Jira Token With Scopes

[aadish]

As Api token without scopes are deprecating I created a jira token with scopes using following scopes:
read:issue:jira
read:issue-details:jira
read:project:jira
read:user:jira
read:permission:jira

curl --location 'https://***********/rest/api/3/issue/PPT-28' \
--header 'Accept: application/json' \
--header 'Authorization: Basic *********** \
--header 'Cookie: atlassian.xsrf.token=a87d095344e85388d88b42f511242659303971a4_lout'

I am getting the below error 

{

"errorMessages": [

"Issue does not exist or you do not have permission to see it."

],

"errors": {}

}

Need help over this

[Jorge Belenguer]

Documentation is a bit confusing, so I'm not going to pretend I'm sure about this, but...

I believe to use scoped tokens you cannot use basic authentication, but OAuth 2.0 instead (Jira scopes for OAuth 2.0 (3LO) and Forge apps).

Worth adding that if that assumption is correct, you will also need to go through the https://api.atlassian.com/ex/jira/<cloudId> endpoint instead of https://your-domain.atlassian.net

https://developer.atlassian.com/cloud/jira/platform/rest/v3/intro/#other-integrations

[Rene C_ _Atlassian Support_]

Hi, @aadish ! I recently received a support request from another customer with a similar problem. I believe this is related to what @Jorge Belenguer mentioned about scopes generally being meant for OAuth 2. but now that the API Tokens page implemented scopes for API tokens and is also indicating that un-scoped API tokens will be deprecated, it is not clear if this is meant to deprecate Basic auth as well, or if the scoped API tokens are meant to be used with Basic auth like un-scoped ones and are simply not working as expected, like in your case.

To ensure we track this, as well as to clarify the scenario, I raised a bug report for this at: JRACLOUD-94545 - Sending web requests with API tokens with a scope result in permission issues

It is worth mentioning some endpoints work as expected even when scoped and using basic auth, so I'm leaning toward a bug in the way scopes are validated with basic auth. In any case, I suggest using un-scoped tokens for now, relying on the project permissions to limit what the credentials can used, and add yourself as a watcher in the bug report to be notified of updates about this topic