Unauthorized Error (401) When Using "Get All Application Roles" Endpoint in Jira REST API

[Vasilis Kokotakis]

Hey community,

I’ve created an app through the Atlassian Developer Console using OAuth 2.0.

I successfully followed all the steps and retrieved a working token. I’m able to use most of the endpoints listed in the Jira REST API documentation without any issues.

However, I’m facing a problem with the following endpoint:

Get All Application Roles API Documentation Link

When I try to access this endpoint, I receive the following error:

{
    "code": 401,
    "message": "Unauthorized; scope does not match"
}

I noticed that this endpoint does not specify any recommended scope in the documentation. To troubleshoot, I added all granular scopes related to roles in my app, but the issue persists.

Does anyone have any suggestions or know how to resolve this?

Thanks in advance!
VK

[Pavel Junek · Accepted solution]

Hi Vasilis,

Welcome to Atlassian Community!

The error "Unauthorized; scope does not match" typically means that the OAuth token you are using lacks the necessary permissions (scopes) to access the Get All Application Roles endpoint. However, in your case, the documentation for this endpoint not specifying a recommended scope adds to the confusion.

I think there is possible problem with "Free Cloud Plan".

Limitations of OAuth 2.0 in Free Plan

Some administrative APIs (like roles management) may be restricted to API tokens created by a user with administrative permissions. OAuth apps might not have access to certain endpoints regardless of scopes, especially on free plans.

Workaround:

If you're on a free plan:

1. Create a personal API token in Jira Cloud:
   • Go to Jira Settings → Personal Settings → API Token.
   • Use this token with Basic Authentication for your API requests.
   • For example:
     ruby

     Authorization: Basic <Base64EncodedEmail:APIToken>

The Get All Application Roles endpoint might not be available on the Free Plan of Jira Cloud because some administrative endpoints are restricted to paid tiers. Double-check the Free Plan limitations in the Atlassian Jira Pricing.

Pavel

[Vasilis Kokotakis]

@Pavel Junek Hey Pavel, Yes you are right. Using Basic Auth, this endpoint works fine.

Thanks for your usefull input.

Vasilis