/
Permissions & Authorization

Permissions & Authorization

Permissions

API tokens are used to authenticate requests to the STAGIL Tables REST API and inherit the permissions of the user who created them.

API tokens can be created in two different contexts:

  • Jira Administration

    • Available to Jira administrators

    • Location: Cog icon → Marketplace apps → API tokens in the left sidebar

    • Tokens are managed centrally

    • All tokens across the instance are visible

  • Project Settings

    • Available to Project administrators

    • Location: Project settings → API tokens for Tables

    • Users can only view and manage their own tokens

Authorization

Basic authentication is accepted for user authorization. Basic auth requires API tokens. API tokens are generated and managed according to your Permissions.

image-20260406-181244.png
Jira Administration
image-20260406-181352.png
Project Settings

Username. Token labels are used to create a username for a REST client. The username has the following format: tokenLabel@instanceName.atlassian.net.

Password. The password is API token itself. For example, Y71AteRwSra1keDalEvp0Y

You can also use our Postman collection for this and define {{tokenLabel}}, {{instanceName}} and {{apiToken}} as variables.

Token Expiration

To enhance security, API tokens include an expiration date. The selectable date range is limited as follows:

  • Earliest date: 1 day from the current date

  • Latest date: 1 year from the current date

If no date is selected, a default value of 7 days from the current date is applied.

image-20260408-131114.png

Authorisation for Automation rules

Authorisation header for web requests uses the same information but in a slightly different construct.

Below you can see an example of a constructed authorisation header:

Authorization: Basic user@stagil-test.atlassian.net:TDTJ9mu06roWwkLqUmlh45

where 

user = token label 
stagil-test.atlassian.net = your instance URL 
TDTJ9mu06roWwkLqUmlh45 = token 

Next, the string user@stagil-test.atlassian.net:TDTJ9mu06roWwkLqUmlh45 should be encoded via Base64.

The last step is to fill out the header with an encoded string as shown in the example to the right.

 

Postman Collection