asApp() calls to JSM Ops API (schedules/on-calls) fail with 403 "Account does not have access to Opsgenie"

[ibuchanan]

Welcome to the Atlassian developer community @OluwatomisinIsogun,

I’ve been working on a reference implementation using the Jira Edge Connector (JEC): GitHub - ibuchanan/explore-forge-jira-edge-connector: Bridge Atlassian JSM to on-premise infrastructure via Forge and Jira Edge Connector (JEC) · GitHub

While it’s a different endpoint, it’s the same REST API, and I discovered the same limitation. Charitably, I think I can see the team was trying to explain that in the Permissions section for the API:

Permissions control the level of a user’s access to the Jira Service Management instance, while roles are how the permissions are assigned to individual users. For detailed information on roles and permissions, see Permissions overview and Setting up service desk users.

To use the Operations API, users must obtain either Global or Team roles depending on specific domain requirements.

Global Roles

• Admin - They are responsible for overall administration, including managing global settings, user accounts, and security settings. Give users admin permissions
• User - This standard role allows users to update their own information. Additionally, this role can be extended through the definition of custom roles. For more details, please refer to

Team Roles

• Team Admin - Members of your team that take this role can manage any kind of settings, configuration (schedule configuration, integration setup, etc.), and other users in the team. Learn more about Team Roles
• Team Member - Team members can only access the configurations that they’re part of, and they can only access the alerts that they have permission for.

I added some bolding to point out the permissions are user oriented and with tight binding to user permissions roles. The exclusion of “apps” in that is meant to express asApp() is not supported and only asUser(). Given we both hit the same problem, I’m sure it’s worthy of clarification.

@OluwatomisinIsogun

Is asApp() simply unsupported for the JSM Ops API surface regardless of scope

Yes, I confirm.

@OluwatomisinIsogun

is offline user impersonation via a Forge Remote genuinely the only supported path for a
scheduled trigger to read on-call schedule state?

Yes, I confirm.

@OluwatomisinIsogun

Or is there a setup step (site-level Operations/Opsgenie connection, additional scope, product access grant) that isn’t obvious from the current docs?

No, I’m unaware of any way Forge Apps could configure or work-around. I recommend user impersonation.