Atlassian service accounts

Use an Atlassian service account for Jira, Jira Service Management, and Confluence workflows. One credential can serve all three products on the same site when its account access and token scopes cover each product.

Setting up a Confluence knowledge base connector? Use the connector scope list. For Search, follow the Confluence Search service-account guide. Jira Search uses each teammate's OAuth account; a workflow service account does not replace that connection.

Create the account and token

An Atlassian organization admin completes these steps:

Open Atlassian Administration, select the organization, then Directory → Service accounts → Create service account.
Give the account access to the intended site's Jira and/or Confluence apps. Grant the project and space permissions its workflows need, including access to restricted content.
Select the service account, then Create credentials → API token → Next.
Name the token, set an expiry between 1 and 365 days, and select Next.
Select the scopes below for the products and operations you need. Review and create the token, then copy it. Atlassian shows it only once.

See Atlassian's service-account setup and token instructions.

Atlassian Administration credential selector with API token selected

Choose scopes

Start with the connection and read scopes for each product, then check the scope requirements for your workflow operations.

Jira and Jira Service Management

Code

read:jira-user
read:jira-work

read:jira-user covers the current-user check when you add the credential, including through Jira Service Management. Add read:servicedesk-request for Service Management requests.

Confluence

Code

read:confluence-user
read:confluence-content.all
read:confluence-space.summary
read:space:confluence
read:page:confluence

read:confluence-user covers the current-user check. The space picker needs read:space:confluence; page reads and the page picker need read:page:confluence.

Confluence knowledge base connectors

A Confluence knowledge base connector reads pages, blog posts, attachments, labels, and the space permissions and page restrictions it mirrors. Its service-account token needs every scope below, not only the Confluence scopes above:

Code

read:confluence-content.all
read:page:confluence
read:blogpost:confluence
read:attachment:confluence
read:space:confluence
read:label:confluence
search:confluence
read:confluence-space.summary
read:content.metadata:confluence
read:space.permission:confluence
read:confluence-user
read:user:confluence
read:group:confluence

Without read:attachment:confluence, pages still sync, but their PDF, Word, Excel, and PowerPoint attachments are not indexed and each sync reports a partial source listing. To fix a token that is missing scopes, create a replacement token with the full list. A credential admin then opens the credential in Integrations, selects Reconnect, and enters the new token and site domain. Connectors that use the credential keep using it.

Workflow actions

Add scopes for the actions your workflow performs:

Actions	Scopes to add
Create or update Jira issues	`write:jira-work`
Create or update Service Management requests	`write:servicedesk-request`
Manage Service Management customers	`manage:servicedesk-customer`
Create or update Confluence pages	`write:confluence-content`, `write:page:confluence`

Deletes, webhooks, Assets, and other operations can require additional scopes. Check the endpoint's complete scope set in the Jira, Jira Service Management, or Confluence API reference.

Use the App and Scope type filters to find both classic and granular scopes. Scopes and account permissions are separate: the account must also have access to the project, space, or content.

Atlassian scope picker with the Jira classic scopes read:jira-user and read:jira-work selected

Add the credential to Sim

Open Integrations in your workspace sidebar, then Jira, Jira Service Management, or Confluence.
Select Add to Sim → Add service account. If only service accounts are available, select Add service account directly.
Paste the API token and enter Site domain, such as your-team.atlassian.net. Omit https:// and any path. Optionally add a display name and description.
Select Add service account. Sim checks the token against the selected product's current-user endpoint; resolve any error before continuing.
In your workflow's Jira, Jira Service Management, or Confluence block, select the credential and configure the operation.

The credential appears on all three integration pages, but adding it only validates the selected product. Check account access and scopes before using another product.

Troubleshooting and rotation

Problem	What to check
Cannot add the credential	Use a scoped API token from Directory → Service accounts, verify its expiry and site, and include the selected product's current-user scope above.
Empty or failed picker	Include `read:jira-work` for Jira projects or `read:space:confluence` for Confluence spaces, and grant the account access to the selected site and content.
A workflow returns a scope or permission error	Check the operation's full scope list and the account's project/space permissions. Successful connection does not validate every operation.
Token expires or needs different scopes	Create a replacement token, add it as a new Sim service-account credential, and select it in the affected workflows. Test them before revoking the old token. Sim does not refresh pasted API tokens.
Data Center or Server host	This credential supports Atlassian Cloud only.

For a Search source, follow Confluence's service-account setup and replacement steps.