Jira Webhook Worklog Event Email

[jiraIntegration101]

Hi, I've registrated webhook and I got worklog_created event.

 That's part of json i've got from jira. 

Why is "?" written in emailAdress field instead of normal email ? 

[Dario B · Accepted solution]

Hi @jiraIntegration101 ,

Throughout 2018 and 2019, Atlassian implemented (and it is still implementing) a number of changes to our products and APIs in order to improve user privacy in accordance with the European General Data Protection Regulation (GDPR).

Due to these changes, some user properties like the username have been removed and some others, like the email address will only be returned depending on what is configured in the Profile Visibility Settings for the user.

Being the webhooks outgoing HTTP POST request non authenticated, according to below schema, it should only be returned if set 'public' in the Profile Visibility Settings:

• anything set to public will always be visible regardless of the type or caller or the authentication method

• anything set to the user's organisation will be visible to:

  • users in the ui

  • users doing REST calls authenticating as themselves

  • it won't be visible to connect apps*

  • it won't be visible in Webhooks

• anything set to "only me and admins" will be visible to:

  • the user when they request themselves (apart from in connect apps)

  • in the user management ui (admin.atlassian.com) it will be visible to admins in the user list (but nowhere else)

  • if its a managed account it might also be accessible to admins through the Identity user managment API

• customer accounts email will be visibile:

  • to agents in the UI on profile cards

  • to agents in places using user search apis inside Jira (there is no clearcut rule for which places it is), including the user search rest api, but not the user lookup api

  • It should be visible to all agents everywhere (apart from connect apps)

*connect apps can apply through ecosystem to use some special api endpoints to get email regardless of privacy settings. This has to be approved by legal and is only for apps in specific use cases (e.g. scriptrunner would not be eligible because its too general)

---

For more information you can review the below pages:

• Major changes to Jira Cloud REST APIs are coming to improve user privacy
• Deprecation notice and migration guide for major changes to Jira Cloud REST APIs to improve user privacy
• Major changes to Atlassian Connect APIs are coming to improve user privacy

I hope this explains.

Cheers,
Dario

[Dario B]

Also, in order to provide some more context (from the other thread on the same topic):

• Guidelines for Testing Profile Visibility Controls
• Guidelines for requesting access to email address

[jiraIntegration101]

@Dario B Got it. Thank for quick answer :)

[Dario B]

You are very welcome @jiraIntegration101 :) 

Happy to know the answer helped