Jira api get all boards returns 403 forbidden

[Tõnu Roosi]

Hi, I have a node js site that uses Oauth 2 to authenticate with Jira.
Followed this documentation. https://developer.atlassian.com/cloud/jira/platform/oauth-2-authorization-code-grants-3lo-for-apps/

Authentication part seems to work fine. I get the authToken and cloudId and
when I make a request to get all projects or an issue with id, then every thing works fine.
But when I try to get all issues or boards then I get the "403 Forbidden" error.

Request headers
method: "GET",
headers: {
  'Authorization': 'Bearer {access_token}' ,
  'Accept': 'application/json'
}

Request url
https://api.atlassian.com/ex/jira/{cloud_id}/rest/api/3/issue/{id} - returns issue
https://api.atlassian.com/ex/jira/{cloud_id}/rest/api/3/project- returns all projects

https://api.atlassian.com/ex/jira/{cloud_id}/rest/api/3/issue - returns 403
https://api.atlassian.com/ex/jira/{cloud_id}/rest/api/3/board- returns 403

So what am I missing here, why cant i get boards and issues?

[Dario B · Accepted solution]

Hi @Tõnu Roosi,

I cannot find anywhere documented that there is an endpoint to GET all the issues. The only documentation I have found for the endpoint /rest/api/3/issue is the below one and it is actually to create an issue using POST:

• https://developer.atlassian.com/cloud/jira/platform/rest/v3/#api-api-3-issue-post

Then, same as above, there is no rest/api/3/board endpoint. The one to get all boards is actually /rest/agile/1.0/board. Find the documentation below:

• https://developer.atlassian.com/cloud/jira/software/rest/#api-rest-agile-1-0-board-get

Cheers,
Dario

[Tõnu Roosi]

Hi Dario,

thank your for the replay.

I solved the issue problem using search.  /rest/api/3/search/?jql={search_params}
But I still have problem getting all the boards.
Unfortunately /rest/agile/1.0/board also returns the 403 error.

Regards,
Tõnu

[Dario B]

Can you make sure the user has Jira Software rights and access to at least one boad?

You can doble-check this by logging into the instance, e.g. https://something.atlassian.net, and then navigate to the same rest endpoint by pasting below url in your Internet browser address bar:

https://something.atlassian.net/rest/agile/1.0/board

[Tõnu Roosi]

Yes, user has Jira Software rights.
When I log into my Jira and navigate to the .../rest/agile/1.0/board then I get a list of boards as expected.

[Dario B]

Then something is going wrong when authenticating the request in the code. Can you try if this works with curl as well?

Also, do you get any error message together with the 403? 

[Tõnu Roosi]

Hi,
with curl it's the same.
curl -u user:pass https://something.atlassian.net/rest/agile/1.0/board returns all boards.

But
curl -H "Accept: application/json" -H "Authorization: Bearer {accessToken}" https://api.atlassian.com/ex/jira/{cloudId}/rest/agile/1.0/board returns "Forbidden 403"

No errors beside 403.

[Dario B]

Hi @Tõnu Roosi

If this is the case then you may want to either:

• Ask the developer community: https://community.developer.atlassian.com/
• Get assistance by opening a request in https://ecosystem.atlassian.net/servicedesk/customer/portal/14

[Tõnu Roosi]

Hi,

Thanks for the advice.
I'll ask around in dev community.

Regards,
Tõnu

[Jason Immerman]

@Dario B @Tõnu Roosi - Calls using 3LO (OAuth2) against the rest/agile APIs (Jira Software, and not Jira Platform) are not yet supported. This took me a bit to figure out, so I wanted to post it here for clarity. It is on the Atlassian roadmap (they in fact released Confluence support for 3LO auth only a few months ago)

[Dario B]

Hi @Jason Immerman , 

I can see that indeed the documentation for Jira Sofware  says this is not supported:

• https://developer.atlassian.com/cloud/jira/software/oauth-2-authorization-code-grants-3lo-for-apps/

While we have this documented for Jira Core  and Jira Service Desk:

• https://developer.atlassian.com/cloud/jira/platform/oauth-2-authorization-code-grants-3lo-for-apps/
  
• https://developer.atlassian.com/cloud/jira/service-desk/oauth-2-authorization-code-grants-3lo-for-apps/

But at the same time, there is below page explaining how to use Oauth2 to integrate with Jira Software:

• https://developer.atlassian.com/cloud/jira/software/integrate-jsw-cloud-with-onpremises-tools/
  

  Jira Software Cloud provides OAuth 2.0 credentials that you can use to integrate Jira Software Cloud with on-premises (self-hosted) tools. Currently, you can integrate with build and deployment tools, such as Jenkins, and it also supports development information from tools like repository managers.

  This page provides instructions on implementing OAuth 2.0 authorization and calling the builds API, deployments API and development information API.
  [...]

I am getting in touch with DEV to get some clarity on this. I will try to update below public issues as soon as I have more details.

• [ACJIRA-1588] Allow apps using OAuth2 Authorization Code Grant (3LO) to be distributed to all users
• [JRACLOUD-43171] Oauth2 Support

Please set yourself as a watcher to them so that you will be notified 

Cheers,
Dario

[Jason Immerman]

Got it, thanks for the comprehensive reply @Dario B - I am watching those issues and look forward to learning more!

[Dario B]

You are very welcome @Jason Immerman ! :)

After reviewing everything I strongly believe the answer is already in the quoted text of my previous answer:

This page provides instructions on implementing OAuth 2.0 authorization and calling the builds API, deployments API and development information API.

The above APIs are only a subset of the ones available for JSW Cloud (below):

Backlog

Board

Epic

Issue

Sprint

Development Information

Feature Flags

Deployments

Builds

Other operations

Therefore, I assume this is still under development and slowly the other endpoints will be added. 

However, this is the idea I got by reviewing the documentation. I have already asked the team working on this to clarify. I should get an answer in the next days.

Cheers,
Dario

[Dario B]

Hello @Jason Immerman ,

I got confirmation that Oauth2 is indeed supported only for a subset of the endpoints available for Jira Software Cloud. For this reason I have opened the below feature request:

• [JSWCLOUD-18874] OAuth 2.0 for all the JSW REST API endpoints 

You may want to vote and watch the above feature request so that you will get notified in case of any update. The  feature will be addressed according to the Implementation of New Features Policy.

Cheers,
Dario

[Jason Immerman]

Thanks @Dario B! Definitely makes my life easier to watch a single ticket. I really appreciate your help.

[Yatish Madhav]

Thank you for this thread and the issue you have created to watch - I am trying to use our private connect app to make REST API calls using JWT. It seems to be returning 403 for this endpoint https://developer.atlassian.com/cloud/jira/software/rest/api-group-other-operations/#api-agile-1-0-board-get - I even saw it the app/system user has permissions and it seems it does have access and SD and Software.

However when I do any request to the Cloud API, it works fine. Any idea why or what the issue is?

Thank you in advance

[Anandhakrishnan]

Even I have a doubt,How could you solve 403 Forbidden error? Please clarify anyone.