# Jira Connect App test the \`ACCESS\_EMAIL\_ADDRESSES\` scope without being whitelisted

**URL:** <https://community.developer.atlassian.com/t/jira-connect-app-test-the-access-email-addresses-scope-without-being-whitelisted/68979>\
**Category:** Jira Cloud\
**Tags:** gdpr, scopes, email, atlassian-connect\
**Created:** [May 1, 2023, 11:00pm UTC](https://community.developer.atlassian.com/t/jira-connect-app-test-the-access-email-addresses-scope-without-being-whitelisted/68979 "2023-05-01T23:00:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![SidBidasaria](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@SidBidasaria](https://community.developer.atlassian.com/u/SidBidasaria)\
**Post date:** [May 1, 2023, 11:00pm UTC](https://community.developer.atlassian.com/t/jira-connect-app-test-the-access-email-addresses-scope-without-being-whitelisted/68979/1 "2023-05-01T23:00:46Z")

</div>

Hi there,

I’m trying to test out the `ACCESS_EMAIL_ADDRESSES` scope for a connect app on a dev instance of jira. However the moment I `ACCESS_EMAIL_ADDRESSES` to the scope, the app fails to install with the following error:

```auto
Could not install the file https://91d3-35-236-90-71.ngrok-free.app/atlassian-connect.json. Check that the file is valid.

```

Is there a way for me to test this endpoint on a dev instance of jira without first being whitelisted for the endpoint? My team is getting the rest of the information required for whitelisting (privacy policy, etc) ready but I do not want to block development on that.

For more context, this atlassian-connect.json file fails to install because it requests the ACCESS\_EMAIL\_ADDRESSE scope:

```auto
{
  "name": "Hello World",
  "description": "Atlassian Connect app",
  "key": "com.riadalabs.jira.plugins.notificationassistant",
  "baseUrl": "https://91d3-35-236-90-71.ngrok-free.app",
  "vendor": {
    "name": "Example, Inc.",
    "url": "http://example.com"
  },
  "authentication": {
    "type": "jwt"
  },
  "lifecycle": {
    "installed": "/install",
    "uninstalled": "/uninstall"
  },
  "scopes": [
    "read",
    "ACCESS_EMAIL_ADDRESSES"
  ],
  "apiVersion": 1,
  "modules": {
    "generalPages": [
      {
        "url": "/helloworld.html",
        "key": "hello-world",
        "location": "system.top.navigation.bar",
        "name": {
          "value": "Greeting"
        }
      }
    ]
  }
}

```

And this file is identical to the one above, except that it does not request the ACCESS\_EMAIL\_ADDRESSES scope.

```auto
{
  "name": "Hello World",
  "description": "Atlassian Connect app",
  "key": "com.riadalabs.jira.plugins.notificationassistant",
  "baseUrl": "https://91d3-35-236-90-71.ngrok-free.app",
  "vendor": {
    "name": "Example, Inc.",
    "url": "http://example.com"
  },
  "authentication": {
    "type": "jwt"
  },
  "lifecycle": {
    "installed": "/install",
    "uninstalled": "/uninstall"
  },
  "scopes": [
    "read"
  ],
  "apiVersion": 1,
  "modules": {
    "generalPages": [
      {
        "url": "/helloworld.html",
        "key": "hello-world",
        "location": "system.top.navigation.bar",
        "name": {
          "value": "Greeting"
        }
      }
    ]
  }
}

```

Can someone please clarify this for me? Thank you!

---

<div class="post-metadata">

**Author:** ![SidBidasaria](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@SidBidasaria](https://community.developer.atlassian.com/u/SidBidasaria)\
**Post date:** [May 1, 2023, 11:03pm UTC](https://community.developer.atlassian.com/t/jira-connect-app-test-the-access-email-addresses-scope-without-being-whitelisted/68979/2 "2023-05-01T23:03:25Z")

</div>

@ibuchanan would you happen to have any insight here? Thanks!

---

<div class="post-metadata">

**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\
**Post date:** [May 1, 2023, 11:25pm UTC](https://community.developer.atlassian.com/t/jira-connect-app-test-the-access-email-addresses-scope-without-being-whitelisted/68979/3 "2023-05-01T23:25:12Z")

</div>

> [@SidBidasaria](#):
>
> Is there a way for me to test this endpoint on a dev instance of jira without first being whitelisted for the endpoint?

Not that I’m aware. Sorry that’s blocking your team.

---

<div class="post-metadata">

**Author:** ![SidBidasaria](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@SidBidasaria](https://community.developer.atlassian.com/u/SidBidasaria)\
**Post date:** [May 1, 2023, 11:29pm UTC](https://community.developer.atlassian.com/t/jira-connect-app-test-the-access-email-addresses-scope-without-being-whitelisted/68979/4 "2023-05-01T23:29:50Z")

</div>

Thanks for the clarification @ibuchanan. You’ve been super helpful last few days.

I’ve got one more follow up:

Is there a way to deterministically tell that my app installation is failing because the key is not whitelisted? The error I receive when installing my app is very generic, and the [json validator tool seems to be down](https://atlassian-connect-validator.herokuapp.com/validate):

```auto
Could not install the file https://91d3-35-236-90-71.ngrok-free.app/atlassian-connect.json. Check that the file is valid.

```

---

<div class="post-metadata">

**Author:** ![remie](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/remie/32/34985_2.png) [@remie](https://community.developer.atlassian.com/u/remie)\
**Post date:** [May 2, 2023, 6:48am UTC](https://community.developer.atlassian.com/t/jira-connect-app-test-the-access-email-addresses-scope-without-being-whitelisted/68979/5 "2023-05-02T06:48:02Z")

</div>

Yes there is… there is a magic app key that can be used for development. Just create a ticket here: [Jira Service Management](https://ecosystem.atlassian.net/servicedesk/customer/portal/34/group/110/create/555) and explain your situation. No need to fill in everything with actual values. The team will provide you with the details.

I’m not going to share it here because it basically undermines the entire process to even have such a key, but even with Atlassian having a policy on paper is more important than actually implementing it 🤷‍♂️