Summary

• Portal-only customer accounts do not have any configurable privacy options(Atlassian accounts do have configurable privacy options)
• For customer accounts - the expected behaviour is that:
  • Agents can see customer email addresses
  • Customers can see other customer email addresses if both have access to the same ticket/request

Calling either:

• <instance_name>.atlassian.net/rest/api/2/search?jql=id=<issue_key>&expand=changelog&maxResults=1
• <instance_name>.atlassian.net/rest/api/2/search?jql=id=<issue_key>
• <instance_name>.atlassian.net/rest/api/3/users/search?accountId=%

Doesn't return the emailAddress field for customer accounts as expected - the field is missing:

        "reporter": {
          "self": "https://dnguyen4-test3.atlassian.net/rest/api/2/user?accountId=qm%3Axxxxx-xxxxxx-xxxxxxx-xxxxxxxxx",
          "name": "qm:xxxxx-xxxxxx-xxxxxxx-xxxxxxxxx",
          "key": "qm:xxxxx-xxxxxx-xxxxxxx-xxxxxxxxx",
          "accountId": "qm:xxxxx-xxxxxx-xxxxxxx-xxxxxxxxx",
          "avatarUrls": {
            "48x48": "https://avatar-cdn.atlassian.com/default?size=48&s=48",
            "24x24": "https://avatar-cdn.atlassian.com/default?size=24&s=24",
            "16x16": "https://avatar-cdn.atlassian.com/default?size=16&s=16",
            "32x32": "https://avatar-cdn.atlassian.com/default?size=32&s=32"
          },
          "displayName": "MyDisplayName",
          "active": true,
          "timeZone": "Europe/Amsterdam",
          "accountType": "customer"

Steps to Reproduce

1. Call the instance to fetch issue data <instance_name>.atlassian.net/rest/api/2/search?jql=id=<issue_key>
2. Examine the response body

Expected Results

• The response shows the emailAddress field

          "reporter": {
            "self": "https://dnguyen4-test3.atlassian.net/rest/api/2/user?accountId=qm%3Axxxxx-xxxxxx-xxxxxxx-xxxxxxxxx",
            "name": "qm:xxxxx-xxxxxx-xxxxxxx-xxxxxxxxx",
            "key": "qm:xxxxx-xxxxxx-xxxxxxx-xxxxxxxxx",
            "accountId": "qm:xxxxx-xxxxxx-xxxxxxx-xxxxxxxxx",
            "avatarUrls": {
              "48x48": "https://avatar-cdn.atlassian.com/default?size=48&s=48",
              "24x24": "https://avatar-cdn.atlassian.com/default?size=24&s=24",
              "16x16": "https://avatar-cdn.atlassian.com/default?size=16&s=16",
              "32x32": "https://avatar-cdn.atlassian.com/default?size=32&s=32"
            },
            "displayName": "MyDisplayName",
            "active": true,
            "timeZone": "Europe/Amsterdam",
            "accountType": "customer",
            "emailAddress": "myemailaddress@domain.invalid"
  

Actual Results

"emailAddress": "myemailaddress@domain.invalid" is missing from the response body

Notes

• "Reporter" and "Request participants" field affected
• Possibly any other fields where the emailAddress field should be present

Workaround

• No known workarounds