asApp() calls to JSM Ops API (schedules/on-calls) fail with 403 "Account does not have access to Opsgenie"

[OluwatomisinIsogun]

I’m building a Forge app (jira-issue-panel-ui-kit + scheduledTrigger template) that reads JSM
on-call schedules from a scheduled trigger to automate shift handoffs. The scheduled trigger
runs as asApp() (no user in session, per the documented behavior of scheduled triggers).

Calling the JSM ops API’s schedules endpoint fails consistently:

api.asApp().requestJira(route`/jsm/ops/api/v1/schedules`)

Error, every invocation since deploy:

Error: Schedules list failed (403): {"code":40301,"message":"Account does not have
access to Opsgenie.","took":0.027,"requestId":"..."}

Setup:

• Scope declared: read:ops-config:jira-service-management
• App installed on Jira product, scopes confirmed via forge install --confirm-scopes
• The dev site has a real JSM project (Basic IT service management template) with
  Operations enabled, a team, and an active on-call schedule with a rotation and overrides
  — all confirmed working correctly through the Jira UI as a logged-in human user
• The same schedule is fully visible/functional via the UI at /jira/ops/who-is-on-call

This looks like the same issue reported here with no resolution:

Service account API access to https://developer.atlassian.com/cloud/jira/service-desk-ops/rest/v2/api-group-alerts/#api-group-alerts

Hi all, I’m trying to switch from personal API credentials to pull alerts via The Jira Service Management ops REST API using basic auth however I’m getting “Account does not have access to Opsgenie“ which is very weird. I’ve gone through a few times setting various scopes as per Manage API tokens for service accounts | Atlassian Support but nothing seems to work - just get same result It’s as though the ghost of Opsgenie is still floating about and / or service accounts can’t be used to access…

Is asApp() simply unsupported for the JSM Ops API surface regardless of scope, and if so, is
offline user impersonation via a Forge Remote genuinely the only supported path for a
scheduled trigger to read on-call schedule state? Or is there a setup step (site-level
Operations/Opsgenie connection, additional scope, product access grant) that isn’t obvious
from the current docs?

Forge CLI 13.2.0, @forge/api 8.0.1, nodejs24.x runtime.

[ibuchanan]

Welcome to the Atlassian developer community @OluwatomisinIsogun,

I’ve been working on a reference implementation using the Jira Edge Connector (JEC): GitHub - ibuchanan/explore-forge-jira-edge-connector: Bridge Atlassian JSM to on-premise infrastructure via Forge and Jira Edge Connector (JEC) · GitHub

While it’s a different endpoint, it’s the same REST API, and I discovered the same limitation. Charitably, I think I can see the team was trying to explain that in the Permissions section for the API:

Permissions control the level of a user’s access to the Jira Service Management instance, while roles are how the permissions are assigned to individual users. For detailed information on roles and permissions, see Permissions overview and Setting up service desk users.

To use the Operations API, users must obtain either Global or Team roles depending on specific domain requirements.

Global Roles

• Admin - They are responsible for overall administration, including managing global settings, user accounts, and security settings. Give users admin permissions
• User - This standard role allows users to update their own information. Additionally, this role can be extended through the definition of custom roles. For more details, please refer to

Team Roles

• Team Admin - Members of your team that take this role can manage any kind of settings, configuration (schedule configuration, integration setup, etc.), and other users in the team. Learn more about Team Roles
• Team Member - Team members can only access the configurations that they’re part of, and they can only access the alerts that they have permission for.

I added some bolding to point out the permissions are user oriented and with tight binding to user permissions roles. The exclusion of “apps” in that is meant to express asApp() is not supported and only asUser(). Given we both hit the same problem, I’m sure it’s worthy of clarification.

@OluwatomisinIsogun

Is asApp() simply unsupported for the JSM Ops API surface regardless of scope

Yes, I confirm.

@OluwatomisinIsogun

is offline user impersonation via a Forge Remote genuinely the only supported path for a
scheduled trigger to read on-call schedule state?

Yes, I confirm.

@OluwatomisinIsogun

Or is there a setup step (site-level Operations/Opsgenie connection, additional scope, product access grant) that isn’t obvious from the current docs?

No, I’m unaware of any way Forge Apps could configure or work-around. I recommend user impersonation.