JSM connection

integrations:jira-service-management

An instance-level connection object: one Jira Service Management site the JSM integration reads from and writes to (integrations:jira-service-management). The admin surface is JsmIntegrationService (API v2, PostgreSQL-backed), gated on the /admin updatable determination; the CLI is opschain admin jsm-connections. Custody is reference-first: the record stores api_token_ref, a secret-vault:// address, or holds an inline token encrypted at rest, and no read, audit row or error ever returns token material.

Data dictionary

Field	Meaning
id	The row id (UUID).
code	The estate code (1-64 of a-z0-9_-, immutable) the connection is addressed by.
display_name	Human-readable name.
base_url	The site's absolute http(s) base URL — an Atlassian cloud site (https://yoursite.atlassian.net) or a Jira Data Center base URL; trailing slashes normalise away.
auth_email	The Atlassian account email the API token belongs to. Set: cloud-style basic authentication. Empty: the credential is a Data Center personal access token sent as a bearer. Never recorded on audit events (auth_mode carries the shape).
api_token_ref	The canonical secret-vault:// reference the API token / PAT lives at — an address, never a value. A supplied reference is resolved at write time (the write-time pin) and clears the at-rest token; empty when the token is held encrypted at rest.
api_token_set	Whether an API token / PAT is held — a pinned reference or an inline token encrypted at rest (the value is write-only).
api_token	Write-only (create/update requests only): an inline API token / PAT the server holds encrypted at rest on the record, clearing any reference; never echoed.
project_keys	The Jira project keys outbound writes are scoped to (upper-cased, de-duplicated). A write to a request outside them refuses by name; empty means unscoped.
webhook_connection_code	The inbound-webhook connection Jira webhook ingestion was provisioned onto (empty until ProvisionJsmWebhook runs); deliveries POST to /api/hooks/<that code>.
enabled	Whether the connection serves outbound writes. Enabling re-checks the entitlement; disabling never gates.
last_test_at	When the dial-free record validation last ran (unset until the first test).
last_test_success	The last test verb's outcome.
last_test_error	Why the last validation failed (empty on success). Never token material.
created_at / updated_at	Row timestamps.

Related shapes

• JsmRequestLink (ListJsmRequestLinks): one jsm:request / jira:issue typed reference joined to the governed subject carrying it — run_id, run_kind, target_path, system, record_type, external_id, url, relationship, updated_at. Served per-row against the caller's read grant on target_path.
• The write verbs (CreateJsmRequestComment, TransitionJsmRequest, SetJsmRequestFields, ResolveJsmRequest) address requests by request_key (SUP-123) through a connection named by connection (or the single enabled connection). Comments are always JSM internal notes — no verb carries a visibility field.

See also

• opschain docs integrations-jsm — the whole integration.
• opschain docs cli/admin-jsm-connections — the CLI verbs.