QuotaWatch: API & Security Documentation
Note: QuotaWatch is a Consumer-Only Application
1. Architectural Role: API Consumer
QuotaWatch is an Atlassian Forge-native application designed to monitor the health of the host Jira site. It is important to distinguish that QuotaWatch is exclusively an API Consumer.
Zero Inbound Surface: The application provides NO external API endpoints, NO public URLs, and NO listening ports.
Outbound Only: All network activity is outbound from the secure Atlassian Forge runtime to the Jira Cloud REST API or configured notification webhooks (Slack/Teams).
Internal Execution: The application logic executes within Atlassian’s serverless environment, protected by the platform's native security controls.
2. Endpoints in Scope (Consumed APIs)
The following Jira Cloud REST API endpoints are called by QuotaWatch. These represent the "In-Scope" APIs for this assessment. All calls are made via the Atlassian-managed requestJira bridge using scoped OAuth 2.0 tokens.
Endpoint (Called by App) | Purpose | Data Retrieved/Sent |
|---|---|---|
| Rate-limit monitoring | Retrieves HTTP headers only (metadata). |
| Alerting | Sends JSON alert payloads to a private Jira issue. |
| Status signaling | Writes alert state to Jira issue properties. |
| Configuration | Locates the designated monitoring heartbeat issue. |
3. Security Features
3.1 Authentication (Platform Managed)
Authentication is handled entirely by the Atlassian Forge platform.
Provider: Atlassian Identity.
Mechanism: Managed OAuth 2.0. The app uses short-lived "app-context" tokens that are only valid within the specific Jira instance where the app is installed.
Access Control: Access to the QuotaWatch UI is restricted to users with the "Jira Administrator" role.
3.2 Authorization (Granular Scopes)
QuotaWatch requests only the minimum required permissions via Atlassian’s Scopes system:
read:jira-work: To access system metadata and headers.storage:app: To persist 24-hour history snapshots within Atlassian’s encrypted storage.write:jira-work: To send notifications to the administrator’s chosen Jira issue.
3.3 Data Encryption
In Transit: All outbound calls to the Jira API are encrypted via TLS 1.2 or higher.
At Rest: Data stored in Atlassian Forge App Storage (KVS) is encrypted using AES-256. Key management and rotation are handled by Atlassian.
4. External Data Egress (Optional)
If (and only if) an administrator configures the "Alert Rules" feature, QuotaWatch can send outbound POST requests to:
hooks.slack.com(Slack)outlook.office.com(Microsoft Teams)
These calls contain only the usage percentages and timestamps; no sensitive Jira issue data, PII, or credentials are ever egressed.
5. Summary for Security Reviewers
Because QuotaWatch consumes standard Atlassian APIs rather than exposing its own, it inherits the full security posture of the Atlassian Cloud platform. There is no external URL for penetration testing, as the app is isolated within the customer's authenticated Jira session.