Issue Summary

Forge apps and OAuth 2.0 apps cannot programmatically configure Assets Objects custom field contexts via a supported public API. The only endpoint that exposes this configuration — GET/PUT /rest/servicedesk/cmdb/latest/fieldconfig/{contextId} — is internal and returns 401 to all app authentication, making full automation of Assets setup impossible for apps.

Steps to Reproduce

Step 1: Create a Forge app that provisions JSM Assets configuration programmatically using asApp() — including creating schemas, object types, attributes, custom fields, and field contexts via supported public APIs.

Step 2: Attempt to configure the Assets Objects custom field context by calling GET or PUT on /rest/servicedesk/cmdb/latest/fieldconfig/{contextId} from the Forge app using requestJira() with asApp(). The request should set the object schema binding (objectSchemaId, workspaceId), AQL filter scope (objectFilterQuery), cascading issue-scope AQL (issueScopeFilterQuery), and display attributes (attributesIncludedInAutoCompleteSearch, attributesDisplayedOnIssue, attributesDisplayedOnPortal).

Step 3: Observe the response from the endpoint when called with Forge asApp() authentication, even with all available cmdb-* scopes granted (read:cmdb-config:jira, write:cmdb-config:jira, read:cmdb-schema:jira, write:cmdb-schema:jira, manage:jira-configuration, manage:jira-project).

Expected Results

A public, documented REST endpoint exists for reading and writing Assets Objects custom field context configuration, secured by an appropriate OAuth 2.0 / Forge scope (e.g. read:cmdb-config:jira / write:cmdb-config:jira). A Forge app with the correct scopes can call this endpoint using asApp() and receive a 200 response, allowing full end-to-end automation of Assets configuration without any manual steps in the Jira UI.

Actual Results

The endpoint /rest/servicedesk/cmdb/latest/fieldconfig/{contextId} returns 401 to all Forge and OAuth 2.0 app authentication. No public, supported alternative exists for this operation.

The below error is returned when calling the endpoint from a Forge app:

{
  "code": 401,
  "message": "Unauthorized; scope does not match"
} 

The same endpoint returns 200 OK when called with a user API token over Basic auth, confirming the endpoint itself is functional but not integrated into the OAuth 2.0 / Forge scope model.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available