Atlassian Cloud Admin integration
Atlassian Cloud Admin integration for AI agents.
Atlassian Cloud Admin integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Atlassian Cloud Admin tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.
What your agents can do
Real Atlassian Cloud Admin actions, managed and audited.
Your user connects Atlassian Cloud Admin once; your agent can then secure AI-agent actions — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.
- 1
Your user grants Atlassian Cloud Admin access once (OAuth) — the token lands in the vault.
- 2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
- 3
Every routed call appends a hash-chained audit record — nothing leaves your infra.
Tools & triggers
Supported Atlassian Cloud Admin tools.
52 tools are generated from the published Atlassian Cloud Admin catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.
Showing 52 tools. All published catalog entries are included in this page's server-rendered HTML.
- Add Resource to Policy
- Adds a resource to an existing Policy
- Policies
- Grant user access
- This API can be used to grant Platform Roles to a user.
- Users
- Create an app access settings domain
- Registers a new approved-domain configuration for your organization, including the initial per-product configuration. Returns `201 Created` with the new configuration and a `Location` header pointing at the newly created resource. Use `ANYONE` as the domain to control access for users with any email address.
- App Access Settings
- Create a policy
- Create a policy for an org
- Policies
- Delete a policy
- Delete a policy for an org
- Policies
- Delete Policy Resource
- Delete an existing Policy Resource
- Policies
- Delete group
- Delete a group from a directory if you don’t need this group anymore. This removes any app access and permissions granted by this group from all members. A member can still access an app if they’re in another group that grants access to the same app.
- Groups
- Remove user from group
- Remove a user from a group. This removes any app access and permissions granted by this group, but the user may still be in other groups that grant the same app access and permissions.
- Groups
- Remove user from directory
- Remove a user from a directory if you don’t want them to appear in your directory or have access to your apps anymore. You’re not billed for a user once they’re removed. You must invite the user to your organization again if you want to reinstate their access to your apps. You’ll need to assign their roles and group memberships again.
- Users
- Get app access settings for a domain
- Returns the app access settings configuration for a specific domain in your organization. Use `ANYONE` as the domain value to retrieve settings for users with any email address (no domain restriction).
- App Access Settings
- Get directories in an organization
- Returns a page of directories in an organization that match the supplied parameters. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:directories:admin`
- Directory
- Get details of a user in a directory
- Returns detailed information about a specific user in a directory within an organization.
- Users
- Get users in an organization
- **This API is deprecated and will no longer work after June 30, 2027.** Use the [Search for users in an organization endpoint](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-users/#api-v2-orgs-orgid-directories-directoryid-users-search-post) instead. Return a page of users in your organization that match the supplied parameters. By default, returns users in all your directories. To get users in a directory only, use the `directoryIds` field. To get your managed accounts, regardless if they’re in a directory or not, use the `claimStatus` field. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:directories:admin`
- Users
- Get count of users in an organization
- Returns a count of users in an organization that match the supplied parameters. By default, users in all your directories and all your managed accounts are counted (including managed accounts that aren’t in a directory). To count users in a directory only, use the `directoryIds` field. To count your managed accounts, regardless if they’re in a directory or not, use the `claimStatus` field.
- Users
- Get domain by ID
- Returns information about a single verified domain by ID. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:domains:admin`
- Domains
- Get domains in an organization
- Returns a list of domains in an organization one page at a time. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:domains:admin`
- Domains
- Get list of event actions
- Returns information localized event actions #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:events:admin`
- Events
- Get an event by ID
- Returns information about a single event by ID. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:events:admin`
- Events
- Query audit log events
- Returns a filtered list of audit log events for an organization. Use this endpoint for more granular and detailed querying. If you simply need to paginate through all events, consider using the [/events-stream](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-events/#api-v1-orgs-orgid-events-stream-get) endpoint. These rate limits for this endpoint be lowered effective end of May 2025 as follows: - *Rate limit per user*: *10* requests per minute - *Rate limit per API path*: *10* requests per minute Please migrate to the polling API to guarantee uninterrupted service for use cases involving a high request rate. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:events:admin`
- Events
- Get group details
- Returns the details of a group.
- Groups
- Get group role assignments
- Returns a page of role assignments for a group that match the supplied parameters. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:groups:admin`
- Groups
- Get groups in an organization
- **This API is deprecated and will no longer work after June 30, 2027.** Use the [Search for groups in an organization endpoint](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-groups/#api-v2-orgs-orgid-directories-directoryid-groups-search-post) instead. Returns a page of groups in an organization that match the supplied parameters. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:groups:admin`
- Groups
- Get the count of groups in an organization
- Returns the count of groups in an organization that match the supplied parameters.
- Groups
- Get group stats
- Returns group stats for the organization.
- Groups
- Get an organization by ID
- Returns information about a single organization by ID #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:orgs:admin`
- Orgs
- Get organizations
- Returns a list of your organizations (based on your API key).
- Orgs
- Get list of policies
- Returns information about org policies
- Policies
- Get a policy by ID
- Returns information about a single policy by ID
- Policies
- Get user role assignments
- Returns a page of role assignments for a user that match the supplied parameters. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:directories:admin`
- Users
- Get user stats in an organization
- Return user stats for the organization. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:directories:admin`
- Users
- Get managed accounts in an organization
- Returns a list of managed accounts in an organization. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:accounts:admin`
- Users
- User’s last active dates
- **Additional response parameters of the API (for e.g., `added_to_org`) are available only to customers using the new user management experience.** Learn more about the [new user management experience](https://community.atlassian.com/t5/Atlassian-Access-articles/User-management-for-cloud-admins-just-got-easier/ba-p/1576592). Specifications: - Return a user’s last active date for each product listed in Atlassian Administration. - Active is defined as viewing a product's page for a minimum of 2 seconds. - The data for the last activity may be delayed by up to 24 hours. - If the user has not accessed a product, the `product_access` response field will be empty. Learn the fastest way to call the API with a detailed [tutorial](https://developer.atlassian.com/cloud/admin/organization/user-last-active-dates/).
