When will the hide header option be available for Jira Automation on data center?

[Ricky Conn]

We're currently trying to integrate the Jira Automation plug in into our Jira instance but we have security concerns over allowing users to send web requests with their rest api tokens visible in the headers section of the send web request action. Data center documentation link:
https://confluence.atlassian.com/jirakb/how-to-extend-automation-for-jira-with-rest-api-calls-1155142199.html

I see that there is an option in the cloud version of the automation plug in to hide the value for the headers. I've bookmarked a response that has this featured in a screenshot:
https://community.atlassian.com/t5/Jira-articles/Automation-for-Jira-Send-web-request-using-Jira-REST-API/ba-p/1443828#M3871 

When will this feature be available in the data center version?

[Bill Sheboy]

Hi @Ricky Conn 

I did a quick search in the public backlog and did not see this as a suggestion yet, so you could add it.

And...you could post this as a comment in both of these threads from a couple of the automation product managers to see how they respond:

https://community.atlassian.com/t5/Automation-articles/How-can-we-improve-Automation-for-you/ba-p/2201861

https://community.atlassian.com/t5/Automation-articles/What-would-make-Automation-better-for-you/ba-p/2196258

Kind regards,
Bill

[Daniel Brvnistan]

I believe Automation Rule project permission allow user to copy the Authorization header (JIRAAUTOSERVER-522) addresses this issue. I upvoted it.

[Clark Everson]

Hi Ricky,

feature parity between cloud and data center is not guaranteed. Atlassian does keep and eye on community for feedback of new features. 

however on the flip side, anyone can make these requests anyways using jira api and either a password or api token. So disabling the functionality from view doesn’t serve much purpose as users can still do this with jira apis

best,

clark

[Ricky Conn]

Hey Clark,

Good to know that feature parity is not guaranteed.

I think you may have misunderstood the ask, we know that users will be using the API and we support them using rest api tokens to achieve this. The problem is that we don't want them to use someone else's token. If we were to open up Jira Automation to multiple users, they would be able to see other people's rest API token in the header value and could then copy it. However, if we had the feature to permanently hide the token in the automation action, we could then roll this out without having to worry about users copying each other's tokens.