> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Jira Service Management

> Connect Jira Service Management Operations for alert triage, on-call visibility, and incident sync during response

Connect Jira Service Management Operations to let CloudThinker agents triage alerts, see who is on call, and run the alert lifecycle during an incident. JSM Operations authenticates with an **Atlassian API token** tied to one account.

***

## Prerequisites

* A **Jira Service Management** site with **Operations** enabled. Operations ships on the Premium and Enterprise plans only.
* An **Atlassian account** that can open Operations on that site.
* An **Atlassian API token** from [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens).
* A CloudThinker workspace on the **Business** or **Enterprise** plan.

<Info>
  This is a separate connection from [Atlassian](/guide/connections/atlassian). Atlassian covers Jira issues and Confluence over Rovo; Operations is a different product with a different credential, so connect both if you want tickets and alerts.
</Info>

***

## Setup

<Steps>
  <Step title="Create an Atlassian API token">
    Go to [id.atlassian.com → Security → API tokens](https://id.atlassian.com/manage-profile/security/api-tokens) and click **Create API token**:

    * **Label**: `cloudthinker`
    * Click **Create**

    Copy the token immediately — Atlassian will not show it again.
  </Step>

  <Step title="Confirm Operations is reachable">
    Open your site and check that **Operations** appears in the JSM sidebar for the account you just created the token under. A site without Operations, or an account that cannot open it, fails the connection test.
  </Step>

  <Step title="Add the connection in CloudThinker">
    Navigate to **Connections → Jira Service Management** and enter:

    * **Site URL**: your Atlassian site, such as `https://acme.atlassian.net`
    * **Account email**: the account the token belongs to
    * **API token**: the token you just created

    Click **Connect**. CloudThinker resolves the site, calls Operations once to confirm access, and shows a **Connected** status.
  </Step>
</Steps>

<Warning>
  An API token carries the full permissions of its account. Create it under a dedicated account scoped to the teams CloudThinker needs, not a site admin.
</Warning>

***

## Connection details

| Field                | Description                                                  | Example                      |
| -------------------- | ------------------------------------------------------------ | ---------------------------- |
| **JSM\_SITE\_URL**   | Your Atlassian site. A pasted project or board URL works too | `https://acme.atlassian.net` |
| **JSM\_SITE\_EMAIL** | Atlassian account the API token belongs to                   | `oncall@acme.com`            |
| **JSM\_API\_TOKEN**  | Atlassian API token, not an account password                 | `ATATT3xFfGF0...`            |

***

## Required permissions

### Minimum (read-only)

An account with **Responder** access to the relevant teams provides:

* List alerts and read their timelines
* View who is on call now and upcoming rotations
* View schedules and escalation routing

### Recommended (full lifecycle)

Add **team admin** on the teams you want agents to act on:

* All read permissions
* Acknowledge, assign, and add responders
* Add notes, close, and escalate

<Tip>
  Follow least privilege: start with a Responder-level account for read-only triage, and grant team admin only on the teams where agents should write.
</Tip>

***

## Agent capabilities

Once connected, agents work alerts within the token account's team access.

| Capability          | Description                                                     |
| ------------------- | --------------------------------------------------------------- |
| **Alert triage**    | List open alerts, read timelines, spot repeat offenders         |
| **On-call lookup**  | See who is on call now and which schedule routed the page       |
| **Alert lifecycle** | Acknowledge, assign, add responders, and add notes              |
| **Escalation**      | Close an alert or escalate it to the next rung                  |
| **Incident sync**   | Keep a CloudThinker incident in step with the responder's alert |

Incident sync runs as a [Deep Response Engine](/guide/incident/overview) outcome. When a responder acknowledges the alert in JSM, the matching incident moves to **Acknowledged** — a responder owns it, and analysis has not started.

<Info>
  Closing and escalating always ask for your approval, even in Auto mode. Acknowledge, assign, add responder, and add note run under the incident's standing approval.
</Info>

### Verify the connection

```text theme={null}
@anna list open JSM alerts and report who is on call right now
```

### Example prompts

```text theme={null}
@anna list open JSM alerts and #report which service pages most often
@anna who is on call for the platform team, and what routed the last page?
@alex acknowledge the checkout latency alert and add a note with the deploy that preceded it
```

***

## Troubleshooting

<Accordion title="Account does not have access to Opsgenie">
  Authentication worked, so the token is good. Either the site's JSM plan does not include Operations, or the account cannot open it. Confirm **Operations** appears in the JSM sidebar for that account, then reconnect.
</Accordion>

<Accordion title="Authentication failed">
  The token is wrong, revoked, or paired with the wrong email. The email must be the account that created the token. Create a new token at id.atlassian.com and update the connection.
</Accordion>

<Accordion title="Site URL not resolving">
  CloudThinker resolves your site before calling Operations. Enter the site origin, such as `https://acme.atlassian.net` — a custom domain that does not front an Atlassian site fails here.
</Accordion>

<Accordion title="Alerts missing from results">
  The token account is not on the relevant teams. JSM scopes alerts by team, so add the account to every team whose alerts agents should see.
</Accordion>

<Accordion title="Incident status not updating">
  Incident sync needs the JSM outcome enabled for the incident. Open the incident's connections panel and confirm **Sync provider incident** is on.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Dedicated account** — issue the token from an account created for CloudThinker, so revoking it never locks out a person.
- **Team scoping** — an API token inherits everything its account can reach; keep that account on only the teams you want agents to touch.

***

## Related

<CardGroup cols={2}>
  <Card title="Atlassian Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/atlassian.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=64fcf0381646a233832602a9086a14eb" href="/guide/connections/atlassian" width="24" height="24" data-path="images/icons/atlassian.svg">
    Jira issues and Confluence knowledge
  </Card>

  <Card title="PagerDuty Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/pagerduty.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=cdc34a966d5d46da70c3bc509a2a7492" href="/guide/connections/pagerduty" width="24" height="24" data-path="images/icons/pagerduty.svg">
    On-call management and escalation
  </Card>
</CardGroup>