rest api: Adding Participant but with notifications DIisabled?

[llagos]

Hi Community,

We need to provide a mechanism for certain people to see the details of an issue via a link. So we're putting something like "for details click here" where "here" is the URL to the issue on the Portal. This may go on email footers and the intranet, but mostly on other systems that integrate with Jira Service Desk (fault managers, Call Center GUI, etc.).

We're thinking of adding that user as a Participant vía API when they click on "here". it works, as the user can after that, see the details of the issue in the Portal. Good.

However, doing this will enable the email notifications to the user so from the click onwards, the user will start receiving an email for every comment, status change, and so on, for that issue.

This is something we don't want. It has to be a read-only access, with no notifications.

The API for adding Participants doesn't have any parameters, so I'm lost as to how to do this.

Is there any easy way?

thanks a lot!

[Earl McCutcheon]

Hi there,

Jira Service Desk add participant REST API endpoint is covered here:

• servicedeskapi/request/{issueIdOrKey}/participant

But there are going to be some underlying issues with this approach as you need to collect data for the input value.  Collecting the users data for the POST statement is going to require remotely triggering a script and scraping for account details.  Pulling the details would also only work if they were logged into a system where that data could be collected from and this type of approach would usually be considered an attempted attack against the target system and possibly set off some security alarms on your recipients system. 

You could probably script something like this  to trigger a popup and ask for details but that brings you to the next issue as the data would need to be passed along with a user session that has the appropriate permissions to add a participant (only a Service Desk agent Admin could issue this).  Doing this either requires the link to contain a user session or the login credential of an authenticated user in plain text that could be collected and used by the recipient of the link to bypass your login security measures.  So only users that could launch the call would already have front end access to the issue.  But most importantly this would require opening up some security holes to implement.

In jira Service Desk there is already an invite option built into the customer portal via the Share option, or via e-mail by adding the user to the CC field as noted here:

• Adding request participants

Regards,
Earl

[llagos]

thanks Earl... the POST takes data in JSON format which is only the usernames, and since we have all systems integrated using ActiveDirectory, usernames are compatible across systems. So we just take the username from the remote system and send it in the POST.

For the no-notifications, i've found that I can call a method by URL, same URL that comes in the first notification email after I added a participant.. something like:

http://.../servicedesk/customer/portal/<sdID>/<issueID>/unsubscribe&jwt=....

However, I cann't find documentation for this URL and specifically how to form the jwt... I've decoded it online, for one case, and it does contain the username and some other info, so it seems this is the way to go... but again, no doc whatsoever...

Regards,