Get User Data through Rest API

[Mathew Lederman]

Can anybody help me understand how teams are expected to pull user data through the Cloud REST API? I understand GDPR restrictions are in place, but from what I can find it should be accessible for teams on Enterprise plans, I just can't find well-documented structure. 

The get User method says it needs access to Browse users and groups global permission. but the link for global permissions doesn't go anywhere. Can anybody help me understand what this permission entails?

[ELFAPP Technologies]

Hey @Mathew Lederman 

If you've claimed your domain and you manage the user base, as an admin by default, the profile visibility is set to that user and admin, and you can therefore see the email address. You can retrieve the user info via this API Get managed account, and get the email addresses you want. The only downside there is you can't get the email addresses of users whose domain isn't claimed by the organization or free domain names e.g. gmail, yahoo etc except those users change their profile visibility to anyone

[Mikael Sandberg]

Here is the link to global permissions, https://support.atlassian.com/jira-cloud-administration/docs/manage-global-permissions/.

Having Browse users and groups allows you to select users and groups from user picker fields and be able to share work items. And if you have this permission you can see the name of users and groups. By default anyone that have access to Jira get this permission.

[Mathew Lederman]

@Mikael Sandberg appreciate the response. With some more digging, it doesn't look like email address is visible. How are application teams supposed to programmatically identify users for support and/or integration with other systems if they can't get a user's email address?

I manage an enterprise instance with 6,000 users. We have claimed our domain and manage all the accounts, but it still doesn't seem like I have the ability to force users to share their work email address due to a failed attempt a compliance with GDPR? Is that right?

I have to imagine other people have run into this issue when trying to pull user's data out of the system. There has to be something that I'm missing. 

[Mikael Sandberg]

Email addresses should be available if you use the Get user endpoint. The response has the email address, display name and other information.

[Mathew Lederman]

Does it bypass Profile Visibility where email address is hidden by default and, from what I can find, there's no way for me as an org admin to force it to be visible?

[Bill Sheboy]

Hi @Mathew Lederman 

There is a new REST API endpoint specifically to help get user information, regardless of the profile visibility setting.  As a disclaimer, I have not tried it yet:

Please look here to learn more: https://jira.atlassian.com/browse/ID-7744

Kind regards,
Bill

[Mathew Lederman]

@Bill Sheboy appreciate the link. I found that as well. Unfortunately it requires the new user management experience and we must remain on the decentralized user management experience to take advantage of the product transfer process as we centralize our instances under one org.

[Mikael Sandberg]

The visibility also depends on if you are using and IDP or not. If you are using an IDP you cannot set the email address to private, admins also need access to it since the email address is used for product access and services.

[Mathew Lederman]

@Mikael Sandberg Can you share the documentation where it states email cannot be set to private if we're using an IDP? 

[Mikael Sandberg]

AT the moment I cannot find the documentation, but I just checked my work profile and it does not allow me to set the email to be private, it only allow me to set it to "Only you and admins", and we are using Okta for SSO.