Jira Service Account - accessing Custom Fields - /rest/api/3/field

Question

Hello, I'm using the API call with a service account: https://api.atlassian.com/ex/jira//rest/api/3/field When accessed through Service Account token, it returns 55 fields (5.82KB JSON response), I didn't check them all, but seems these are the system fields. The same API, with my personal token: https://.atlassian.net/rest/api/3/field When accessed through my personal account, it returns all the fields (132.80KB JSON response). The Service Account token has the following scopes: read:jira-work, read:field:jira, read:avatar:jira, read:project-category:jira, read:project:jira, read:field-configuration:jira, read:issue-meta:jira, read:issue-security-level:jira, read:issue.vote:jira, read:issue.changelog:jira, read:issue:jira, read:issue:jira-software, read:status:jira, read:user:jira, read:board-scope:jira-software, read:board-scope.admin:jira-software, read:build-info:jira, read:build:jira-software, read:field.default-value:jira, read:field.option:jira, write:issue:jira, write:jira-work, read:issue-details:jira, read:issue-event:jira, read:issue-field-values:jira, read:issue-link-type:jira, read:issue-link:jira I also gave Admin rights on the space. I can't see what is missing. Thank you

Trevan Householder_Isos-Tech-Consulting_ · Answer

Hi @Paul Marachlian, your scopes are fine. @Arkadiusz Wroblewski and  @Matthew Sinclair nailed it : /rest/api/3/field only returns custom fields used in spaces where the caller has Browse projects. Space admin doesn't include Browse, and as @Martin Runge said, your own account probably browses everything.

So I'd grant Browse projects to the service account (ideally via a group or role) in the permission scheme of each space whose fields you need, then confirm with GET /rest/api/3/mypermissions?projectKey=KEY&permissions=BROWSE_PROJECTS using its token.

If you only need the field catalogue, GET /rest/api/3/field/search?type=custom is worth a try too. It's paginated, documents only "access Jira" as the requirement, and covers company-managed spaces.

Matthew Sinclair · Answer

Slight adjustment/Clarification -

Org-Admins can't access Jira controls without the Jira App Admin role - Likewise Jira App Admins can't see Spaces without browse permissions. Just space settings. Even Space Admins need Browse permission to see tickets - and that's assuming the Screens provide View/Edit permissions.

Atlassian's structure is set up intentionally this way that no one role auto-grants access to "all the things" unless you set it up that way (risky).

Easiest test to perform is JQL up a test on a given space under said account.

If you get results - you have browse permission.

Martin Runge · Answer

Hi,

I agree with @Mohamed Benziane, @Arkadiusz Wroblewski & @Matthew Sinclair.

I would first compare apples with apples. Your personal account is likely a Jira admin, so it sees every field on the site. The service account only sees fields from spaces it can browse and he is a space admin.

Cheer, Martin