{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"080539ac2c65940d15c2046f7d5e4d44a7d8236ccf13223768145b67340eee9c","entry":{"id":"atlassian/jira-confluence","name":"Atlassian Jira and Confluence Cloud APIs (API token or OAuth 2.0 3LO app)","vendor":"Atlassian","summary":"Use an Atlassian API token for your own scripts, or create an OAuth 2.0 (3LO) app in the developer console for multi-user access; sharing is opt-in, and a public Marketplace listing needs Atlassian approval.","category":"productivity","group":"C","homepage":"https://developer.atlassian.com","docs":["https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/","https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"oauth3lo","url":"https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/","title":"OAuth 2.0 (3LO) apps","accessed":"2026-10-25","supports":"Developer console Create > OAuth 2.0 integration; Permissions to add APIs and scopes; Authorization to set callback URL; apps private by default, Distribution to enable sharing; unreviewed-app warning; offline_access for rotating refresh tokens that expire after 90 days of inactivity.","kind":"official"},{"id":"api_tokens","url":"https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/","title":"Manage API tokens for your Atlassian account","accessed":"2026-10-25","supports":"Create at id.atlassian.com; expiry 1-365 days, default one year; scoped tokens via api.atlassian.com/ex/{product}/{cloudId}; basic auth with email + token.","kind":"official"},{"id":"privacy_guide","url":"https://developer.atlassian.com/cloud/jira/platform/user-privacy-developer-guide/","title":"User privacy guide for app developers","accessed":"2026-10-25","supports":"Apps storing personal data must report it via the Personal data reporting API; default cycle 7 days.","kind":"official"},{"id":"security_reqs","url":"https://developer.atlassian.com/platform/marketplace/security-requirements/","title":"Security requirements for cloud apps","accessed":"2026-10-25","supports":"Marketplace Partner Agreement; security requirements (TLS 1.2+, encrypt data at rest, least privilege, security contact); 3LO apps must encrypt OAuth secrets and validate state.","kind":"official"},{"id":"approval","url":"https://developer.atlassian.com/platform/marketplace/app-approval-guidelines/","title":"App approval guidelines","accessed":"2026-10-25","supports":"New public listings need approval; usually 10-15 business days; privacy and security tab, partner verification ticket; privacy policy; basic auth not acceptable for public apps.","kind":"official"}],"allowed_domains":["developer.atlassian.com","id.atlassian.com"],"account_model":{"summary":"An Atlassian account owns API tokens and developer-console apps; data access follows the user's Jira/Confluence site permissions.","accounts":[{"name":"Atlassian account","kind":"personal","owned_by":"the person","required":true},{"name":"Jira / Confluence Cloud site","kind":"organisation","required":true},{"name":"Marketplace partner","kind":"developer","required":false,"note":"Only for public Marketplace listings."}]},"steps":[{"id":"api_token","title":"Create an API token (your own scripts)","summary":"At id.atlassian.com > Security > API tokens choose Create API token (or with scopes), name it, set an expiry (1-365 days) and copy it once.","route":"copilot","depends_on":[],"gate":"human_submit","url":"https://id.atlassian.com/manage-profile/security/api-tokens","capture":{"env":"ATLASSIAN_API_TOKEN","kind":"api_key"},"sources":["api_tokens"]},{"id":"create_3lo","title":"Create an OAuth 2.0 (3LO) app","summary":"In the developer console select Create > OAuth 2.0 integration, name it and choose the grant type.","route":"copilot","depends_on":[],"gate":"human_submit","url":"https://developer.atlassian.com/console/myapps/","optional":true,"sources":["oauth3lo"]},{"id":"permissions_callback","title":"Add scopes and the callback URL","summary":"Under Permissions add Jira/Confluence APIs and only the scopes needed; under Authorization set the callback URL exactly as your redirect_uri.","route":"copilot","depends_on":["create_3lo"],"gate":"human_submit","url":"https://developer.atlassian.com/console/myapps/","recovery":[{"hiccup":"Refresh fails with invalid_grant","fix":"Refresh tokens rotate and expire after 90 days unused; store the newest one each time, or make the user re-authorise.","source":"oauth3lo"}],"capture":{"env":"ATLASSIAN_OAUTH_CLIENT_SECRET","kind":"secret"},"sources":["oauth3lo"]},{"id":"enable_sharing","title":"Turn on sharing (Distribution)","summary":"Apps are private by default. Under Distribution enable sharing; if the app stores personal data it must report it via the Personal data reporting API (default every 7 days).","route":"copilot","depends_on":["permissions_callback"],"gate":"human_submit","url":"https://developer.atlassian.com/console/myapps/","optional":true,"sources":["oauth3lo","privacy_guide"]},{"id":"marketplace_review","title":"Submit for Marketplace approval (public listing)","summary":"Meet the cloud security requirements, accept the Marketplace Partner Agreement, complete the privacy and security tab and partner verification, then submit.","route":"guided","depends_on":["enable_sharing"],"gate":"third_party_review","url":"https://developer.atlassian.com/platform/marketplace/app-approval-guidelines/","lead_time":{"official":{"text":"Approvals usually take 10-15 business days, depending on submission volume; expect a few review rounds.","source":"approval"}},"optional":true}],"outputs":[{"name":"ATLASSIAN_EMAIL","description":"Atlassian account email used with the API token for basic auth","secret":false,"example_format":"you@example.com","from_step":"api_token"},{"name":"ATLASSIAN_API_TOKEN","description":"Atlassian account API token","secret":true,"example_format":"opaque token string","from_step":"api_token"},{"name":"ATLASSIAN_OAUTH_CLIENT_ID","description":"3LO app client ID","secret":false,"example_format":"opaque id string","from_step":"permissions_callback"},{"name":"ATLASSIAN_OAUTH_CLIENT_SECRET","description":"3LO app client secret","secret":true,"example_format":"opaque secret string","from_step":"permissions_callback"}],"terms_notes":[{"kind":"rules_say","severity":"amber","text":"Apps that store Atlassian personal data must report account IDs via the Personal data reporting API (default 7-day cycle).","source":"privacy_guide"},{"kind":"rules_say","severity":"yellow","text":"Shared but unreviewed 3LO apps show users a warning that Atlassian has not approved them.","source":"oauth3lo"}],"renewals":[{"what":"Atlassian API token expiry","every":"up to 1 year (default)","every_days":365,"source":"api_tokens"},{"what":"Personal data report","every":"7 days (default cycle period)","every_days":7,"source":"privacy_guide"}],"stripe_projects":false,"api_provisioning":{"available":"no","notes":"Tokens and console apps are created in the web UI."}}}