Permissions required to integrate Jira with GitProtect and protect its resources.
A Jira admin is required to back up not only individual spaces but also the broader set of global resources and company-managed spaces that may be accessed or shared by team-managed spaces, including any global resources used by those spaces.
With Jira admin access, GitProtect ensures that all global configurations—such as shared dashboards, filters, and automation rules—are properly protected.
If you only need to protect specific team-managed spaces that do not use global resources, granting your Jira account administrative permissions at the space level is usually sufficient. With access limited to the team-managed space, GitProtect will not have access to global configurations.
The following lists the permissions your Jira account must have for GitProtect to access, download, and back up all attachments in the protected space, based on the space management type.
Permission schemes — to access attachments, your Jira account must have the Browse Projects permission for a specific space, either directly or through a group or role. You can change this permission by editing the scheme assigned to the space or by assigning a different scheme.
Work item access restrictions — if a space uses a work item Issue Security scheme and contains work items with restricted access that include attachments, your account must belong to at least one Security Level assigned to each work item.
Comment restrictions — if an attachment is part of a comment with restricted access, your account must belong to the role or group that has access to this comment.
Space visibility — for spaces with private or limited visibility, you must be a member of the space to access and then back up its attachments. The assigned role and its permission scope are not relevant; space membership alone is sufficient. For all other visibility levels, attachments are accessible to the public and do not require any additional roles or permissions.
Work item access restrictions — if a work item or a comment has an access restriction applied, its attachments are visible only to users who have at least one of the roles specified in the restriction. The role name and permission scope do not matter — your Jira account only needs to be assigned one of the specified roles.
Technical requirements for securing Jira organizations with custom domains.
Custom domains in Jira allow organizations to use a branded URL instead of the default *.atlassian.net address. Even if a Jira instance has a custom domain configured, proper protection requires adding the organization to GitProtect using the original Atlassian URL.
Jira instances that use custom domains can be integrated with GitProtect, but must use their original Atlassian URL instead of the custom domain. This limitation results from how Atlassian identifies and authorizes organizations.
Atlassian security and administration APIs are bound to the organization's original Atlassian-managed URL (e.g., yourcompany.atlassian.net), not the custom domain. The custom domain serves as a user-facing alias for access and branding purposes.
Internally, Atlassian recognizes, authenticates, and grants permissions only through the original URL registered in Atlassian Administration (https://admin.atlassian.com). Therefore, GitProtect must use the original Atlassian URL to identify the organization and its applications, authenticate API requests, and enforce security and access controls.
Using the custom domain would prevent proper authorization and could lead to failed connections or incomplete protection, which is why the original Atlassian URL is required even when a custom domain is configured.
You can find organization's original URL in https://admin.atlassian.com > Apps > App URLs > Custom domains > Actions > Show details.
The original URL is listed in the Details section under Default URL (fallback).
This article describes the process of adding a Jira organization to GitProtect.
Log in to GitProtect Management Service, open the DevOps tab on the left side of the window, and select Jira from the list.
Click the Connect button under Jira Software or Jira Service Management (depending on your needs).
Enter your instance URL (for example, https://mycompanyjira.atlassian.net) and your Jira login, then add or select an API token from the Password Manager.
Configure your spaces sync and default worker — specify hours for synchronization, or set a time interval for automatic updates. Once done, click Proceed.
Your Jira organization has now been successfully added to GitProtect — click Custom policy to adjust your backup policy settings, or click Run backup to execute the backup immediately using the current policy configuration.
