Atlassian Cloud Admin

Adds a resource to an existing Policy

This API can be used to grant Platform Roles to a user.

Registers a new approved-domain configuration for your organization, including the initial per-product configuration. Returns `201 Created` with the new configuration and a `Location` header pointing at the newly created resource. Use `ANYONE` as the domain to control access for users with any email address.

Create a policy for an org

Delete a policy for an org

Delete an existing Policy Resource

Delete a group from a directory if you don’t need this group anymore. This removes any app access and permissions granted by this group from all members. A member can still access an app if they’re in another group that grants access to the same app.

Remove a user from a group. This removes any app access and permissions granted by this group, but the user may still be in other groups that grant the same app access and permissions.

Remove a user from a directory if you don’t want them to appear in your directory or have access to your apps anymore. You’re not billed for a user once they’re removed. You must invite the user to your organization again if you want to reinstate their access to your apps. You’ll need to assign their roles and group memberships again.

Returns the app access settings configuration for a specific domain in your organization. Use `ANYONE` as the domain value to retrieve settings for users with any email address (no domain restriction).

Returns a page of directories in an organization that match the supplied parameters. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:directories:admin`

Returns detailed information about a specific user in a directory within an organization.

**This API is deprecated and will no longer work after June 30, 2027.** Use the [Search for users in an organization endpoint](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-users/#api-v2-orgs-orgid-directories-directoryid-users-search-post) instead. Return a page of users in your organization that match the supplied parameters. By default, returns users in all your directories. To get users in a directory only, use the `directoryIds` field. To get your managed accounts, regardless if they’re in a directory or not, use the `claimStatus` field. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:directories:admin`

Returns a count of users in an organization that match the supplied parameters. By default, users in all your directories and all your managed accounts are counted (including managed accounts that aren’t in a directory). To count users in a directory only, use the `directoryIds` field. To count your managed accounts, regardless if they’re in a directory or not, use the `claimStatus` field.

Returns information about a single verified domain by ID. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:domains:admin`

Returns a list of domains in an organization one page at a time. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:domains:admin`

Returns information localized event actions #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:events:admin`

Returns information about a single event by ID. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:events:admin`

Returns a filtered list of audit log events for an organization. Use this endpoint for more granular and detailed querying. If you simply need to paginate through all events, consider using the [/events-stream](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-events/#api-v1-orgs-orgid-events-stream-get) endpoint. These rate limits for this endpoint be lowered effective end of May 2025 as follows: - *Rate limit per user*: *10* requests per minute - *Rate limit per API path*: *10* requests per minute Please migrate to the polling API to guarantee uninterrupted service for use cases involving a high request rate. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:events:admin`

Returns the details of a group.

Returns a page of role assignments for a group that match the supplied parameters. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:groups:admin`

**This API is deprecated and will no longer work after June 30, 2027.** Use the [Search for groups in an organization endpoint](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-groups/#api-v2-orgs-orgid-directories-directoryid-groups-search-post) instead. Returns a page of groups in an organization that match the supplied parameters. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:groups:admin`

Returns the count of groups in an organization that match the supplied parameters.

Returns group stats for the organization.

Returns information about a single organization by ID #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:orgs:admin`

Returns a list of your organizations (based on your API key).

Returns information about org policies

Returns information about a single policy by ID

Returns a page of role assignments for a user that match the supplied parameters. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:directories:admin`

Return user stats for the organization. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:directories:admin`

Returns a list of managed accounts in an organization. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:accounts:admin`

**Additional response parameters of the API (for e.g., `added_to_org`) are available only to customers using the new user management experience.** Learn more about the [new user management experience](https://community.atlassian.com/t5/Atlassian-Access-articles/User-management-for-cloud-admins-just-got-easier/ba-p/1576592). Specifications: - Return a user’s last active date for each product listed in Atlassian Administration. - Active is defined as viewing a product's page for a minimum of 2 seconds. - The data for the last activity may be delayed by up to 24 hours. - If the user has not accessed a product, the `product_access` response field will be empty. Learn the fastest way to call the API with a detailed [tutorial](https://developer.atlassian.com/cloud/admin/organization/user-last-active-dates/).

