Custom actions and connections

In addition to many useful built-in action templates, JWT offers the possibility to create individual remote actions.

A remote action refers to a defined connection in which the information about the remote service, such as the URL and the authentication, is configured. In the action, all further configurations are made to clearly address an entry point and the relevant information clearly. This includes, among other things, the relative path of the actual entry point and the parameters to be used for the query.

Custom remote actions

A custom remote action can either be directly created within the Execute remote action post function or within the Remote actions page in the Manage apps administration. On the Remote actions page, you can furthermore copy, edit and delete custom actions.

Create an action

Name

Define the name of the action. The name must be unique across all remote actions.

Method

Select the HTTP method type used while connecting to the remote service.

Default connection

Select either the current instance or one of the already connections to a remote service already configured. Learn more about creating a connection!

REST path

Define the path to the endpoint to be called by the action. This path will be appended to the configured base URL in the connection.

To make it easier and more powerful to work with the REST path, you can use placeholders for path and query parameters. A path needs to conform the following pattern:

/path/to/my/endpoint/{pathParameter}?{queryParameter1}&{queryParameter2}

A path parameter is any placeholder before the first found question mark character. It will be replaced at runtime with the value set in the further configuration. 

If a placeholder is found after the first question mark, it will be treated as a query parameter. You can configure the placeholder in the further configuration and set a custom value. At runtime, it will get replaced by the default query parameter pattern:

With the configuration 

pathParameter : "extended"
queryParameter1 : "my"
queryParameter2 : "value"

the example above will get evaluated to: 

/path/to/my/endpoint/extended?queryParameter1=my&queryParameter2=value

Parameter

If you have defined any placeholders in the REST path, you need to configure how they will be replaced when executing the action. You can set a value by either passing the value of a field to the placeholder or by setting it manually using a Parser expression. 

Action body

A JSON-based action body can be defined and configured if one of the methods POST or PUT is configured as a method type for the action. You can insert usual field codes and Expression parser functions within the body.

Edit an action

On the Remote actions page in the Manage apps administration, you are able to edit an action by just clicking the edit icon of the remote action that you want to update.

Copy an action

On the Remote actions page in the Manage apps administration, you are able to copy an action by just clicking the copy icon of the remote action that you want to copy. All configurations are taken over. As the name has to be unique across all remote actions, you have to at least update the action name parameter. 

Delete an action

On the Remote actions page in the Manage apps administration, you are able to delete an action by just clicking the delete icon of the remote action that you want to delete. Please keep in mind that deleting an action might result in an invalid workflow configuration if it is still in use.

Connections

Each remote action uses a connection to which the request is sent. This can either be an internal connection that helps to overcome some platform limitations or an external one. These connections can be created directly within the Execute remote action post function or on the Remote actions page at the Connections tab in the Manage apps administration. There, you can furthermore copy, edit and delete the connections or get information on whether they are used or not.

Create a connection

Name

Define the name of the connection. The name must be unique across all configured connections.

Connection type

Select whether to create an internal or an external connection. Although there is a usable default internal connection authenticated as the logged-in user, you can create further internal connections with a dedicated authentication.

Expert tip: On the cloud platform, not all REST endpoints are available for a 3rd party app like Jira Workflow Toolbox. If you want to use such an endpoint, you can overcome this limitation by creating an external connection using the current site URL and passing the authentication of a privileged user instead of using the internal one.

On Data Center, this only works if the base URL of your instance resolves to a publicly reachable address. If your instance resolves to a private address, the connection is blocked until an administrator allows internal addresses SINCE 3.5.11

Base URL

If the connection is configured as external, the base URL of the remote service needs to be defined. The base URL has to start with http or https and will be concatenated with the REST path configured in the action when executing the action.

To keep your instance safe, the base URL is validated before the connection is saved SINCE 3.5.11

Requirement

Details

Uses HTTP or HTTPS

Any other scheme is rejected.

The host can be resolved

The hostname must resolve to at least one IP address from the Jira node.

The host is not internal or reserved

Every IP address the host resolves to is checked. If a single one of them is internal or reserved, the base URL is rejected.

The host is on Jira's outbound allowlist

JWT respects the platform-wide allowlist configured in Administration > System > Security > Allowlist.

Blocked address ranges

While internal addresses are not allowed, a base URL is rejected if any of the resolved IP addresses falls into one of the following ranges:

Range type

Addresses

Loopback

127.0.0.0/8, ::1

Any local

0.0.0.0

Link local

169.254.0.0/16, fe80::/10

Private

10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

Multicast

224.0.0.0/4, ff00::/8

Unique local IPv6

fc00::/7

Reserved IPv4

0.0.0.0/8, 100.64.0.0/10, 192.0.0.0/24, 192.0.2.0/24, 192.88.99.0/24, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 240.0.0.0/4

Internal addresses are blocked by default. Learn more about allowing internal addresses

The base URL is validated again every time the action is executed, and on every redirect the remote service returns. A connection that was saved successfully can therefore still fail at runtime.

Authentication

Select the authentication used for the connection.

Option

Connection type

Description

Current user

Current instance

The logged-in user will be used to execute the remote action.

Selected user

Current instance

Independent of the logged-in user, the selected user will be the one executing the remote action.

No authentication

External

No authentication details will be passed when executing the remote action. This option can be used to connect to anonymous accessible web services.

Basic

External

A username and password combination will be used to execute the remote action.

Bearer

External

An API token will be passed when executing the remote action.

Custom headers

Add custom headers for the connection.

Option

Description

Name

A proper name to describe the header.

Value

You can choose between:

  • Get field value from the current issue

  • Set field value manually (by passing a parser expression check mark )

The header setup overwrites the Authentication configuration (from the previous section) in case of setting the Authorization header.


Validation messages

If a base URL cannot be used, the reason is displayed directly on the Base URL field.

Message

Cause

Resolution

The URL "..." is not a valid HTTP/HTTPS URL.

The value cannot be parsed as a URL, or it has no scheme or host.

Enter a complete URL, for example https://service.example.com

Only http and https URLs are allowed (got "...").

A scheme other than HTTP or HTTPS was used.

Use http:// or https://

The host "..." cannot be resolved.

The Jira node cannot resolve the hostname.

Check the spelling and make sure the Jira node can reach your DNS

The URL targets an internal/reserved address and is blocked for security reasons (host: ..., address: ...).

The host resolves to an internal or reserved address.

Use a publicly reachable address, or ask an administrator to allow internal addresses

The URL host "..." is not in Jira's outbound allowlist.

The host is blocked by Jira itself, not by JWT.

Add the host in Administration > System > Security > Allowlist

Edit a connection

On the Remote actions page at the Connections tab in the Manage apps administration , you are able to edit a connection by just clicking the edit icon on the connection that you want to update.

Copy a connection

On the Remote actions page at the Connections tab in the Manage apps administration , you are able to copy a connection by just clicking the copy icon on the connection that you want to copy. Most configurations are taken over except the credentials in case of an external connection. As the name has to be unique across all remote connections, you have to update at least the connection name parameter.

Delete a connection

On the Remote actions page at the Connections tab in the Manage apps administration , you are able to delete a connection by just clicking the delete icon on the connection that you want to delete. If the connection is used in any connection as a default connection, you need to update the affected actions first. Please keep in mind that deleting a connection might result in an invalid workflow configuration in case it is still in use.