s suggestion for the Organization API is worth trying. The Jira group endpoint and the Atlassian organization directory endpoint are separate APIs, so the failure from /rest/api/3/group/user doesn’t necessarily mean the organization-level request will fail.

Use this endpoint with an organization API key and organization-admin access:

`DELETE https://api.atlassian.com/admin/v1/orgs/{orgId}/directory/groups/{groupId}/memberships/{accountId}`

Atlassian documents the request here.

There are two important limitations. If the membership is managed through SCIM, you’ll need to remove the user from the group in your identity provider. Also, Atlassian’s documentation doesn’t specifically confirm whether this endpoint can modify the hidden system-administrators group.

If the organization endpoint also returns Group not modifiable, I’d open an Atlassian Support case and include the group ID, account ID, the original POST request, the failed DELETE responses, and the approximate time the user was added. Since Jira allowed the membership to be added but provides no supported way to reverse it, Atlassian may need to remove it internally and investigate why the original request was accepted.

Until Atlassian confirms how this group is intended to work, I’d avoid adding anyone else to hidden groups returned through the API.

Thanks,

James

All comments

Alexandre Pezzini

The system-administrators group (and its variations like jira-system-administrators) is a protected system group. In Jira Cloud, certain groups are managed by the underlying Atlassian platform to ensure system stability and security.

1. Why you are seeing "Group not modifiable"

The error message "Group not modifiable" typically occurs because the group is considered a system-managed group. These groups often have restricted membership rules to prevent accidental lockout or unauthorized elevation of privileges.

In many cases, if a group is not visible in the standard Directory > Groups UI at admin.atlassian.com, it is because it is a legacy or internal system group that is not intended for manual modification via the standard Jira REST API (/rest/api/3/group/user).

2. How to Remove the User

Since the standard Jira API is returning a "not modifiable" error, you should try the Atlassian Administration (Organization) API instead. This API operates at a higher level than the Jira-specific API and is often required for managing protected groups.

The correct endpoint to try is:
DELETE /admin/v1/orgs/{orgId}/directory/groups/{groupId}/memberships/{accountId}

Steps to perform this:

Get your Org ID: You can find this in the URL when you are at admin.atlassian.com.
Use an Organization API Key: Note that this requires an Organization API Key (Bearer token), not a standard Jira API Token.
Execute the call:

<span data-ds--code--row="" data-testid="renderer-code-block-line-1">    curl --request DELETE \
</span><span data-ds--code--row="" data-testid="renderer-code-block-line-2">    --url '<a href="https://api.atlassian.com/admin/v1/orgs/%7BorgId%7D/directory/groups/%7BgroupId%7D/memberships/%7BaccountId" target="_blank" rel="nofollow noopener noreferrer">https://api.atlassian.com/admin/v1/orgs/{orgId}/directory/groups/{groupId}/memberships/{accountId</a>}' \
</span><span data-ds--code--row="" data-testid="renderer-code-block-line-3">    --header 'Authorization: Bearer <ORG_API_KEY>' \
</span><span data-ds--code--row="" data-testid="renderer-code-block-line-4">    --header 'Accept: application/json'</span>

3. Important Considerations

Managed Accounts: If the user is a "Managed User" (synced via SCIM/Azure AD/Okta), you may need to remove them from the group in your Identity Provider rather than in Jira.
Site Admin vs. Org Admin: Ensure you are performing these actions with Organization Admin privileges. Site-level administrators often lack the permissions to modify system-protected groups.
Hidden Groups: As a best practice, we recommend avoiding adding users to "hidden" groups found via the API, as these groups may be part of legacy configurations or internal Atlassian service accounts that can cause unexpected behavior if modified.

Verified Documentation

The Organizations REST API REST API
Managing global permissions | Administering Jira applications Data Center 11.3 | Atlassian Documentation (Note: While this is a Server/DC doc, it explains the protected nature of the System Admin permission).

I hope this helps you resolve the issue with the stuck user membership!

James Gamble

Hola Duy Anh,

Use this endpoint with an organization API key and organization-admin access:

`DELETE https://api.atlassian.com/admin/v1/orgs/{orgId}/directory/groups/{groupId}/memberships/{accountId}`

Atlassian documents the request here.

Until Atlassian confirms how this group is intended to work, I’d avoid adding anyone else to hidden groups returned through the API.

Thanks,

James

Duy Anh Do

Thanks @Alexandre Pezzini and @James Gamble for your help and detailed instructions

I tested this API:
DELETE
`/admin/v1/orgs/{orgId}/directory/groups/{groupId}/memberships/{accountId}`

I also tried this one:
DELETE `/v2/orgs/{orgId}/directories/{directoryId}/groups/{groupId}/memberships/{accountId}`
(Ref: https://developer.atlassian.com/cloud/admin/organization/rest/api-group-groups/#api-v2-orgs-orgid-directories-directoryid-groups-groupid-memberships-accountid-delete)

I tested with other groups and they can be deleted. However, for the “system-administrators” group I got this error:

{
"errors": [
{
"id": "722d8b0f-e6de-47d2-b3a1-325d2dbc6fc9",
"code": "ADMIN-UAM-400-11",
"status": "400",
"title": "Group cannot be modified",
"detail": "These groups are not modifiable"
}
]
}

I believe this is due to the permissions concept you mentioned from Atlassian.

My target is to find an API I can use in a Forge app to search groups and assign a specific user to a group. But all available Jira group search APIs return the “system-administrators” group, which is not safe to assign.

Is there any other API or best practice that can help us fetch only assignable groups for a specific user? I would sincerely appreciate any guidance. Thank you very much.

James Gamble

Hola Duy Anh,

I don’t see a documented Jira API that returns only groups that are safe for membership changes. The Jira group search endpoints return discoverable groups, but as you found, that can include protected groups such as system-administrators.

The safer option is to use the Organization API’s group search and filter the results using the returned metadata. In particular, exclude groups where managementAccess.modifiable is false. You may also want to exclude groups where externalSynced is true if membership should only be managed through your identity provider.

Atlassian documents the organization group searches endpoint here.

For the Forge app itself, I’d still use an administrator-maintained allowlist of approved group IDs rather than presenting every modifiable group. That protects against accidentally exposing privileged groups that are technically modifiable but shouldn’t be available through your app.

The Jira endpoint used to add the user still requires site-administration permission.

So the practical approach would be to search through the Organization API, reject non-modifiable and externally synchronized groups, then limit the remaining choices to an admin-approved allowlist before calling the Jira membership endpoint.

Thanks,

James

Anastasiia Dimnych

Hi @Duy Anh Do,

Sorry you’re still facing this issue. I created a support ticket for you - JST-1334103. Check your email for further updates.

Best regards,

Anastasiia

Duy Anh Do

Thanks a lot, James. I appreciate your help.

Thanks, Anastasiia. I’ve seen the support ticket.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

jira-cloud