> ## Documentation Index
> Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Jira Integration

> Sync ZeroPath findings with Jira for streamlined issue tracking and remediation workflows

## Overview

ZeroPath integrates with Jira to push security findings as Jira issues and sync status changes back. When a Jira issue is resolved, the corresponding ZeroPath finding is automatically marked as resolved. Both **Jira Cloud** and **Jira Data Center** (self-hosted) are supported.

<Info>An organization can connect either Jira Cloud **or** Jira Data Center — not both at the same time. Disconnect the existing integration before switching between the two.</Info>

## Setup

<Tabs>
  <Tab title="OAuth (Recommended — Cloud)">
    <Steps>
      <Step title="Navigate to Integrations">
        Go to **Settings → Integrations** in the ZeroPath dashboard.
      </Step>

      <Step title="Connect Jira">
        Click **"Connect Jira"** and authorize ZeroPath in the Atlassian consent screen.
      </Step>

      <Step title="Auto-Configuration">
        ZeroPath automatically detects your Jira Cloud instance and default project.
      </Step>
    </Steps>
  </Tab>

  <Tab title="API Token (Cloud)">
    <Steps>
      <Step title="Navigate to Integrations">
        Go to **Settings → Integrations** and select **"Connect with API Token"**.
      </Step>

      <Step title="Enter Credentials">
        Provide your **email**, **Jira API token** (from [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens)), and **Jira subdomain** (e.g., `mycompany` for `mycompany.atlassian.net`).
      </Step>

      <Step title="Validate & Connect">
        ZeroPath validates your credentials and connects.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Personal Access Token (Data Center)">
    <Steps>
      <Step title="Prerequisites">
        Your Jira Data Center instance must be version **8.14 or later**. Personal Access Tokens are not available on earlier versions or on Jira Cloud.
      </Step>

      <Step title="Navigate to Integrations">
        Go to **Settings → Integrations** and select **"Connect with Personal Access Token"**.
      </Step>

      <Step title="Allow ZeroPath through your firewall">
        ZeroPath connects to your Jira instance from a fixed set of egress IPs. Add these IPs to your network allowlist so ZeroPath can reach your instance and receive its webhooks. The current egress IPs are shown in the connection dialog; contact ZeroPath support if they are not displayed.
      </Step>

      <Step title="Enter Credentials">
        Provide your Jira Data Center **base URL** (e.g., `https://jira.mycompany.com` or `https://jira.mycompany.com/jira` if Jira is mounted at a context path) and your **Personal Access Token** (generated in your Jira profile under **Profile → Personal Access Tokens**).

        If your instance uses a self-signed or internal CA certificate, paste the **CA certificate bundle** (PEM format) in the optional field so ZeroPath can establish a trusted TLS connection.
      </Step>

      <Step title="Validate & Connect">
        ZeroPath validates the token, confirms the instance is on-prem and meets the version requirement, then saves the integration.
      </Step>
    </Steps>
  </Tab>
</Tabs>

<Info>All three methods register a webhook in your Jira instance for bidirectional sync. OAuth connections use the dynamic webhook API. API token and Personal Access Token connections use the legacy Jira admin webhooks API, which registers the webhook automatically when the user is a Jira admin. If auto-registration is not possible (for example, because the PAT belongs to a non-admin user), the setup flow returns the webhook URL and secret so you can create it manually in Jira's admin settings.</Info>

### Webhook Events

The ZeroPath webhook uses the following Jira events:

| Event                | Required | Purpose                                     |
| -------------------- | -------- | ------------------------------------------- |
| `jira:issue_updated` | Yes      | Syncs issue status changes back to ZeroPath |
| `comment_created`    | No       | Syncs ticket comments for smarter triage    |
| `comment_updated`    | No       | Keeps synced comments up to date            |

The comment events are optional but recommended. When enabled, ZeroPath uses ticket comments to intelligently classify closed tickets as **Resolved**, **False Positive**, or **Accepted Risk** instead of always defaulting to Resolved.

