Issue Summary

Integration API keys created in JSM Operations do not offer granular scope configuration (Read, Create/Update, Delete, Configuration Access) as they did in Opsgenie. This creates two compounding security gaps:

1. A DELETE operation against the JSM Integration Events API (api.atlassian.com/jsm/ops/integration/v2/alerts/{alertId}{}) is accepted using GenieKey authentication, despite not being documented in the The Jira Service Management ops REST API. The only documented operations are: Create Alert, Acknowledge, Close, Add Note, and Get Request Status.

1. Once the Opsgenie UI is shut down, customers will permanently lose the ability to configure scope on integration keys. Keys created in JSM default to broad permissions with no mechanism to restrict them — including against Opsgenie REST endpoints, which remain functional until EOL (2027). This makes global integration keys effectively unscoped and uncontrollable for the remainder of the transition period.

Steps to Reproduce

1. Log in to a JSM instance that has been migrated from Opsgenie

1. Navigate to Operations > General Configuration > Integrations and create a new API Integration (or use an existing one)

1. Copy the API key for the integration

1. Create an alert via the documented Create Alert endpoint to obtain a valid alert ID:
    {{}}

   curl -XPOST 'https://api.atlassian.com/jsm/ops/integration/v2/alerts' \  --header 'Authorization: GenieKey ${JSM_API_KEY}' \  --header 'Content-Type: application/json' \  --data '{"message": "Test alert", "alias": "test-alias-001"}'

   {{}}

2. Note the alert ID returned in the response

1. Attempt to DELETE the alert using the same GenieKey against the Integration Events API:
    {{}}

   curl -XDELETE 'https://api.atlassian.com/jsm/ops/integration/v2/alerts/{alertId}' \  --header 'Accept: application/json' \  -H "Authorization: GenieKey ${JSM_API_KEY}"

   {{}}

2. Observe that the request is accepted and processed successfully

1. Navigate to JSM Operations > Integrations, attempt to configure scope checkboxes (Read, Create/Update, Delete, Configuration Access) on the integration key — observe that no such configuration is available

 

Expected Behaviour:

• Undocumented operations (DELETE) should not be accepted on the Integration Events API

• Integration API keys created in JSM should either have a configurable scope (as in Opsgenie) or be restricted to only the documented operations

Expected Results

• The DELETE operation against api.atlassian.com/jsm/ops/integration/v2/alerts/{alertId} using GenieKey authentication should return a 403 Forbidden or 405 Method Not Allowed response, as this operation is not part of the documented Integration Events API contract

• Integration API keys created in JSM should expose scope configuration (Read, Create/Update, Delete, Configuration Access) as was available in Opsgenie, allowing administrators to apply the principle of least privilege

• A global integration key should be restricted to only the operations explicitly permitted by its configured scope

Actual Results

The DELETE request is accepted and returns a successful response.

No scope configuration is available on the integration key creation or edit page in JSM Operations. Keys default to full permissions and cannot be restricted via the JSM interface. Once Opsgenie UI access is removed, there is no UI or API mechanism to configure scope on integration keys for the remainder of the Opsgenie transition period.

Workaround

There is a partial workaround available only until the Opsgenie UI is shut down

• For integration keys that require restricted scope, configure the scope checkboxes (Read, Create/Update, Delete, Configuration Access) through the Opsgenie UI (Settings > API Key Management or via the integration's settings page) before the Opsgenie interface is decommissioned. Keys with scopes configured in Opsgenie will retain those scope settings.

• Where possible, use team-level integrations instead of global integrations. A team-scoped integration key limits access to only that team's alerts and configurations.