Admin controls

Authenticated A2A task execution is disabled by default. Before an external agent can send requests to https://a2a.atlassian.com/v1/rovo, an organization administrator must enable A2A for the organization.

What admins control

There are two separate controls that affect whether A2A requests can run:

Both must allow access before A2A requests can succeed.

What stays public

The Agent Card at https://a2a.atlassian.com/.well-known/agent.json remains public even when A2A is not enabled for the organization. This lets agents discover the gateway before they authenticate.

What happens when A2A is disabled

The gateway resolves your organization before it checks the admin setting, so there are two distinct failures with two distinct error codes.

If the organization cannot be resolved from the authenticated context, the gateway returns 403 with error code -32008:

1
2
{
  "jsonrpc": "2.0",
  "id": null,
  "error": {
    "code": -32008,
    "message": "Unable to determine the organization for the requested site. Please ensure the site is correctly configured and try again."
  }
}

If the organization resolves but A2A is not enabled for it, the gateway returns 403 with error code -32007:

1
2
{
  "jsonrpc": "2.0",
  "id": null,
  "error": {
    "code": -32007,
    "message": "A2A connections are not enabled for this organization. Please contact your site administrator to enable A2A connections in Admin Hub."
  }
}

Enabling A2A

To enable A2A:

1. Go to Atlassian Administration.
2. In the left sidebar, select Rovo, then Agent2Agent.
3. Enable A2A connections.

Revoking access

• Organization admins can disable A2A for the organization at any time.
• Users can revoke app authorization from Atlassian profile settings.

Next steps

• Authentication — Learn how OAuth 2.0 and organization enablement work together.
• Getting started — Verify the required setup before sending your first request.
• Troubleshooting — Diagnose 403, 404, and auth-related failures.