Jira Integration

​

Overview

​

Setup

1. In Strix, go to Settings → Integrations and click Connect on the Jira card. You must be an organization admin, and your plan must include ticketing integrations.
2. Strix opens the standard Atlassian consent screen (auth.atlassian.com). Sign in with a Jira account that can browse projects and create issues in the target projects. Then approve the requested scopes.
3. Atlassian redirects back to https://app.strix.ai/api/integrations/jira/callback. Strix exchanges the authorization code for tokens, records the Jira site (cloud ID and site URL), and registers a webhook for inbound status synchronization.
4. In Strix, select a default project (and, if you want, a default issue type) as the export destination. You can also enable auto-sync with a minimum severity. Auto-sync exports new findings automatically.
5. Optional: route findings to other projects. Under Route by source, select a project for pentests, PR reviews, or supply-chain findings. Under Route by repository, select a project for findings from one repository. Both cards sit under Advanced on the settings page and are collapsed by default. See Route tickets.

​

Route tickets

1. The destination that you select in the export dialog.
2. The repository route of the repository that the finding belongs to.
3. The source route of the finding source.
4. The default project.

​

Route by source

​

Route by repository

​

Required fields on routed projects

​

Set routes through the API

curl -X PATCH "https://app.strix.ai/api/v1/integrations/jira/settings" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "source_routes": {
      "supply_chain": {
        "collection_id": "<JIRA_PROJECT_ID>",
        "collection_name": "Dependencies",
        "ticket_type": "Bug",
        "jira_field_values": { "customfield_10001": { "value": "<TEAM_ID>", "label": "Platform" } }
      }
    },
    "repository_routes": [
      { "repository_id": "<REPOSITORY_ID>", "collection_id": "<JIRA_PROJECT_ID>", "collection_name": "Payments" }
    ]
  }'

​

Ticket defaults

​

Default assignee

​

Title and description templates

​

Group tickets by pentest

​

Preview and test ticket

​

Set defaults through the API

curl -X PATCH "https://app.strix.ai/api/v1/integrations/jira/settings" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "default_assignee_id": "<JIRA_ACCOUNT_ID>",
    "title_template": "[{{severity}}] {{title}}",
    "description_template": "{{details}}\n\nStrix: {{strix_url}}",
    "group_by_pentest": true
  }'

​

OAuth scopes requested

​

What data flows where

• Issue summary: the vulnerability title (shortened to the Jira limit).
• Issue description: severity, CVSS and CVE (when present), target, endpoint or affected file, impact, technical analysis, evidence, suggested fix or remediation steps, proof of concept, and a link back to the issue in Strix.
• Priority mapped from severity, and a due date when an issue is snoozed.
• Status comments (for example, “marked In Progress by …”) when the Strix status changes.

• The issue ID and key, its status category (new, in progress, or done), the due date, and the display name of the user who made the change. Strix applies the status category to the status of the linked vulnerability.

​

Security

• Admin-gated: The connect and callback endpoints require an authenticated Strix org admin. Strix checks the role again at the callback. Thus a demoted user cannot complete a pending connection.
• CSRF-protected OAuth: The OAuth state is HMAC-signed and bound to the initiating organization and user. It expires after 10 minutes.
• Webhook verification: Atlassian does not sign Jira dynamic webhooks. Thus the callback URL contains a per-connection random secret. Strix compares this secret (in a timing-safe operation) with the stored value before it processes a payload.
• Token storage: Strix keeps the access and refresh tokens server-side in its database. The tokens apply only to your organization. The browser and other tenants cannot see them.
• One webhook URL per Atlassian account: Atlassian accepts one webhook URL for each Atlassian account and OAuth app. If the account that connects Jira already sends Strix webhooks from another Strix workspace, the connection completes without the webhook. Exports work, but Jira status changes do not flow back. The Integrations page shows Connected, status sync off. To enable the sync, disconnect Jira in the other workspace, then reconnect it here.
• Revocation on disconnect: When you disconnect the integration, Strix deletes the webhook and revokes the Atlassian grant. Refresh-token revocation makes the full grant invalid. Thus no live tokens stay on the Atlassian side.
• Audit trail: The Strix audit log records the connection of the integration and the changes to the settings.

​

Self-hosted Jira (on-prem Strix only)

1. In Jira, create a personal access token under Profile → Personal Access Tokens. The token owner must be able to create issues in the target projects.
2. In Strix, click Connect on the Jira card and select Self-hosted Jira.
3. Enter the instance URL (for example https://jira.internal.example.com) and the token. Then click Connect.

curl -X POST "https://<your-strix-host>/api/v1/integrations/jira/server/connect" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"instance_url": "https://jira.internal.example.com", "access_token": "<JIRA_PERSONAL_ACCESS_TOKEN>"}'

​

Disconnecting

curl -X DELETE "https://app.strix.ai/api/v1/integrations/jira" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"