Need to create an account for API (our internal) to API (JIRA REST 3).

[Jim Gruszczynski]

Our company has some internal web pages used by our development QA department to update our issues in JIRA, used for development tasks and bug tracking.  The development on this is complete, with on recent snag that I will elaborate later.  For the development the developer used their personnel JIRA account, which is now problematic for the commenting we have.  So we need to create an account that will have access to add comments to all issues and transition all issues.  Just looking for some pointers so we do not have any issues in the future.  It is our belief because we are not publishing an app, API to API communication, that this is not the avenue to pursue.

As for the recent snag, within the last month the transitioning of status has stopped working with this error: 

{

   "errorMessages": ["Issue does not exist or you do not have permission to see it."],

   "errors":{}

}

The developer can transition the issue from the JIRA site (the issue exists, and the credentials do work to transition, just not from the API), but the credentials have stopped working for the API, all other functions still works.  We would like the above account to have security enough to not have any issues like this.

Thanks in advance.

[Daniel Eads]

Hi Jim,

If you're onboard with the changes happening as a specific user (you might call it a "service account"), you could create a new user on the site registered to a department-owned email address and have that user account do the work. I'd recommend using a name for the user to make it very clear that it's not a person when looking through activity logs - e.g. "QA Bot". Once the account is created with an email address you have control of, you'll create an API token from the service account.

Details about how to use API tokens with Atlassian Cloud are listed here. In short, you generate a new token from id.atlassian.com and use that in place of a password. The advantage to this is that you can have multiple tokens on the account (one per application/script would be a good way to set them up) and they can be easily revoked!

I would recommend trying your scripts/pages again with the new account and API token, then troubleshooting permissions in Jira if you still run into trouble at that point. The permissions each user can have may vary per project. Adding the service account as a project administrator is likely to grant it the appropriate permissions in those projects, but double-checking that the permission scheme in those projects does actually grant permissions to the project administrator role would be a good idea. There isn't necessarily a single permission grant across all of Jira that will allow an account to transition issues, if someone has tweaked project permissions individually and removed rights from the project administrator role. It's within the realm of possibility that the developer's account has permissions to transition issues in one project that they tried in the browser but not another that the scripts are trying to update via API.

Cheers,
Daniel