I'm trying to access user permissions for project through Jira python module

[Rajinish_Gaddam]

Hi, I have tried to get permission for a project for a user, but I was getting below error. Thanks in advance

from jira import JIRA

ORGANISATION = "https://domain.atlassian.net"

jira = JIRA(basic_auth=('xxxxxx@gmail.com', 'xxxxxxx'), options={'server': ORGANISATION})

f = jira.my_permissions(projectId="10001")



{
"errorMessages": [
"The 'permissions' query parameter is required."
],
"errors": {}
} 

[Earl McCutcheon · Accepted solution]

Hello @Rajinish_Gaddam ,

First looking at the error you are getting "The 'permissions' query parameter is required." looks like it is related to an update to the API covered in this KB "Change notice - Get my permissions resource will require a permissions query parameter" there is a change in acquiring permissions and you can no longer get all permissions of the user but rather check if a user has a particular permission specified:

Starting 1 February 2019, we will require that you provide the permissions query parameter in all requests to the Get my permissions resource.

and I am not seeing an input for this update in the python module "my_permissions" referance here:

• https://jira.readthedocs.io/en/master/_modules/jira/client.html#JIRA.my_permissions

So it looks like this one is no longer valid in Jira python module after this change in Jira cloud.

I would recomend updating the command rather than using the "my_permisisons" value to pass in the params, but rather manually pass in the additional URL string including the permissions as covered in the API documentation with something similar to the exe:

• https://developer.atlassian.com/cloud/jira/platform/rest/v3/?utm_source=%2Fcloud%2Fjira%2Fplatform%2Frest%2F&utm_medium=302#api-rest-api-3-mypermissions-get

curl --request GET \
  --url '/rest/api/3/mypermissions?permissions=BROWSE_PROJECTS%2CEDIT_ISSUES' \
  --user 'email@example.com:' \
  --header 'Accept: application/json'

Regards,
Earl

[Rajinish_Gaddam]

thanks @Earl McCutcheon  for informative response, but how will I get to know what permissions are applied on the user ?

[Earl McCutcheon]

Hi @Rajinish_Gaddam ,

So to check what permissions are avaliable to the mypermission fall under the keys returned by the get all permissions endpoint, covered in the API doc under the "Get my permissions" section here:

• https://developer.atlassian.com/cloud/jira/platform/rest/v3/?utm_source=%2Fcloud%2Fjira%2Fplatform%2Frest%2F&utm_medium=302#api-rest-api-3-mypermissions-get

permissions

string

A list of permission keys. This parameter accepts a comma-separated list. Omitting this parameter is deprecated. To get the list of available permissions, use Get all permissions. Note that deprecated keys cannot be used. Deprecated keys are not returned by Get all permissions but are returned by this operation if permissions is omitted.

If you wanted to check all permissions that a user has you would need to check avaliable permissions in the projects permission scheme covered here append each avaliable permission to the permission endpoint, and I would recomend looking into adapting the "Get permitted projects" into your script for this.

The updated to the behavior is in relation to app development, This will add additional context requirements for scenarios where you want to check the full permissions set on a user, but massively reduces the load to the server when running permissions checks for individual actions. 

When an external application is doing a permissions checks it should only be calling on the permissions required by the follow up actions it is attempting to do to see if the action can be completed, if the app is calling all permissions on every check this adds a lot of overhead as permission lookups can be expensive in terms of time, cpu, etc...

As an exe if all you needed to check was if a user has a global administrator permission, to complete an action your app could run a GET "/rest/api/3/mypermissions?permissions=ADMINISTER" to hit a single check, where if it were if the call is checking all permission possibilities you are looking at 39 permissions on a default install for the same action and cause 39 times the load on the server for the single call, and when apps are doing repeated calls for various permission checks for your various actions, this load can add up rather quickly.

Regards,
Earl

[Rajinish_Gaddam]

thank you @Earl McCutcheon you're wonderful this information is more helpful

[Eliot_Cole]

I was struggling to see from the responses here as to what options were available to the requester to place in the ?permissions= field.

Hopefully the link below can assist others in this when they arrive at this page:

https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-permission-schemes/#built-in-permissions

That is a list of all the values you could use there. Or to quote the guide as of time of posting this:

The built-in Jira permissions are listed below. Apps can also define custom permissions. See the project permission and global permission module documentation for more information.

I will list them below, also.

Project permissions

• ADMINISTER_PROJECTS
• BROWSE_PROJECTS
• MANAGE_SPRINTS_PERMISSION (Jira Software only)
• SERVICEDESK_AGENT (Jira Service Desk only)
• VIEW_DEV_TOOLS (Jira Software only)
• VIEW_READONLY_WORKFLOW

Issue permissions

• ASSIGNABLE_USER
• ASSIGN_ISSUES
• CLOSE_ISSUES
• CREATE_ISSUES
• DELETE_ISSUES
• EDIT_ISSUES
• LINK_ISSUES
• MODIFY_REPORTER
• MOVE_ISSUES
• RESOLVE_ISSUES
• SCHEDULE_ISSUES
• SET_ISSUE_SECURITY
• TRANSITION_ISSUES

Voters and watchers permissions

• MANAGE_WATCHERS
• VIEW_VOTERS_AND_WATCHERS

Comments permissions

• ADD_COMMENTS
• DELETE_ALL_COMMENTS
• DELETE_OWN_COMMENTS
• EDIT_ALL_COMMENTS
• EDIT_OWN_COMMENTS

Attachments permissions

• CREATE_ATTACHMENTS
• DELETE_ALL_ATTACHMENTS
• DELETE_OWN_ATTACHMENTS

Time tracking permissions

• DELETE_ALL_WORKLOGS
• DELETE_OWN_WORKLOGS
• EDIT_ALL_WORKLOGS
• EDIT_OWN_WORKLOGS
• WORK_ON_ISSUES