## Manual Issue Export

From any finding in the ZeroPath dashboard:

1. Click **"Export to Jira"** on the issue detail view.
2. Select a **Jira project**, **issue type** (Bug, Story, Task, etc.), and optionally an **epic** and **assignee**. Epics are available for all issue types, not just Tasks.
3. ZeroPath creates the Jira issue with full vulnerability details — title, description, affected file, severity, CVSS score, CWEs, code snippet, and patch link if available. For secrets findings, the title, description, and code snippet are automatically redacted so that cleartext secret values are never written into Jira tickets. The title is replaced with a generic label identifying only the affected file, and the description is withheld entirely.

If the selected issue type does not support a parent link (for example, Epics cannot have a parent in Jira's hierarchy), ZeroPath automatically retries without the epic link so the issue is still created successfully.

The Jira issue key is linked to the ZeroPath finding for bidirectional tracking.

### Bulk Export

You can export multiple findings to Jira at once:

1. Select the findings you want to export from the issues list.
2. Choose **"Export to Jira"** from the bulk actions menu.
3. Select a **Jira project**, **issue type**, and optionally an **epic** and **assignee**. You can select "None" to explicitly clear the epic selection.
4. If a Jira template is configured, you can toggle **"Use Jira Template"** to apply it to all exported issues.
5. ZeroPath creates Jira issues for all selected findings in batches. Titles, descriptions, and code snippets for secrets findings are automatically redacted in all created tickets.

Findings that have already been exported to Jira are automatically skipped. After the export completes, you will see a summary showing how many issues were exported, skipped, or failed.

## Automatic Ticketing

Configure automatic issue creation for new findings:

1. Go to **Settings → Integrations**, select **Jira** from the sidebar, and open **Auto-Ticketing**.
2. Set a **score threshold** — only findings above this score create Jira tickets.
3. Choose which **scan types** trigger tickets (Full Scan, PR Scan, SCA, etc.).
4. Select the **Jira project** and **issue type**.
5. Optionally select an **epic** to group auto-created tickets under. If a previously configured epic is no longer available in Jira, a warning is displayed so you can select a new one or clear the selection.
6. Optionally configure **auto-assignment**, **custom templates**, and **scope** (all repos, specific repos, or repos matching specific tags).

Titles, descriptions, and code snippets for secrets findings are automatically redacted in all auto-created tickets, so cleartext secret values are never written into Jira.

### SLA Due Dates

Enable **Set due date from SLA** to stamp each created ticket with the finding's remediation deadline as the Jira **due date** — the earliest breach date across every [SLA policy](/docs/platform/sla) that covers the issue. This applies to both auto-created and manually exported tickets. If no SLA policy covers the finding, no due date is set.

<Note>
  The due date requires the selected issue type to expose a **Due date** field on its create screen. If it does not, ZeroPath warns you when saving the configuration and still creates tickets (without a due date). If Jira later rejects the due date for an individual ticket, ZeroPath retries without it so the ticket is still created.
</Note>

### Custom Templates

Auto-ticketing supports customizable title and description templates with variables:

* `{{severity}}`, `{{issueTitle}}`, `{{repositoryName}}`, `{{affectedFile}}`, `{{vulnClass}}`, and more.
* Custom Jira fields can be mapped to ZeroPath finding data or static values.

## Bidirectional Sync

When a Jira issue's status changes to **Done**, **Resolved**, **Closed**, or **Completed**, ZeroPath automatically:

* Analyzes ticket comments to determine the appropriate status — **Resolved**, **False Positive**, or **Accepted Risk**
* If no comments are present or comment events are not enabled, the finding defaults to **Resolved**
* If comments are present but the intent cannot be determined with confidence, the status change is skipped rather than defaulting to Resolved, preventing incorrect triage
* Records who made the change and when
* Logs the state transition in the finding's audit trail

When the same Jira ticket is linked to more than one ZeroPath finding (for example, because a finding was carried forward across successive scans), closing the ticket resolves all linked findings at once. Duplicate webhook deliveries for a ticket that was already closed are automatically skipped — this includes findings that were closed because they are no longer detected in the latest scan, so those findings are never incorrectly re-triaged when Jira echoes their ticket closure back.

ZeroPath selects the correct Jira workflow transition based on the target status. When marking a finding as **Resolved**, ZeroPath picks a completion transition (such as "Done") and avoids cancellation-style transitions like "Won't Do". When marking a finding as **False Positive** or **Accepted Risk**, ZeroPath prefers a cancellation-style transition if one is available. This ensures your Jira workflow states accurately reflect the triage decision.

