Scopes Justification
UniPortal declares the scopes below in its manifest.yml. When you authorize another JSM instance, UniPortal also requests several of them, plus offline_access, on the Atlassian consent screen. Each entry says what the app uses the scope for.
Scopes in the manifest
read:cmdb-object:jira
Fetches Jira Service Management Assets objects to show Assets columns in the request table.
manage:servicedesk-customer
Fetches the organizations of the site and the application roles of users, to match customers to dialog variants and to verify access.
read:instance-configuration:jira
Reads the application properties of the local instance (GET /rest/api/3/application-properties), to get the date format that UniPortal uses for user settings.
manage:jira-configuration
Reads the application roles of the local instance and their user counts, for the background license check and to validate subscription tiers.
read:jira-user
Reads the identity of the current user, looks up Jira users by account ID to check whether a user belongs to the target instance, and identifies the connected user during the OAuth authorization. It also fetches the groups of a user and searches groups by name, to match a customer to a dialog variant by Jira group.
read:email-address:jira
Reads the email addresses of Jira users and customers with the Jira email API. A portal-only customer has an account on one site only, so UniPortal uses the email addresses only to find the same customer on every other connected instance.
read:jira-work
Searches issues and retrieves spaces, custom fields, and statuses across the connected instances. It runs the query that decides which requests a customer can see in the dialog, and powers the daily cache refresh.
read:forge-app:jira
Lets UniPortal call its own API routes on the connected instances.
read:servicedesk-request
Fetches customer requests on behalf of portal users, to combine ticket data from several instances. This scope uses allowImpersonation: true, which is required because customers without a license don’t have a native Forge execution context.
storage:app
Stores the app configuration, encrypted OAuth tokens, synchronized request data, the mapping of portal-only customer accounts between instances, and system event logs in the Forge Key-Value Store (KVS) and Object Store. All data, including logs, stays within the Atlassian Forge infrastructure.
Custom scope
manage:instance:custom
A custom scope, named “Manage Instances Info”, that protects the API routes of UniPortal. Connected instances use them to read information about the main and service desk instance and the license, to find the account of a portal-only customer by email, and to receive the configuration that the master sends. See Architecture.
Consent screen
offline_access
Keeps the OAuth connection to another JSM instance valid with a refresh token, so you don’t have to authorize the instance again.
Access to external addresses
The manifest also lets a site admin decide which external addresses UniPortal can call. For Atlassian, Salesforce, and Azure DevOps, the site admin approves each tool’s addresses with Allow access. See Connections.