I'm building a Jira App with Forge where I retrieve board data from the Jira Cloud Rest API. Data retrieval is done in a client-side script using requestJira from @forge/bridge. I'm able to successfully retrieve a list of all boards using the route /rest/agile/1.0/board but when I try to retrieve the configuration of a selected board using the route '/rest/agile/1.0/board/' + boardId + '/configuration' e.g. /rest/agile/1.0/board/4/configuration, this leads to the error response 403 "Forbidden".
In manifest.yml I have defined permissions as follows:
permissions:
scopes:
- read:jira-work
One should think that this should be enough for retrieving board configurations, particularly since the retrieval of the board list was successful. If not, then what is the required permission in this case? Or what else might be going wrong here?
I also tried executing api.asApp().requestJira('/rest/agile/1.0/board/4/configuration',{}) from @forge/api on the server side. Result was the same, i.e. also a 403 response.
The route /rest/agile/1.0/board/4/configuration works fine when pasted into a browser's address field after the URL of my dev instance.
Got an answer in the Atlassian Developer Community. Turned out that my app requires the read:board-scope.admin:jira-software and read:project:jira scopes, as per https://developer.atlassian.com/cloud/jira/software/rest/api-group-board/#api-rest-agile-1-0-board-boardid-configuration-get