Jira

Create Jira tickets from Watchtower issues, incidents and action items, keep their status in sync both ways, and let a receiver open one ticket per alert group. Jira REST API v2 with an API token (Basic auth); Cloud and Server.

Install (organization admin)

The API calls POST /internal/connect/jira/install on the notifier after it checked ManageConnectors:

{"org_id": "...", "user_id": "...", "project_id": "...",
 "config": {"base_url": "https://acme.atlassian.net", "project_key": "OPS", "issue_type": "Bug",
            "priority_map": {"high": "Highest", "medium": "Medium", "low": "Low"},
            "required_fields": {"customfield_10100": "core"},
            "done_transition_id": "31"},
 "secrets": {"email": "bot@acme.com", "api_token": "..."}}

base_url must be https and is reached through the SSRF guard (private addresses are refused). Jira's createmeta is fetched at save time (the per-issue-type endpoints of current Jira Cloud; the legacy form only on a 404, for Server and Data Center): a required field with no Jira default that is neither filled by Watchtower (summary, description, issuetype, project, reporter, priority with a priority_map) nor in required_fields is rejected with 422 and nothing is saved. Send installation_id to change the mapping of an existing installation; changing base_url or email then requires api_token to be entered again (stored credentials are never sent to a different host).

The answer holds webhook_path and, once, webhook_secret (stored sealed; it cannot be read back). In Jira add a webhook for issue: updated to https://<WT_PUBLIC_URL><webhook_path> with that secret (Jira signs with X-Hub-Signature: sha256=...); a Jira Automation "send web request" rule can send the secret as X-WT-Webhook-Secret instead. A bad or missing secret is a 401 before the body is parsed.

Tickets

POST /internal/connect/jira/tickets {user_id, project_id, installation_id, target} with target issue:<id>, incident:<id> or action_item:<incident id>/<task id>. The API's create_ticket action authorizes the user. The ticket description links back to Watchtower, and ticket_links links forward. Asking twice returns the same ticket.

Sync

• Jira moves a linked issue's ticket to the done category: the Watchtower issue is resolved as the system actor jira (audited as issue.resolved, via: jira); a webhook body is never trusted to name a Watchtower user.

• A Watchtower issue is resolved: within 15 seconds the ticket gets done_transition_id.

• No loop: the link is marked done before either side acts, so a resolve caused by Jira never transitions the ticket back. Reopening is not synced.

• Incidents and action items are linked but not auto-resolved.

Channel jira

A receiver of kind jira with public config {"installation_id": "..."} opens one ticket when an alert group first fires and comments as alerts fire and resolve (keyed on receiver and group key). It never closes the ticket.