Jira Data Center Source

What it ingests

Issue activity from self-hosted Jira Data Center — issues and their comments — optionally scoped to specific projects or narrowed with an extra JQL filter.

This is a sibling of the Jira Cloud source, not a mode of it. Cloud uses /rest/api/3/search/jql and email + Atlassian API token Basic; Data Center still uses classic /rest/api/2/search (startAt / total) and a Personal Access Token. Pointing the Cloud source at a DC instance fails or under-fetches. external_id is namespaced jira-dc:… so a Cloud site and a DC site in one org cannot collide.

Jira Server (EOL) is not supported. Verified against Jira Software Data Center 11.3.10.

Credential

References an atlassian_dc_pat credential by id. The secret is a Jira Data Center personal access token — opaque, no ATATT prefix. The same vault type works for Confluence Data Center; Cloud API tokens (jira_api_token) are a different product and will not authenticate here.

bash

curl -sS -X POST https://your-corveil-host/api/credentials \
  -H "Authorization: Bearer <admin>" -H "Content-Type: application/json" \
  -d '{"type":"atlassian_dc_pat","name":"intranet-jira-pat","secret":"<pat>"}'

Config fields

Key	Required	Notes
`site_url`	yes	Base URL of the instance, including any context path, e.g. `https://intranet.example.com/jira`. Query strings, fragments, and userinfo are rejected. HTTPS only except loopback (`localhost`, `127.0.0.1`, `::1`).
`username`	no	Leave empty to send `Authorization: Bearer <pat>` (typical). Set it only if the instance expects HTTP Basic (`username:PAT`). Rejected if it contains `:` or a newline.
`project_keys`	no	Comma-separated project keys, e.g. `ENG, OPS`. Blank ingests every project the token can read.
`jql_filter`	no	Optional JQL clauses ANDed into every poll, e.g. `labels = engineering`. Interpolated verbatim into queries scoped to this source's own token/instance; a malformed fragment surfaces as a Jira `400`.

Provider-side setup

Sign in to Jira Data Center as the account that should own the token.
Create a personal access token: Profile → Personal Access Tokens → Create token. Copy it once; Jira will not show it again.
Make sure that account can view the projects you want to ingest.
Confirm Corveil can reach the instance over HTTPS. Air-gapped deployments typically trust an internal CA; plaintext HTTP is not the air-gap path.

Wire-up

POST /api/sensors

json

{
  "sensor_type": "jira_datacenter",
  "name": "Intranet Jira",
  "config": {
    "site_url": "https://intranet.example.com/jira",
    "project_keys": "ENG, OPS"
  },
  "credentials": { "pat": "<atlassian_dc_pat credential id>" }
}

If your instance requires HTTP Basic instead of Bearer, add "username": "jdoe" to config.

Verify

Run Test connection to confirm the site URL and PAT authenticate (/rest/api/2/myself). Once polling, created and updated issues in the selected projects appear as task events.

Notes

First poll. A new source seeds its watermark to "now" and emits nothing on the first tick, so adding a source does not drag in every historical issue. Use backfill to ingest history.

Auth scheme. Empty username → Bearer. Set username → Basic username:pat. Do not store the PAT in config; it lives in the vault.

Out of scope. Webhooks, OAuth 3LO, and Sprint as a first-class entity.

Jira Data Center Source ​

What it ingests ​

Credential ​

Config fields ​

Provider-side setup ​

Wire-up ​

Verify ​

Notes ​