# Atlassian Jira > Atlassian Jira: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the issues of the Jira projects you name, each with its description and every comment in one document, so a question about a case finds the discussion as well as the report. A deleted issue, or one moved out of the projects, leaves the knowledge base. ## At a glance | Collector | Atlassian Jira, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | Reads | Atlassian: Jira Cloud ([the vendor's documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v3/intro/)) | | Family | ITSM | | Kind | Tickets | | Ways to connect | Access token | | Scopes | - Read: `read:jira-work` | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Content, Identity | | Hosts it may contact | `{tenant}.atlassian.net` | | Vendor API versions | Jira Cloud platform REST API v3 | | Lowest engine version | `0.45.0` | ## What it reads - Issues in the projects you name: the summary, the description and every comment, in one document, with the project, type, status and labels. - The cursor is UTC. Jira reads dates in the account’s profile time zone, which the collector cannot see, so the query starts a day before the cursor and drops what is not newer. - Deletions: every `reconcile_hours` (six by default) the collector lists the projects’ issue keys, with no other field, and removes every issue it holds that is no longer there. A project taken out of `projects` has its issues removed. - Never read: attachments, work logs and history. ## How to connect 1. Create or choose an integration account in your Atlassian site with browse access to the projects you name and nothing else. Do not use a site administrator. 2. Signed in as that account, create an API token at id.atlassian.com (Security, API tokens). 3. In LightHouse, open **Connectors**, choose **Jira**, name the site, the project keys, the label and how often to read, and paste the account’s email address and token. 4. In code, set `JIRA_BASE_URL`, `JIRA_EMAIL` and `JIRA_TOKEN` (the names can be changed with `site_env`, `email_env` and `credential_env`) and add a `kind: jira` source card with `projects`, `label` and `requires`. ## Permissions The collector signs in with the account’s email address and API token (HTTP Basic). Atlassian API tokens carry no scopes, so what the account can browse is what the collector can read; LightHouse’s card lists `read:jira-work` for a scoped token. Every request is a `GET`: `/rest/api/3/search/jql` (issues, and issue keys alone for deletions) and `/rest/api/3/issue/{key}/comment`. Its read-only test proves it on every change. ## Limits - You must name the projects; a whole site is never the default. Project keys may hold letters, digits and underscores only. - The base address must be `https://`. - The search returns only the first page of an issue’s comments; the rest are fetched a page at a time. - A deletion listing that Jira refuses fails the pull and removes nothing. - Requests are paced and back off when Jira asks (`Retry-After`). ## Data handling - Issue text and comments are copied into the deployment’s corpus under the source’s `label`. Comments carry their author’s display name; issues can hold personal data. - The token stays in your secret store; only the name of a missing variable is ever reported, never a value, and the token is never put in a URL. - Nothing leaves the deployment: only counts reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | -------------------------------------------------------------- | ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | `credential variable 'JIRA_EMAIL' is not set` | A variable the source names is missing (the name is shown, never a value) | Set it, or point `email_env`, `site_env` or `credential_env` at the right variable | | `JIRA_BASE_URL must be an https URL` | The site address is not https | Use the `https://.atlassian.net` address | | `name the projects to sync; a whole site is never the default` | `projects` is empty | Name the project keys | | `not Jira project keys` | A key holds characters other than letters, digits and underscores | Correct the key | | `HTTP 401` or `HTTP 403` | The token was revoked, or the email is not the token’s owner | Make a new token for the integration account | | Read succeeded, 0 written | No issue changed since the cursor | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.45.0` | Jira Cloud platform REST API v3 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/jira/