Is it possible to get an audit list of all api tokens issued for the instance?

[Heather Rimmey]

I recently joined an organization and I'm doing an assessment of an existing Cloud instance. As a site-admin, is there a way that I can identify how many API tokens are in use against the instance?

[Andy Heinzer · Accepted solution]

I don't know of any way that you could do this as a Jira Cloud site-admin.  Part of the problem I can see with this kind of request is that user API tokens are not created on a per Cloud site basis.  Instead user accounts in Jira Cloud are all authenticating to and creating API tokens to the https://id.atlassian.com site. 

Whether or not an user has created an API token is only something that the ID site could theoretically tell you.  I say theoretically, because to my knowledge only the end user that logs into that site can see that token information or lack there of.   I don't know of any way for a site-admin to be able to see if that that user has created a token or not. 

Complicating the situation, your end users could belong to multiple Jira Cloud sites, and use the same login credentials through the id platform to access them all.  As such they might have an API token, but this same token could be used for any number of Atlassian Cloud sites to which that account has been created permissions to use.  Hence it might not be feasible to even implement an audit system that could provide you this information.

I found a feature request that would appear to cover this scenario over in https://jira.atlassian.com/browse/ACCESS-96  However as to today, I don't know of any way that you could do this.  I would recommend watching and voting on this issue to help our development team prioritize new potential features.

[Heather Rimmey]

Thank you for the detailed response, this is really helpful info. I just voted up ACCESS-96 :)

[Dave Meyer]

Great summary @Andy Heinzer We definitely plan to support this feature at the organization level as part of Atlassian Access in the future.