API

The API lets you trigger exports programmatically — for integrations and custom workflows. It is part of the Exportelier Automation app.

Authentication

Calls are authenticated with a bearer token you generate under Settings → REST API tokens in the Automation app. Each token is bound to exactly one schedule: the request says run this, never run this query.

The complete token is shown once, when it is generated or rotated. Only a hash of it is stored, so it cannot be retrieved later — copy it into your integration at that moment.

Validity and rotation

Every token is issued with a validity of 30, 90, 180 or 365 days (90 by default) and stops working when it expires. There is no unlimited option: these credentials live in build pipelines and integration accounts outside Jira, where nothing expires them for you.

Rotate issues a fresh secret for an existing token while keeping its name, its bound schedule and its activity history. The previous secret stops working immediately — there is no overlap window — so update the calling system in the same change. Rotating also restarts the validity period.

Tokens created before validity existed keep working and are listed as "No expiry — rotate this token". Rotate one to bring it under the current policy.

What the endpoint returns

An unknown, revoked, expired or mistyped token all return the same 401 with {"error":"unauthorized"}. This is deliberate: the response must not tell a caller whether a given token exists.

Status	Body	Meaning
202	{"jobId":…,"status":"queued"}	The export was queued.
200	{"jobId":…,"status":"queued"}	A replay of an earlier request with the same Idempotency-Key.
401	{"error":"unauthorized"}	Token unknown, revoked, expired, or the secret is wrong.
403	{"error":"forbidden"}	The Automation subscription is not active.
404 / 409	{"error":"schedule_not_found"} / {"error":"schedule_disabled"}	The bound schedule is gone or paused.
429	{"error":"rate_limited"}	Rate limit reached — see Limits reference.

Reviewing token activity

Expanding a token in the list shows its recent triggered exports with their job IDs, and how often somebody presented the wrong secret for it. A rising failure count on a token you are not actively using is a reason to rotate it.

REST API token management with a token name and bound schedule selector.

Typical flow

1. Authenticate.
2. Request an export (context, template, format).
3. Poll the job status for large exports.
4. Retrieve the result.

Rate limits

The API is subject to rate limits — see Limits reference. For event-driven delivery, consider webhooks instead of polling.

Exact endpoints

Endpoint paths and request/response schemas are documented in-product and will be expanded here. This page describes the model and flow.