API - users/assignable/search with ?query= param returns all users

[David Schovanec]

Recently few customers of our product that uses API reported following error: "The query parameter 'username' is not supported in GDPR strict mode" which happens when finding reporter for a new issue.

Quickly I was able to find how to solve it with following privacy changes migration guide:

https://developer.atlassian.com/cloud/jira/platform/deprecation-notice-user-privacy-api-migration-guide/

The suggestion is:

Replace /rest/api/3/user/assignable/search?project=ABC&username=email@email.com

With /rest/api/3/user/assignable/search?project=ABC&query=email@email.com

We implemented and tested this and everything was ok until other customers reported wrongly assigned users. Shortly after we found the problem is that this ?query=email@email.com does not filter users at all for them.

I found out they all have Jira Server. Version: 7.6.14 or 7.13.2 for example.

Also, we use API V2 (/rest/api/2) instead of 3 as is mentioned in the migration guide. But the documentation covers the ?query param https://developer.atlassian.com/cloud/jira/platform/rest/v2/#api-rest-api-2-user-assignable-multiProjectSearch-get
which seems OK.

Any idea what can be the state on server Jira, or what should be a different/better solution?

Thank you 🙏🏻

[Fabio Racobaldo _Catworkx_]

Hi @David Schovanec ,

you speak about cloud but tag is referred to server. I'm a little bit confused.

Btw, for the cloud the assignable users could be retrieved by https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-user-search/#api-rest-api-3-user-assignable-multiprojectsearch-get 

Problem could be related to character encoding (use the following site https://meyerweb.com/eric/tools/dencoder/).

Character @ should be encoded as %40

Please let us know if it solve your issue.

Fabio