> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Jira Server

*This article covers **Jira Server Provisioning**, account and group-membership management for self-hosted **Jira Server/Data Center**. For the ITSM integration that syncs users and logs and syncs access-request tickets, see Jira. For Jira Cloud provisioning, see Jira Provisioning.*

## After this article

You will be able to connect a self-hosted Jira Server/Data Center instance to Lumos to sync and provision Jira user accounts and their access-control group memberships, and to track users' last login.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | Yes | User account records (on-prem/server Jira accounts) |
| Groups | Permission | Yes | Yes | Access control groups |

| Deprovisioning Action | Type | Description |
| :- | :- | :- |
| Deactivate | User | Deactivate the user's account (user update) |
| Delete | User | Delete the user's Jira account (Jira imposes restrictions before a user can be deleted) |

Activity tracking is supported. Lumos tracks users' **last login**.

## Required plan and roles

* The service account that creates the personal access token should be in the **jira-administrators** group with the **Jira Administrators** global permission.
* **Authentication is a personal access token (PAT)** plus your instance base URL. Group browsing must not be restricted, and custom permission schemes must allow viewing project roles.
* Your Jira Server instance must be reachable from the internet. If it sits behind a firewall, allowlist the Lumos IP addresses `44.228.74.159` and `54.244.99.235`.
* This integration can only be connected with **provisioning access**. There is no read-only variant.

## Read-only access vs provisioning

**Is read-only possible?** No. This integration only connects with provisioning access. There is no read-only variant. If you only need to sync Jira users and log or sync access-request tickets without managing accounts or group memberships, use the separate **Jira ITSM** integration instead. That integration connects to self-hosted Jira Server with a Site Admin personal access token.

**What full provisioning requires.** A personal access token (PAT) from a service account in the **jira-administrators** group with the **Jira Administrators** global permission, plus your instance base URL. Follow the steps below.

**Watch out for.** Group browsing must not be restricted and custom permission schemes must allow viewing project roles, or the connection reports "Insufficient permissions" even with a valid token. Because this integration has no read-only mode, connecting it for visibility alone still means granting a PAT that can create, deactivate, and delete Jira accounts.

## Instructions

**Phase 1: Prepare Jira Server**

1. In Jira, click your avatar (top right) → **Profile** → **Personal access tokens** (left menu).
2. Click **Create token**, give it a name, and set the expiration date (or disable expiration completely).
3. Click **Create** and copy the token.
4. Copy your instance base URL from the browser while logged in (for example `https://jira.your-organization.com`). Include the scheme (`https://` or `http://`). Port numbers and a base path are also supported.

**Phase 2: Connect in Lumos**

1. Open the **Jira Server Provisioning** integration card in Lumos.
2. Enter the **Personal Access Token** and the **Account Base URL** from Phase 1.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**"Unable to reach Jira Server".** Verify the instance is accessible from the internet, the URL includes the protocol (`https://` or `http://`), the Lumos IPs (`44.228.74.159`, `54.244.99.235`) are allowlisted in your firewall, SSL certificates are valid, and the server is running. You can test connectivity with `curl` from an external server.

**SSL certificate verification failed.** Ensure the certificate is valid, unexpired, matches the domain name, and the chain is complete. For self-signed certificates, contact Lumos support.

**"Insufficient permissions".** Ensure the service account is in the `jira-administrators` group with the Jira Administrators global permission, group browsing isn't restricted, and custom permission schemes allow viewing project roles.

**Intermittent failures.** Check firewall logs for blocked requests, verify rate limiting isn't blocking requests, confirm reverse proxy and load balancer settings route requests correctly, and monitor server performance and network logs for dropped connections.