Skip to main content
Strix connects natively to Jira Cloud. Strix can export the vulnerabilities that scans and PR reviews find as Jira issues, and keep the statuses synchronized in both directions. This page describes the setup, the OAuth scopes that Strix requests, the data that Strix and Jira exchange, and the disconnect procedure.

​
Overview

​
Setup

  1. In Strix, go to Settings → Integrations and click Connect on the Jira card. You must be an organization admin, and your plan must include ticketing integrations.
  2. Strix opens the standard Atlassian consent screen (auth.atlassian.com). Sign in with a Jira account that can browse projects and create issues in the target projects. Then approve the requested scopes.
  3. Atlassian redirects back to https://app.strix.ai/api/integrations/jira/callback. Strix exchanges the authorization code for tokens, records the Jira site (cloud ID and site URL), and registers a webhook for inbound status synchronization.
  4. In Strix, select a default project (and, if you want, a default issue type) as the export destination. You can also enable auto-sync with a minimum severity. Auto-sync exports new findings automatically.
If the authorizing Atlassian account has access to more than one Jira site, Strix connects the first accessible site. If you have more than one site, use an account that has access only to the applicable site.

​
OAuth scopes requested

Access tokens are short-lived. Strix refreshes them automatically with the rotating refresh token. All API calls go through https://api.atlassian.com/ex/jira/<cloudId>/rest/api/3 and apply only to the one connected site.

​
What data flows where

Strix → Jira (when you export a vulnerability manually, or when auto-sync exports it):
  • Issue summary: the vulnerability title (shortened to the Jira limit).
  • Issue description: severity, CVSS and CVE (when present), target, endpoint or affected file, impact, technical analysis, evidence, suggested fix or remediation steps, proof of concept, and a link back to the issue in Strix.
  • Priority mapped from severity, and a due date when an issue is snoozed.
  • Status comments (for example, “marked In Progress by …”) when the Strix status changes.
Jira → Strix (through a webhook on jira:issue_updated):
  • The issue ID and key, its status category (new, in progress, or done), the due date, and the display name of the user who made the change. Strix applies the status category to the status of the linked vulnerability.
Strix does not read existing Jira issues, attachments, comments, or user directories. Inbound processing applies only to status and due-date updates for the issues that Strix created.

​
Security

  • Admin-gated: The connect and callback endpoints require an authenticated Strix org admin. Strix checks the role again at the callback. Thus a demoted user cannot complete a pending connection.
  • CSRF-protected OAuth: The OAuth state is HMAC-signed and bound to the initiating organization and user. It expires after 10 minutes.
  • Webhook verification: Atlassian does not sign Jira dynamic webhooks. Thus the callback URL contains a per-connection random secret. Strix compares this secret (in a timing-safe operation) with the stored value before it processes a payload.
  • Token storage: Strix keeps the access and refresh tokens server-side in its database. The tokens apply only to your organization. The browser and other tenants cannot see them.
  • Revocation on disconnect: When you disconnect the integration, Strix deletes the webhook and revokes the Atlassian grant. Refresh-token revocation makes the full grant invalid. Thus no live tokens stay on the Atlassian side.
  • Audit trail: The Strix audit log records the connection of the integration and the changes to the settings.

​
Disconnecting

An org admin can disconnect Jira at any time from Settings → Integrations, or through the API:
Required scope: integrations:write The disconnect operation removes the stored tokens, deletes the Jira webhook, and revokes the OAuth grant. Strix does not delete the issues that it already created in Jira.