How to i disable REST API calls on JIRA?

[Rahul Aich [Nagra]]

I have someone run a script which makes calls to REAT API every few minutes and for some reason that script fails and throws errors in my logs.

How do i disable any calls made to REST API?

Rahul

[BenjiI · Accepted solution]

Goto Administration > System > General Configuration. Then click the Edit settings button and turn Accept remote API calls off.

[carrhuntc]

Please update - there is no Accept remote API calls option in General Config Edit for the Server Edition

[BenjiI]

This similar thread might help: https://answers.atlassian.com/questions/177821/how-to-stop-jira-making-rest-api-calls

[Laurent PIANFETTI]

Hello.

In Jira 7.3.2, the settings "Accept remote API calls" is no more available ? Someone knows how to restore this feature ?

Thanks in advance.

[Nic Brough -Adaptavist-]

It was removed late in 6.something if my memory serves.

This is because Jira now uses its own REST interface to fetch some of its own data.  Turning it off will stop a good chunk of Jira from working.

So, you can't disable it any more.

[Owen Blacker]

Presumably there's a way to require authentication on these APIs, though? I can see private information on publicly accessible API endpoints.

[Nic Brough -Adaptavist-]

All the REST calls require authentication.

If you're seeing "private" information, it is available becuase it has been made public

[Nic Brough -Adaptavist-]

If you can see "private information" over the REST API, then you have configured your system such that it is NOT private.

The REST API respects the security you set up in the application.  If you want to secure your data, then disable access to it with your permission schemes.

[Owen Blacker]

Yes, this is precisely the case. But it would be very useful for there to be a setting to suppress all publicly-shared content, so that administrators could override settings to ensure all content were only available at a maximum to authenticated users within the instance.

That seems relatively easy to for user lists. But it is considerably more onerous to unshare boards and filters that have been inadvertently made public.

[Nic Brough -Adaptavist-]

But there's a load of publically shared information Jira needs in order to function now.  So you can't turn it off.