Read-only Atlassian Connect app permissions for querying workflows

Background

Currently, Atlassian Connect apps require the ADMIN scope in order to query workflows, workflow schemes, and related read-only endpoints. Being able to query a Jira issue type's workflow transitions is important for building Jira apps that automatically transition issues under certain conditions. Currently, the only way to do this is by having the full-blown ADMIN scope associated with the app, which grants wildly excessive permissions to apps that only need to read this information. This increases the security risk associated with such apps, and cautious Jira admins may not be willing to install them.

Suggestion

To reduce the security risks associated with Atlassian Connect apps that need to query Jira workflows, add a new scope in between READ and ADMIN that enables this functionality, or allow the READ scope to query these API endpoints. The current description of the READ scope on the Atlassian Marketplace is Read data from the host application. Allowing that scope to read workflow configurations seems consistent with this description, so an entirely new scope may not be necessary.