Uploaded image for project: 'Jira Cloud'
  1. Jira Cloud
  2. JRACLOUD-77810

Inconsistent behavior of Get users from group (GET /rest/api/3/group/member) REST API endpoint

    XMLWordPrintable

Details

    Description

      Issue Summary

      According to our documentation the Get users from group REST API endpoint is requiring Administer Jira global permission, as well as ADMIN scope for Connect apps and manage:jira-configuration for Oauth.

      This is not consistent with the fact that:

      1. the Administer Jira Global permissions documentation page actually says that you only need Browse users and groups ** global permission: 

        "Users with Administer Jira permission can perform most administration tasks, except managing users"

      2. you can actually use the REST API endpoints Find users and groups and Get user groups without ADMIN rights (as expected/documented). So that you can still get the same result using a combination of 2 other endpoints without having admin rights.

      Steps to Reproduce

      1. In the REST API documentation page for the Get users from group REST API endpoint, if you click on the "Permissions required: Administer Jira global permission" link, this brings you to the Administer Jira Global permissions page that, as mentioned above, says that you only need Browse users and groups  global permission. 
      2. The Get group members REST API endpoint for Confluence Cloud does not need ADMIN rights either.

      Attachments

        Issue Links

          Activity

            People

              3615987e9d83 Xin Liang
              a0559d4d59a1 Shreyas Agarkar
              Votes:
              3 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

                Created:
                Updated: