How to i disable REST API calls on JIRA, or prevent our private data from being exposed?

[James]

How to i limit REST API calls on JIRA, or prevent our private data from being exposed?

I've learned that I can't turn off the REST API all together as i would desire too, but how do i prevent our private information from being exposed? I've had developers and users reach out to our admin's b/c they can see our private info available in the REST API. 

i've spent way too much time mucking about in the admin trying to figure out how to manage this without any success. I see no mention of the API and/or how to manage how to suppress it via our user group settings. 

I would love to have some help, thanks in advance if someone can help us resolve this.

[Nic Brough -Adaptavist- · Accepted solution]

Jira can not work without the REST API, so there's no way to turn it off.

But it does restpect the permissions that you set for the UI.  If someone can see an issue in the REST API, then they can see it in the UI as well.

What are you trying to secure that you think is leaking out over REST?

[James]

in short our rest api, list our company name and individual users and some project tasks to anyone who browses it, and i would ideally like that to not be the case. 

[Nic Brough -Adaptavist-]

They can get the same from the UI too, you'd want to think about how to remove it from there as well.

[James]

in short our rest api, list our company name and individual users and some project tasks to anyone who browses it, and i would ideally like that to not be the case.