Atlassian Jira

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the issues of the Jira projects you name, each with its description and every comment in one document, so a question about a case finds the discussion as well as the report. A deleted issue, or one moved out of the projects, leaves the knowledge base.

At a glance

Collector	Atlassian Jira, version 1.0.0
Reads	Atlassian: Jira Cloud (the vendor's documentation)
Family	ITSM
Kind	Tickets
Ways to connect	Access token
Scopes	Read: read:jira-work
Read only	Yes
Vendor's API can move money	No
Personal data	Content, Identity
Hosts it may contact	{tenant}.atlassian.net
Vendor API versions	Jira Cloud platform REST API v3
Lowest engine version	0.45.0

What it reads

• Issues in the projects you name: the summary, the description and every comment, in one document, with the project, type, status and labels.
• The cursor is UTC. Jira reads dates in the account’s profile time zone, which the collector cannot see, so the query starts a day before the cursor and drops what is not newer.
• Deletions: every reconcile_hours (six by default) the collector lists the projects’ issue keys, with no other field, and removes every issue it holds that is no longer there. A project taken out of projects has its issues removed.
• Never read: attachments, work logs and history.

How to connect

1. Create or choose an integration account in your Atlassian site with browse access to the projects you name and nothing else. Do not use a site administrator.
2. Signed in as that account, create an API token at id.atlassian.com (Security, API tokens).
3. In LightHouse, open Connectors, choose Jira, name the site, the project keys, the label and how often to read, and paste the account’s email address and token.
4. In code, set JIRA_BASE_URL, JIRA_EMAIL and JIRA_TOKEN (the names can be changed with site_env, email_env and credential_env) and add a kind: jira source card with projects, label and requires.

Permissions

The collector signs in with the account’s email address and API token (HTTP Basic). Atlassian API tokens carry no scopes, so what the account can browse is what the collector can read; LightHouse’s card lists read:jira-work for a scoped token. Every request is a GET: /rest/api/3/search/jql (issues, and issue keys alone for deletions) and /rest/api/3/issue/{key}/comment. Its read-only test proves it on every change.

Limits

• You must name the projects; a whole site is never the default. Project keys may hold letters, digits and underscores only.
• The base address must be https://.
• The search returns only the first page of an issue’s comments; the rest are fetched a page at a time.
• A deletion listing that Jira refuses fails the pull and removes nothing.
• Requests are paced and back off when Jira asks (Retry-After).

Data handling

• Issue text and comments are copied into the deployment’s corpus under the source’s label. Comments carry their author’s display name; issues can hold personal data.
• The token stays in your secret store; only the name of a missing variable is ever reported, never a value, and the token is never put in a URL.
• Nothing leaves the deployment: only counts reach LightHouse.

Troubleshooting

What you see	What it means	What to do
credential variable 'JIRA_EMAIL' is not set	A variable the source names is missing (the name is shown, never a value)	Set it, or point email_env, site_env or credential_env at the right variable
JIRA_BASE_URL must be an https URL	The site address is not https	Use the https://<site>.atlassian.net address
name the projects to sync; a whole site is never the default	projects is empty	Name the project keys
not Jira project keys	A key holds characters other than letters, digits and underscores	Correct the key
HTTP 401 or HTTP 403	The token was revoked, or the email is not the token’s owner	Make a new token for the integration account
Read succeeded, 0 written	No issue changed since the cursor	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.45.0	Jira Cloud platform REST API v3	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only