After revoking user in Jira, still able to access Jira defects with access token through APIs

[Manoj Kumar]

Create a user in jira.

using APIs create defects for that user

Revoke that user in Jira

I am still able to access defects of revoked user using JIra APIs with access token.

I am expecting Jira APIs to NOT allow access to user who is revoked .

[Joe Pitt]

Are you saying you can access the issues created by the user? If that is the case, revoking the user doesn't do anything to the issue. 

[Bill Sheboy]

Hi @Manoj Kumar -- Welcome to the Atlassian Community!

Adding a question to what Joe asked...

Are you suggesting that an API Token should stop working when the user who created it is de-activated/has Jira permissions removed...and you observe that not to be the case?

Best regards,
Bill

[Mélanie Liguet]

@Bill Sheboy 
Do you have the answer to your question?
I need to know the answer too

regards

[Bill Sheboy]

Hi @Mélanie Liguet 

I do not know, so I was asking Manoj Kumar what they observed, as I didn't find anything in the documentation.

If you are on a paid Jira license, consider asking your site admin to submit a support ticket to Atlassian to learn what they say: https://support.atlassian.com/contact/#/

Kind regards,
Bill

[Manoj Kumar]

It is not in documentation.  As I have revoked jira access of jira user. Then I am able to communicate with jira server using rest API by using access token which was generated earlier. 
Basically As we revoke access of any jira user from jira server then its token must be invalid automatically. 

[Keshav]

Hi Manoj,

Please validate the email id of the account through which you had created the API token earlier. You may have revoked the API token through a different email id account and assuming it to have been revoked.