Skip to main content

Jira Connection

The scanner reads Jira Data Center content exclusively through the Jira REST API. It never accesses the Jira database and never modifies Jira content.

Configure via the admin UI​

Open Administration -> Jira Connection and provide:

  • Jira base URL - e.g. https://jira.example.com
  • Service account username - the Jira account used for API calls
  • Service account credential - the API token or password for that account

Then run Test connection. It verifies that the API is reachable, the Jira version is available, and the service account has the required permissions. Failed tests show a sanitized error; credentials are never included in errors or logs.

Configure via environment variables​

VariableDescription
JIRA_BASE_URLBase URL of the target Jira Data Center instance
JIRA_SERVICE_ACCOUNT_USERNAMEUsername of the Jira service account
JIRA_SERVICE_ACCOUNT_TOKENAPI token / password for the service account
JIRA_CREDENTIAL_ENCRYPTION_KEYSymmetric key used to encrypt stored credentials at rest (required)

Service account requirements​

The service account needs:

  • Jira Browse Projects permission on every project that should be scanned.
  • Jira Browse users and groups global permission if you use reporting. The scanner uses it to look up a project lead when the expanded project response does not include the lead's e-mail address.

Reporting also requires Jira to disclose project-lead e-mail addresses to the service account. Under Administration -> System -> General configuration, set User email visibility to Logged in users only (recommended) or Public. Hidden omits the address and Masked does not return a usable recipient address.

There is no special Jira project role to grant for reporting, and the service account does not need Jira administrator rights. Jira permissions govern the data available to the scanner; application administration is controlled by app-local OIDC roles.

See Atlassian's documentation for global permissions and the User email visibility setting.

Credential storage​

Credentials are stored encrypted at rest using JIRA_CREDENTIAL_ENCRYPTION_KEY and are never written to logs. Keep the key stable across restarts; rotating it requires re-entering the Jira credential.