API Token Not Matching User Permission

Huan Ting Chen

Just wondering if API token is an admin access token. I've done the following tests using Postman and they seemed to be dangerous.

- Any Atlassian user can generate an API token even if a particular Jira site access is deactivated.

- API token can be used without a user (email) specified.

- API token can be used to access any API even a user doesn't have permission. Got 401 when I just pasted a URL in browser when logged on.

- API token is still valid after a particular Jira site access is deactivated.

Any idea?

unknown

Hi Huan,

When a user generates an API token at https://id.atlassian.com, any API calls made using that token will be treated as coming from that specific user. In other words, any script configured with that API token will run with the same permissions that the user has.

If the script attempts to perform an operation that the user does not have permission to perform, Jira returns a 401 error code (Unauthorized). This is expected behavior since this HTTP status describes the situation best.

If site access is disabled for a user any script / API calls running with an API token generated by that user will return a 401

The fact that a user can generate an API token even if site access has been disabled is related to the fact that a user can have access to multiple Jira sites and can use the same API token to send API calls to either of them.