Use of the JIRA API Token

[Mike Donnan]

I have developed an Excel sheet which uses the Cloud API to run JQLs. I use the API token code generated from the JIRA website. The authentication in the web call is email.address:token ...  how do I share this Excel sheet with another person for them to use..? Do they have to generate their own code and embed in the API call..?

[Nicolas Brunson]

The recommended way would be to make the login credentials configurable and have every user generate their own API token. Please note that depending on the user's permissions and the configured JQL, other users may receive a different number of results (check configured Security Levels, Permission Schemes, etc.).

Another option would be to create a dedicated service account for the Excel sheet and use the API token from that account in the shared Excel sheet. Since the API token allows full access to the user's account, you should take appropriate measures with the service account's permissions to ensure that it only has access to the required resources, e.g. by restricting its edit permissions.

[Mike Donnan]

Thanks Nicolas...  how does this work with Atlassian's licensing model. If you have more "agents" using a service account to perform admin tasks in Jira than you have "agent" licenses..? Also... an agent is defined as someone who can edit or delete comment on issues ... if you are doing this through the API... does it have the capability to capture the "real" user in the issue history rather than the API service account..?

[Nicolas Brunson]

@Mike Donnancorrect, that service account would use an agent license since an agent is defined as someone who has JSM product access. Out of the box there's no way to map actions taken by the service account to the real users.

You could create an internal comment via API on the issue with the action taken and log the username.