Assets scopes for OAuth 2.0 (3LO) and Forge apps

Scopes enable an app to request a level of access to an Atlassian product.

Forge apps

The easiest way to set your app's scopes is to:

• Update to the latest forge-cli packages.
• Run forge lint --fix to add the scopes to the manifest.

If you want to set the scopes manually, you need to:

• Review your app to determine all of the operations used.
• Consult the Assets REST API documentation to determine the scope needed for each operation and create a list of scopes.
• Add the scopes required to the app's manifest file.

Redirect response codes

Currently, Assets APIs that return a 3xx status code with a redirect URL in the Location header are not handled properly in Forge. To work around this, you need to manually manage redirects by making a new request to the URL provided in the Location header.

1
2
// Call API that returns 3xx with destination set in Location header
const response = await api
    .asUser()
    .requestJira(
        route`<API>`,
        {
            // ...all the other options...,
            redirect: 'manual'
        },
    );

const locationHeader = response.headers.get('Location');

let redirectAPI;
try {
    // Dropping the host from url
    redirectAPI = (locationHeader.split(new URL(locationHeader).origin))[1];
} catch (error) {
    // url is relative, no change required
    redirectAPI = locationHeader;
}

const response = await api
    .asUser()
    .requestJira(route`${redirectAPI}`);

OAuth 2.0 apps

For OAuth 2.0 apps, you need to:

• Review your app to determine all of the operations used.
• Consult the Assets REST API documentation to determine the scope needed for each operation and create a list of scopes.
• Update the scopes required in the developer console.

Scopes

These scopes are for apps using OAuth 2.0 authorization code grants (3LO) for authorization and Forge apps. The title and description are displayed to the user on the consent screen during the authorization flow.