Access Issue

Question

We are able to create customers manually in Jira CSM. However, when creating a customer through the Jira CSM API from Postman or MuleSoft, we are receiving the following error:

403 Forbidden – "User does not have permission to create customer accounts."

How do I  check whether the OAuth/integration user has the required permissions to create customer accounts through the API?

It appears the user may require the Administer Jira global permission, or the OAuth application may need to be authorized using an account that already has the required permission.

Could you please verify and let us know?

Sami Shaik · Answer

@Testing the error text tells you which endpoint you are hitting, and it is not the one @Andrea Robbins assumed (her notes are correct for request creation, which has its own rules). “User does not have permission to create customer accounts” is the 403 from POST /jsm/csm/cloudid/{cloudId}/api/v1/customer (Create customer account), and the reference for that operation says exactly what it needs: * Permissions required: Administer Jira global permission. Not a project role, not agent access. The identity making the call must be a Jira admin on that site. * OAuth 2.0 scope: write:customer:jira-service-management. If you are also calling Create customer profile (the one that sets detail fields and links organizations and products), that needs write:customer.profile:jira-service-management plus “Customer Service Management or Jira Service Management user”, so the account also needs a CSM or JSM licence. Your two guesses are both right, and they combine. With OAuth 2.0 (3LO), the call runs as the user who authorised the app, so the app can hold the scope and still get 403 if that person is not a Jira admin. The checks, in order: * Who authorised the app? Have a Jira administrator run the authorisation flow once and use the tokens from that grant. A grant made by a licensed agent carries the agent’s permissions, which is where “we can create customers in the UI” (an agent action in CSM) and “the API says no” (an admin-only endpoint) stop matching. * Is the scope on the app? In the developer console, the app’s Permissions must include the Customer Service Management API with write:customer:jira-service-management; a scope added after the grant needs a fresh authorisation. * Confirm the permission directly. Atlassian Administration > the site > Jira > Global permissions: the authorising account (or a group it is in) must hold Administer Jira. For a quick test from Postman, call the same endpoint with Basic auth (email plus API token) as that admin; the reference allows Basic for scripts. If it works there and fails under OAuth, the grant is the problem, not the account. * For MuleSoft, the same rule holds for whichever connector identity it uses: a service account that is a Jira admin and holds a licence if you also create profiles. Note that Connect apps are not supported on the CSM APIs at all, so if your integration layer wraps a Connect app, that is a separate wall. Reference, read today: Customer Service Management REST API, Customer group and the API introduction (authentication and roles).

Andrea Robbins · Answer

Hello!

Assuming this endpoint is being used:

https://api.atlassian.com/jsm/csm/cloudid/{cloudId}/api/v1/request/form/external

As documented here:

https://developer.atlassian.com/cloud/customer-service-management/rest/v1/api-group-csm-request/#api-api-v1-request-form-external-post

It mentions the following is needed:

Authentication: This endpoint supports all authentication types including OAuth 2.0 (2LO), API token, and session authentication. Note that scopes only apply to OAuth and API token authentication.

Reporter Email Behavior:

When using 2LO authentication without specifying an email, the request is created on behalf of the caller.

When using 2LO authentication with an email, the specified user becomes the reporter.

For API token and session authentication, only agents can specify a reporter email. Non-agents will receive a 403 Forbidden error if they attempt to set this field.

Metadata: You can optionally include a metadata object to provide additional context about the request. The metadata object must only contain primitive values (string, int and boolean). Nested objects or arrays are not supported and will result in a 400 Bad Request error.

Permissions required:

OAuth authentication: write:csm-request:jira-service-management scope

API token authentication: write:csm-request:jira-service-management scope

Session authentication: Authenticated user

To set reporter email (non-2LO): Jira Service Management agent

OAuth 2.0 scopes required:write:csm-request:jira-service-management