Integrate with Jira

Follow this step-by-step guide to allow SlashID to monitor and protect your Jira Cloud site. This integration tracks users, app (bot) accounts, groups, projects, project role assignments, and installed Marketplace apps.

note

This integration supports Jira Cloud (*.atlassian.net). Jira Data Center is not currently supported.

Before starting

Before starting, ensure you have:

• A Jira Cloud site
• An account with the Browse users and groups global permission
• Optionally, site admin access for the integration user, so installed Marketplace apps can be synced

IP allowlisting

If your endpoint or tenant restricts traffic by source IP, allow connections from SlashID's egress IPs published at https://cdn.slashid.com/egress.json. The list is global and stable; the syncToken field changes whenever the IPs change, so you can use it to detect drift.

The file follows the JAFAR draft format (A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients), the same convention major cloud providers use to publish their IP ranges.

Step 1: Choose an integration user

We recommend a dedicated integration account rather than a personal one, so the connection survives personnel changes and its activity is clearly attributable.

The integration user needs:

Permission	Required	Used for
Browse users and groups	Yes	Users, app accounts, groups, group memberships
Browse projects (project membership or Administer Jira)	Yes	Projects and project role assignments
Site admin	No	Installed Connect/Forge (Marketplace) apps

tip

If the integration user is not a site admin, the sync still succeeds — installed apps are simply skipped.

Step 2: Create an API token

1. Sign in as the integration user and go to id.atlassian.com → Security → API tokens
2. Click Create API token
3. Give it a label (e.g. SlashID Identity Protection) and copy the token — it is shown only once

Step 3 (optional): Enable event streaming

To stream org audit-log events (group membership changes, permission grants, user lifecycle), SlashID needs an organization admin API key:

1. Go to admin.atlassian.com, select your organization → Settings → API keys
2. Click Create API key, name it (e.g. SlashID event streaming), and copy the key
3. Note your organization ID — it's the UUID in the admin.atlassian.com URL
4. Enter both values in the SlashID Console connection form

Without these two fields the integration still works; only event streaming is disabled.

Step 4: Create your Jira↔SlashID Integration

Go to the SlashID Console integrations page and add a Jira connection with:

SlashID Console field	Description	Example
Name of the connection	Arbitrary name for this connection	Jira Production
Authoritative status	Whether Jira identities are the primary source of truth when reconciling identities across providers	Primary or Secondary
Instance URL	Your Jira Cloud site URL	https://acme.atlassian.net
Email	The Atlassian account email of the integration user	[email protected]
API token	The token you created in step 2	—
Atlassian org ID	Optional — your organization ID from admin.atlassian.com; enables event streaming	a1b2c3d4-...
Org admin API key	Optional — the org API key you created in step 3; enables event streaming	—

Verification

After the first sync completes, SlashID will show:

• Users — every Atlassian account in the site, including Jira Service Management customer accounts
• Non-human identities — app (bot) accounts belonging to installed integrations
• Groups — with group memberships, and global permissions flagged on well-known admin groups
• Projects — as resources, with per-project role assignments (who can access which project, directly or via groups) and project lead ownership
• Applications — installed Connect/Forge Marketplace apps (site admin only)

Troubleshooting

• 401 Unauthorized during sync or preflight — the API token was revoked or expired, or the email doesn't match the token's account. Recreate the token and update the connection.
• User list is empty or missing users — the integration user lacks the Browse users and groups global permission.
• No projects or role assignments — the integration user cannot browse the projects. Grant project access or Administer Jira.
• No installed apps — the integration user is not a site admin. The rest of the sync is unaffected.
• No events streaming — the org ID / org API key pair is missing, or the API key was revoked or expired (Atlassian org API keys expire — rotate at admin.atlassian.com).
• Emails show as “-” for some users — those users hide their email via Atlassian profile privacy controls; Jira's API omits the address.