- Users
- List app access settings domains
- Returns a paginated list of domain configurations for your organization's app access settings. Each domain can be configured to control who can access apps in your organization. Results are returned in alphabetical order by domain name. Use the `cursor` parameter to paginate through results. The special domain `ANYONE` represents users with any email address (no domain restriction).
- App Access Settings
- Poll audit log events
- Returns a paginated list of audit logs events for an organization. Use this endpoint if you want to retrieve events in a simple, paginated manner with time-based filtering. If you need more advanced filtering, refer to the [/events](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-events/#api-v1-orgs-orgid-events-get) endpoint. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:events:admin`
- Events
- Assign organization-level role
- Assign an organization-level role to a user. These are roles that have organization-wide privileges, like organization admin. This operation follows eventual consistency. Changes may take up to 30 seconds to be reflected after the operation is performed.
- Users
- Remove organization-level role
- Remove an organization-level role from a user. These are roles that have organization-wide privileges, like organization admin. This operation follows eventual consistency. Changes may take up to 30 seconds to be reflected after the operation is performed.
- Users
- Create group
- Create a group in a directory to manage app access and permissions for multiple users together.
- Groups
- Add user to group
- Add a user to a group. This gives the user the same app access and permissions as the group. The user must be in the same directory as the group. **Note:** Adding a user to the org-admin group through this API will return an error after the Units rollout. The org-admin group will no longer grant organization admin access after the rollout. To grant organization admin, use the [Assign organization-level role endpoint](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-users/#api-v1-orgs-orgid-users-userid-role-assignments-assign-post) instead. This applies to all organizations, not just unit organizations. You can’t add a user to a group synced from an identity provider. Manage this group in your identity provider instead. You can’t add a user to a group if you’ve exceeded your user limit for an app that the group grants access to. Increase your user limit or suspend another user from the app first.
- Groups
- Grant access to group
- Assign a role to a group to assign all members the same role.
- Groups
- Remove access from group
- Revoke a role from a group to remove access to an app from all members. A member can still access the app if they’re in another group that grants access to the same app.
- Groups
- Restore user access in directory
- Restore a user’s access in a directory to let them access apps again. They regain their roles and group memberships from before their access was suspended. We resume billing you for this user.
- Users
- Suspend user access in directory
- Suspend a user’s access in a directory to remove their access to apps temporarily. You’re not billed for a user when their access is suspended. They regain their roles and group memberships when you restore their access.
- Users
- Invite users to an organization
- Invite people to your organization. When you invite someone: - they’re given app roles according to your invitation. - they’re added to directories based on apps in your invitation. - they’re added to groups according to your invitation. - they receive an email invitation if the `sendNotification` field is set to `true` and the `notificationText` field contains a message to include in the email invitation. **This API is only available to customers who have at least one paid subscription in their organization.**
- Users
- Get list of workspaces
- A workspace refers to a specific instance of an Atlassian product that is accessed through a unique URL. Whenever a user initiates or adds a new product instance, it results in the creation of a distinct workspace. This API will: - Return a paginated list of workspaces in a given org - Return more details about an organization's products (including product URL). #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:workspaces:admin`
- Workspaces
- Replace app access settings for a domain
- Replaces the full per-product configuration for a domain. Any product that was previously configured but is **not** in the request body will be removed. For partial updates (e.g. add or change a single product without disturbing the others), use `POST /v2/orgs/{orgId}/app-access-settings/domains/{domain}/products`.
- App Access Settings
- Revoke user access
- This API can be used to revoke Platform Roles from a user.
- Users
- Search for groups in an organization
- Return a page of groups in an organization that match the supplied parameters. Use `searchTerm` for free-text search across group names. Filter by IDs, role assignments, resources, members, or specific group identifiers using the corresponding request fields. Use the `expand` field to include additional fields such as `counts.resources` and `counts.users` in the response.
- Groups
- Search for users in an organization
- Return a page of users in an organization that match the supplied parameters. Use `searchTerm` for free-text search across user display names and email addresses. Use `emails` for exact-match filtering by full email addresses. `searchTerm` and `emails` are mutually exclusive. Providing both in the same request returns `400 Bad Request`. Use the `expand` field to include additional fields such as `platformRoles`, `counts.resources`, `productAccess`, and `groups` in the response.
- Users
- Update a policy
- Update a policy for an org
- Policies
- Update Policy Resource
- Update an existing Policy Resource
- Policies
- Add or update a single product configuration on a domain
- Adds or replaces a single product's access configuration on a domain. Other products configured on the domain are left untouched (this is a partial update). Use this endpoint when you want to configure or change one product without re-sending the entire product list.
- App Access Settings
- Validate Policy
- Validate a policy based on specific requirements. For example, Trigger CDEN validation by pushing a task into the SQS dns-validation queue
- PoliciesValidate
FAQ
Atlassian Cloud Admin integration, answered
- How do AI agents use Atlassian Cloud Admin through Open Connector?
- Your user connects Atlassian Cloud Admin once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Atlassian Cloud Admin tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
- Is this a Atlassian Cloud Admin MCP server?
- Yes. Open Connector can serve Atlassian Cloud Admin as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Atlassian Cloud Admin actions with credentials injected server-side.
- Where do Atlassian Cloud Admin credentials live?
- In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.
Give your agents Atlassian Cloud Admin — keep the keys.
Open source, self-hostable, with Atlassian Cloud Admin credentials that never leave your infrastructure. Run it from source today.