Problem Statement
The POST .../suspend and POST .../restore endpoints in the Atlassian Directory API (v2) are not covered by any scope in the scoped API key framework. No ScopeFilter is configured for these routes, which means no scope — including write:directories:admin or write:users:admin — will authorize requests made with a scoped key. This forces customers to fall back to classic (unscoped) org API keys or perform operations manually via the Admin Hub UI, both of which are unsuitable for least-privilege or automated workflows.

Expected Behaviour
The POST .../suspend and POST .../restore endpoints should be authorized via an appropriate write scope (e.g., write:directories:admin or a new dedicated scope) so that scoped API keys can be used to suspend and restore user accounts programmatically.

Current Workarounds

1. Use a classic (unscoped) org API key — bypasses scope enforcement but violates least-privilege principles.
2. Perform suspend/restore manually via admin.atlassian.com.

Impact
Customers building automation or integrations using scoped API keys are blocked from managing user lifecycle (suspend/restore) programmatically, undermining the purpose of the scoped key framework.

References

• Cloud Admin scopes

• Cloud Admin changelog