Returns a paginated list of domain configurations for your organization's app access settings. Each domain can be configured to control who can access apps in your organization. Results are returned in alphabetical order by domain name. Use the `cursor` parameter to paginate through results. The special domain `ANYONE` represents users with any email address (no domain restriction).

Returns a paginated list of audit logs events for an organization. Use this endpoint if you want to retrieve events in a simple, paginated manner with time-based filtering. If you need more advanced filtering, refer to the [/events](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-events/#api-v1-orgs-orgid-events-get) endpoint. #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:events:admin`

Assign an organization-level role to a user. These are roles that have organization-wide privileges, like organization admin. This operation follows eventual consistency. Changes may take up to 30 seconds to be reflected after the operation is performed.

Remove an organization-level role from a user. These are roles that have organization-wide privileges, like organization admin. This operation follows eventual consistency. Changes may take up to 30 seconds to be reflected after the operation is performed.

Create a group in a directory to manage app access and permissions for multiple users together.

Add a user to a group. This gives the user the same app access and permissions as the group. The user must be in the same directory as the group. **Note:** Adding a user to the org-admin group through this API will return an error after the Units rollout. The org-admin group will no longer grant organization admin access after the rollout. To grant organization admin, use the [Assign organization-level role endpoint](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-users/#api-v1-orgs-orgid-users-userid-role-assignments-assign-post) instead. This applies to all organizations, not just unit organizations. You can’t add a user to a group synced from an identity provider. Manage this group in your identity provider instead. You can’t add a user to a group if you’ve exceeded your user limit for an app that the group grants access to. Increase your user limit or suspend another user from the app first.

Assign a role to a group to assign all members the same role.

Revoke a role from a group to remove access to an app from all members. A member can still access the app if they’re in another group that grants access to the same app.

Restore a user’s access in a directory to let them access apps again. They regain their roles and group memberships from before their access was suspended. We resume billing you for this user.

Suspend a user’s access in a directory to remove their access to apps temporarily. You’re not billed for a user when their access is suspended. They regain their roles and group memberships when you restore their access.

Invite people to your organization. When you invite someone: - they’re given app roles according to your invitation. - they’re added to directories based on apps in your invitation. - they’re added to groups according to your invitation. - they receive an email invitation if the `sendNotification` field is set to `true` and the `notificationText` field contains a message to include in the email invitation. **This API is only available to customers who have at least one paid subscription in their organization.**

A workspace refers to a specific instance of an Atlassian product that is accessed through a unique URL. Whenever a user initiates or adds a new product instance, it results in the creation of a distinct workspace. This API will: - Return a paginated list of workspaces in a given org - Return more details about an organization's products (including product URL). #### Scopes **[Authorization scopes](/cloud/admin/scopes/) required:** `read:workspaces:admin`

Replaces the full per-product configuration for a domain. Any product that was previously configured but is **not** in the request body will be removed. For partial updates (e.g. add or change a single product without disturbing the others), use `POST /v2/orgs/{orgId}/app-access-settings/domains/{domain}/products`.

This API can be used to revoke Platform Roles from a user.

Return a page of groups in an organization that match the supplied parameters. Use `searchTerm` for free-text search across group names. Filter by IDs, role assignments, resources, members, or specific group identifiers using the corresponding request fields. Use the `expand` field to include additional fields such as `counts.resources` and `counts.users` in the response.

Return a page of users in an organization that match the supplied parameters. Use `searchTerm` for free-text search across user display names and email addresses. Use `emails` for exact-match filtering by full email addresses. `searchTerm` and `emails` are mutually exclusive. Providing both in the same request returns `400 Bad Request`. Use the `expand` field to include additional fields such as `platformRoles`, `counts.resources`, `productAccess`, and `groups` in the response.

Update a policy for an org

Update an existing Policy Resource

Adds or replaces a single product's access configuration on a domain. Other products configured on the domain are left untouched (this is a partial update). Use this endpoint when you want to configure or change one product without re-sending the entire product list.

Validate a policy based on specific requirements. For example, Trigger CDEN validation by pushing a task into the SQS dns-validation queue