When you change the status of multiple findings at once (for example, marking many issues as false positive), ZeroPath syncs each update to Jira with controlled concurrency to stay within Jira Cloud rate limits. If an individual ticket update fails, the remaining updates continue — partial failures are logged without blocking the bulk action.

This sync is powered by a webhook registered in your Jira instance during setup.

<Warning>
  Jira Cloud webhooks created via the dynamic API (used by OAuth connections) expire after **30 days**. ZeroPath automatically renews them, but if sync stops working, reconnect the integration from Settings → Integrations to refresh the webhook. Webhooks created via the legacy admin API (used by API token and Personal Access Token connections when the user is a Jira admin) do not expire. When you reconnect, ZeroPath automatically removes any stale webhooks — including those registered under an outdated secret or a previous public URL — before creating a new one.
</Warning>

## Confluence Access

The Jira Cloud integration also provides access to Confluence, since both products share the same Atlassian OAuth token. When Confluence is enabled, the AI AppSec Assistant can search and read your Confluence pages for security documentation, architecture context, and runbooks.

<Note>
  Confluence is only available with **Jira Cloud** connections (OAuth or API Token). Jira Data Center integrations do not support Confluence linkage.
</Note>

### Enabling Confluence

1. Connect Jira using either the OAuth or API Token method described above.
2. Once Jira is connected, a **Confluence** option appears in the integrations page. You can enable it directly from the **Add Integration** dialog with a single click — no additional authentication is required.
3. Alternatively, select **Confluence** from the integrations sidebar and toggle **Confluence Access** on.

No additional authentication is required — Confluence reuses your existing Atlassian OAuth token.

### Disabling Confluence

To disable Confluence access, select **Confluence** from the integrations sidebar and toggle **Confluence Access** off. This does not affect your Jira integration.

## Auto-Fix PR Templates

When a finding has a linked Jira ticket, ZeroPath's [auto-fix](/docs/scanning/auto-fix) templates can reference the ticket. You can use `{jira_id}`, `{jira_title}`, and `{jira_url}` placeholders in your PR title, PR description, branch name, and commit message templates to include the linked Jira ticket details in generated patch PRs. See [Jira Ticket References in Templates](/docs/scanning/auto-fix#jira-ticket-references-in-templates) for details.

## Repository Deletion

When a repository is deleted from ZeroPath, all Jira tickets that were synced for findings in that repository are automatically closed before the repository is removed. This happens as a best-effort step — if closing a ticket fails, the repository deletion still proceeds. Tickets created for findings in other repositories are not affected.

## Troubleshooting

<AccordionGroup>
  <Accordion title="&#x22;Jira integration not found&#x22;">
    Ensure the integration is connected in Settings → Integrations.
  </Accordion>

  <Accordion title="Bidirectional sync not working">
    For OAuth connections, check if the Jira webhook has expired (30-day limit) and reconnect the integration to refresh it. For API token and Personal Access Token connections, verify the webhook was auto-registered (the setup response indicates this) or create it manually in Jira admin. Also verify the Jira issue key matches a ZeroPath finding (the link is created during export).
  </Accordion>

  <Accordion title="&#x22;Failed to create Jira issue&#x22;">
    Check that the selected project and issue type exist in your Jira instance. Ensure required Jira fields are configured in the auto-ticketing settings.
  </Accordion>

  <Accordion title="Data Center connection errors">
    * **Invalid Personal Access Token** — Verify the token is active in your Jira profile under **Profile → Personal Access Tokens**. Tokens expire based on your Jira admin's policy.
    * **Version not supported** — Personal Access Tokens require Jira Data Center 8.14 or later. Check your instance version in **Jira Administration → System → System Info**.
    * **TLS certificate error** — If your instance uses a self-signed or private CA certificate, paste the CA bundle (PEM) in the optional CA certificate field during setup.
    * **Cannot reach Jira** — Ensure the base URL is correct and reachable over HTTPS. If your Jira is behind a firewall, make sure ZeroPath's egress IPs are added to your network allowlist (shown in the connection dialog). If your Jira is on a fully private network, contact ZeroPath support about self-hosted deployment options.
  </Accordion>
</AccordionGroup>