Getting error OAuth 2.0 not allowed for this method

[Administrator Admin]

Hello team,

I am using OAuth 2.0 for authentication and using that i am calling all rest APIs.

Till now it works fine but whenever i am trying to fetch Choice field options using rest than getting error.

Below is the rest i am trying to call.
https://api.atlassian.com/ex/jira/" + jiraCloudId + "/rest/api/3/customField/10005/option

[Beata Szturemska · Accepted solution]

Hi!
I'd like to let you know that I have enabled `customField/{fieldId}/option` endpoints for OAuth and now you can use it in 3LO apps.

Do not hesitate to reach us when you are facing any other issues.
Enjoy!

[Dario B · Accepted solution]

Hello @Administrator Admin ,

I believe this is the same issue that is being currently discussed in the below thread:

• OAuth 2.0 is not enabled for this method

In short:

By reviewing the documentation, it definitely looks like: 

• Oauth 2 (3LO) is not supported for the Issue custom field options endpoints (no OAuth scopes required).
• Oauth 2 (3LO) is supported for the Issue custom field options (apps) but they can only be used for custom fields created by apps.

I am waiting for DEV to confirm this is the case and/or provide more details on plans to have this implemented.

Please review above thread and follow it for updates.

Cheers,
Dario

[Administrator Admin]

Hello Dario,

Thanks for your quick response.

But using basic authorization also we are not able to access this API.

We are trying to access this API from SharePoint Site and it is showing CORS Policy issue.

[Dario B]

Hello @Administrator Admin,

As mentioned in the below thread in the Developers Community, CORS are only supported for 3LO apps: 

• https://community.developer.atlassian.com/t/cors-error-with-rest-api/27354/3
  
  

  @estrom We actually do support CORS requests when using https://developer.atlassian.com/cloud/jira/platform/oauth-2-authorization-code-grants-3lo-for-apps/ 235, as your requests will go through api.atlassian.com 22 were token based authentication is the only thing we allow.

  For further explanation: The problem why we don’t support CORS directly on your site host/domain is that we accept session based authentication on there, which would then allow any site to make random, authenticated requests to your site.

  The alternative is to proxy your requests through your own backend, which is @sfbehnke was referring to.

  Hope this makes sense. Let me know if you have any other questions please.

As suggested in above post, in order to workaround this, you may want to use something like CORS Anywhere:

CORS Anywhere is a NodeJS proxy which adds CORS headers to the proxied request.

For the rest, going back to the original topic, I have created the below feature request to have the endpoints to manage custom fields options enabled for 3LO apps:

• [ACJIRA-2103] Oauth 2 (3LO) is not supported for the Issue custom field options endpoints 

You may want to vote and watch the above feature request so that you will get notified in case of any update. The  feature will be addressed according to the Implementation of New Features Policy.

Finally, for the future, please notice that this is not the best place to get help on development  related questions. The best resources are the ones listed in https://developer.atlassian.com/resources. 

Specifically:

• Ask the Developers Community
• Create a Developer Support Request

Have a nice weekend.

Cheers,
Dario