-
Type:
Suggestion
-
Resolution: Unresolved
-
Component/s: API keys / authentication
-
None
-
Jira Software
Context
Jira Cloud exposes a number of REST API operations that are explicitly marked as experimental in the public docs, for example:
- Get all metadata for an expanded attachment (Experimental):
The Jira Cloud platform REST API
Per the Jira Cloud REST API v3 intro:
The Jira Cloud platform REST API
Features and methods marked as experimental may change without notice.
Many customers, especially in regulated or risk‑averse environments, are not comfortable with experimental endpoints being callable on production sites with no way to centrally block them.
Suggested improvement
Add a site‑level admin setting in Jira Cloud that allows administrators to disable all experimental REST API methods for a given site.
When disabled:
- Any REST operation marked as Experimental in the Jira Cloud REST docs should return a clear error (e.g. 403 with a message like “Experimental REST APIs are disabled for this site”) and perform no action.
This would give customers a simple, enforceable control to prevent use of experimental APIs in production, while still allowing others to opt in where desired.
- is related to
-
JRACLOUD-42122 REST API Access Permission
- Gathering Interest
- relates to
-
ID-8434 Provide enhanced auditing and controls over site-level API access
- Gathering Interest