Heartbeat ping through integration API

Question

Hello

On opsgenie, we could ping a heartbeat with "Authorization: geniekey: xxx".

With JSM, we need  a basic auth with a token having "write:ops-config:jira-service-management" scope.

Do you have a solution to ping heartbeat without write scope (or with integration API key) ?

Regards

Arkadiusz Wroblewski · Answer

Hello @Yannick Martin

In JSM Operations, the current Heartbeat API uses the Atlassian API gateway via /jsm/ops/api/{cloudId}/v1/teams/{teamId}/heartbeats/ping?name=....

Authentication requires Atlassian account with an API token and read:ops-config:jira-service-management and write:ops-config:jira-service-management scopes.

There is actually an open Atlassian suggestion for exactly this:

[JSDCLOUD-18241] Allow Operations Heartbeat to be pinged via GenieKey Authentication - Create and track feature requests for Atlassian products.

Best,

Arek🤠

Gabriela - LeanZero · Answer

No read-only path, I'm afraid. The ping endpoint itself lists both, "read:ops-config:jira-service-management" and "write:ops-config:jira-service-management", so the write scope isn't something you can configure around. It's what the operation is documented to need.

The thing I'd give more attention to is what that same endpoint says about its own response, because it changes how you verify whatever you end up building: "Pings the heartbeat with given name. Heartbeat ping requests processed asynchronously, it does not check if the heartbeat exists or not before responding. Please note that receiving a PONG response does not necessarily mean that the heartbeat exists."

Read that one twice.

A typo in the name parameter still comes back 202 with "PONG - Heartbeat received", your cron records a success, and nothing on the Jira side is being touched, so the monitoring goes green precisely because it isn't doing anything. That's a worse failure than a 403, since a 403 tells you immediately.

Which means the check belongs on the heartbeat, not on the ping. A new one sits at Pending until a signal actually arrives, and moves to Responsive once they're landing at the interval you configured. If your script is logging 202s while the heartbeat still reads Pending, the name doesn't match, and the response code wouldn't have told you.