Given the fact that, Jira 11.X supports oAuth 2LO for Service Accounts, we need Xray REST APIs to support it as well

Description
Jira Data Center 11.x supports OAuth 2.0 for Service Accounts (2LO), allowing secure, non-interactive authentication for integrations and automation. However, Xray Data Center REST APIs currently do not support OAuth 2LO authentication.

As a result, customers attempting to access Xray APIs using a valid Jira OAuth 2LO token receive a 403 Forbidden response indicating that the resource is not allowed for 2LO access. While Xray functionality within the Jira UI remains unaffected because it relies on Jira session-based authentication, REST API consumers cannot leverage Jira's modern service-account authentication model when interacting with Xray APIs.

Supporting OAuth 2LO for Xray REST APIs would bring consistency with Jira DC authentication capabilities and simplify secure integrations, automation pipelines, and enterprise service-to-service communication.

User friction

• Customers adopting Jira DC 11.x OAuth 2LO authentication expect all Jira-installed applications to support the same authentication mechanism.
• REST API integrations with Xray require alternative authentication approaches, increasing implementation complexity.
• Organizations pursuing centralized authentication standards and service-account-based automation cannot fully utilize Jira's OAuth 2LO framework with Xray APIs.
• The current behavior is unexpected because Jira accepts the OAuth 2LO token while Xray endpoints reject it.
  Steps to reproduce (right now) / Actual Result:
• Configure OAuth 2.0 for Service Accounts (2LO) in Jira Data Center 11.x.
• Obtain a valid OAuth access token using the service account flow.
• Invoke any Xray Data Center REST API endpoint using the OAuth bearer token.
• Observe the API response.

Actual Result
**
 

{   "message": "This resource is not allowed for 2LO access.",   "status-code": 403,   "sub-code": -1 }

Expected Results:
The Xray REST API should honor valid Jira Data Center OAuth 2LO service-account tokens and authorize requests according to the permissions of the associated service account.
IMPACT

What would improve if solved:

• Enable modern service-to-service authentication for Xray integrations.
• Align Xray authentication capabilities with Jira Data Center 11.x.
• Simplify CI/CD, automation, reporting, and test-management integrations.
• Improve security posture by allowing organizations to standardize on OAuth 2.0 service accounts.
  Impact on stakeholders:
• DevOps Teams: Easier automation and CI/CD integration.
• QA/Test Automation Teams: Simplified access to Xray APIs for test execution and reporting.
• Security Teams: Greater alignment with enterprise authentication standards.
• Administrators: Reduced overhead managing multiple authentication methods across Jira and Xray.
  Current workaround:
  Use authentication methods currently supported by Xray REST APIs, such as session-based authentication or other supported credential mechanisms, instead of Jira OAuth 2LO service-account tokens.
  CONTEXT & EXAMPLES:
  Concrete example:
  An organization upgrades to Jira Data Center 11.x and standardizes all integrations on OAuth 2.0 service accounts. Internal applications can successfully authenticate against Jira APIs using 2LO tokens. However, when the same application attempts to retrieve Xray test executions, test plans, or test run information through Xray REST APIs, the request fails with:

  {   "message": "This resource is not allowed for 2LO access.",   "status-code": 403,   "sub-code": -1 }

  This forces the organization to maintain a separate authentication approach specifically for Xray integrations.
  Workaround risk:

• Requires maintaining multiple authentication models for a single Jira ecosystem.
• Increases operational and administrative complexity.
• May conflict with enterprise security policies favoring OAuth 2.0 service accounts.
• Creates additional maintenance burden for automation tools and integrations.
• Can delay or complicate migrations to Jira Data Center 11.x authentication standards.