JSM connection

integrations:jira-service-management

An instance-level connection object: one Jira Service Management site the JSM integration reads from and writes to (integrations:jira-service-management). The admin surface is JsmIntegrationService (API v2, PostgreSQL-backed), gated on the /admin updatable determination; the CLI is opschain admin jsm-connections. Custody is reference-first: the record stores api_token_ref, a secret-vault:// address, and no read, audit row or error ever returns token material.

Data dictionary

Field	Meaning
id	The row id (UUID).
code	The estate code (1-64 of a-z0-9_-, immutable) the connection is addressed by.
display_name	Human-readable name.
base_url	The site's absolute http(s) base URL — an Atlassian cloud site (https://yoursite.atlassian.net) or a Jira Data Center base URL; trailing slashes normalise away.
auth_email	The Atlassian account email the API token belongs to. Set: cloud-style basic authentication. Empty: the credential is a Data Center personal access token sent as a bearer. Never recorded on audit events (auth_mode carries the shape).
api_token_ref	The canonical secret-vault:// reference the API token / PAT lives at — an address, never a value. A supplied reference is resolved at write time (the write-time pin); an inline token on create/update is vault-write sugar stored under jsm-connections/<code>/credential.
api_token	Write-only (create/update requests only): an inline API token / PAT the server vaults and pins; never echoed.
project_keys	The Jira project keys outbound writes are scoped to (upper-cased, de-duplicated). A write to a request outside them refuses by name; empty means unscoped.
webhook_connection_code	The inbound-webhook connection Jira webhook ingestion was provisioned onto (empty until ProvisionJsmWebhook runs); deliveries POST to /api/hooks/<that code>.
enabled	Whether the connection serves outbound writes. Enabling re-checks the entitlement; disabling never gates.
last_test_at	When the dial-free record validation last ran (unset until the first test).
last_test_success	The last test verb's outcome.
last_test_error	Why the last validation failed (empty on success). Never token material.
created_at / updated_at	Row timestamps.

Related shapes

• JsmRequestLink (ListJsmRequestLinks): one jsm:request / jira:issue typed reference joined to the governed subject carrying it — run_id, run_kind, target_path, system, record_type, external_id, url, relationship, updated_at. Served per-row against the caller's read grant on target_path.
• The write verbs (CreateJsmRequestComment, TransitionJsmRequest, SetJsmRequestFields, ResolveJsmRequest) address requests by request_key (SUP-123) through a connection named by connection (or the single enabled connection). Comments are always JSM internal notes — no verb carries a visibility field.

See also

• opschain docs integrations-jsm — the whole integration.
• opschain docs cli/admin-jsm-connections — the CLI verbs.