Reaching the /admin/rest/um/1/user/ endpoint after session authentication is depreciated

Question

With the upcoming depreciation of session based authentication, how does one recommend making a rest call to the /admin/rest/um/1/user/ endpoint to retrieve user information? Specifically, I am looking to get the productPresenceList   response  of a user query programatically to keep track of last activity dates.

Joe Sapinoso · Answer

Hi @Daniel Eads , is there yet a timeline for us being able to retrieve this information from a public endpoint yet? It is becoming increasingly difficult to manage our users as our organization grows, so having this available would really help us out.

Thank you.

Daniel Eads · Answer

Hey Perry,

I've just been in touch with the Atlassian ID development team. They've re-iterated that the endpoint is not a public API.

They also said that you could continue using it if you generate session tokens manually and respect any updates to them via Set-Cookie headers (although programatic acquisition of session tokens is being phased out). That's not to say it couldn't get pulled out from under you in the future though.

You could raise a feature request on jira.atlassian.com for a public endpoint for this. For more information about how Atlassian prioritizes feature requests made on jira.atlassian.com, check out this Community post.

As another semi-option, you could also grab details from the User Export. Still not as nice as a public endpoint, but it's something.

Perry Ravet · Answer

Daniel, Thank you for your reply. To give more clarity, this endpoint is the same one that Jira User Management page is calling to gather its data in the web browser via the UI. I am simply trying to recreate its actions via rest call. Ex: Going to the https:/admin/users/ via administration panel will call : * Request URL: https:///admin/rest/um/1/user/search?max-results=30 * Request Method: GET * Status Code: 200 I am simply recreating that call via rest client. In the past, this call required a session token created to work, and that is what was used. I just want to be proactive in that a bulk of automation will go down due to not having a proper replacement for these endpoints.