Can we create a write only API user?

[Jordan Moss]

Hello,

Our Jira Data Center is subject to some governmental security restrictions (fedramp,...).

We're looking at making an integration with an outside site (monday.com) to link the projects we have between them and Jira.

Due to the restrictions, we can't allow monday.com to read any data from our Jira because it cannot be guaranteed to be 'secure'

So we are looking at a 'workaround' of doing the link the other way, where we would create projects in monday, and those would get sent to Jira via the REST API.

So we need a user account that we can generate an API key (PAT?) for that can only write to Jira, but cannot read from it.

I don't see a way to do this after searching around and playing with permissions.

Jira version: Jira Project Management Software - Data Center v10.3.2

Is anything like this possible?

[John Funk]

Hi Jordan,

Wondering if you create the user in Jira and then grant Create work item permissions in the Permission scheme, but nothing else if that would work. It would be easy enough to test out just in Jira first without connecting to another app. 

[Ignacio Vera]

It doesn't work. You cannot create issues without the Browse permission

[John Funk]

I thought that might be the case. The other option is to add Issue Level Security to the issues and make sure that user is not included. 

[Ignacio Vera]

There’s no built-in “write-only” API user in Jira Data Center.
I suggest you to use an intermediary service that only forwards specific “create/update” operations to Jira via REST, and that way you can be sure you are not exposing read endpoints back to monday.com