Atlassian Cloud
Setup guide.

Before you start

• An Atlassian Cloud organization and an organization admin who can create API keys in Atlassian Administration.
• Create an API key with scopes. Do not use an API key without scopes: it is not limited to read access.

Read-only permissions

Grant exactly one scope:

Do not add any write: or delete: scope. All three endpoints KeySkope calls (Get directories, Get users, Get user role assignments) require only this scope. KeySkope cannot confirm which scopes a key carries and never attempts write calls to find out; the key owner is responsible for the restriction, so record it in your credential register.

Connect Atlassian Cloud

1. In Atlassian Administration, open Settings → API keys and choose Create API key → API key with scopes.
2. Select only read:directories:admin and set the shortest expiry your policy allows.
3. Copy the organization ID and the key value.
4. In KeySkope, open Connectors → Atlassian Cloud, enter both values and run a sync.

Connection fields

What appears in KeySkope

• Directory users with accountStatus and membershipStatus. An account is active only when both are active. A user in several directories appears once.
• Administrator roles (admin_role): atlassian/org-admin, atlassian/site-admin, atlassian/user-access-admin (from the user’s platformRoles) and atlassian/admin on a product (from role assignments).
• Ordinary access (access): user, basic, guest, customer, contributor, stakeholder, ai-access.
• Roles are read from Atlassian, including roles Atlassian reports as granted through its own groups; nothing is inferred from IdP membership.
• Activity is Unavailable: last-active dates are not read, so no account is shown as unused or “never”.
• If a sync stops early (permission error, rate limit, timeout, malformed response, repeated cursor), accounts already read are kept and nothing is removed.
• Known limitation: KeySkope makes one role-assignment request per user within a fixed sync time budget. Large organizations may finish as partial (safe, nothing removed) until a longer-running sync is available.
• The user list uses Atlassian’s GET Get users in an organization endpoint, which Atlassian has deprecated from 30 June 2027; KeySkope will move to the replacement before then.

Verify the first sync

1. Check the sync status and coverage on the Connectors page.
2. Compare a known organization admin’s roles with Atlassian Administration → Users.
3. Record the key owner and expiry, and rotate before expiry.

Troubleshooting

Official references

• Atlassian admin API scopes
• Organizations REST API — Users
• Organizations REST API — Directory