We use Jira Automation's "Send web request" action to call an external system's REST API whenever a ticket transitions state.
The target system requires a static credential (e.g., a Personal Access Token / API key)
attached as a header value, since Jira's outbound webhook delivery can only send a static, pre-configured header or URL token — it cannot perform an OAuth 2.0 handshake, token exchange, or token refresh (confirmed against the public webhooks documentation).

Problem

The target system's credential (PAT) is short-lived and must be rotated periodically
(e.g., every 30-90 days). Today, there is no supported way to update this credential
programmatically:

1. If the credential is stored as a plain header value directly in the rule, it can only
   be edited manually through the rule's UI (or marked "Hidden", which is one-way masking that is lost on rule duplication/export, forcing manual reconfiguration on every export).

2. If the credential is stored using the recommended "Secret keys" feature (masked,
   centrally managed, referenced by name across rules), there is no REST API to create,
   read, or update a secret key's value. Rotation must be done manually through
   "Automation rules > Manage secret keys" in the UI every time.

3. We also reviewed the Automation Rule Management API (GET/PUT /rule/{ruleUuid}).
   We found that it currently does return and accept plain-text header/token values —
   but only because of a confirmed security bug (AUTO-2211: "Automation Rule Management API returns secrets in clear text"), which exposes credentials to anyone able to call the API. This is explicitly flagged by Atlassian as unintended behavior, not a
   supported mechanism, and may be patched/closed at any time without providing an
   alternative.

Request

Please provide an official, documented, and secure way to rotate credentials used by
automation rules without manual UI intervention, for example:

• A REST API endpoint to create/update/rotate the value of a "Secret key" used across
    automation rules (write-only, value never returned in GET, consistent with current
    UI masking behavior).
• And/or a way to reference an external secret manager (e.g., a customer-managed vault)
    from a "Send web request" action, so Jira always fetches the current credential value
    at execution time instead of storing a static copy.

This would let teams safely automate end-to-end credential rotation for outbound
integrations (Jira -> external systems) without exposing secrets in plain text via API,
and without requiring manual re-entry of tokens every rotation cycle.

Related issues

• AUTO-2211 - Automation Rule Management API returns secrets in clear text (security bug, currently the only way tokens can technically be read/written via API)