---
title: "JMWE Cloud: Allow app to access restricted Team-managed projects"
canonical: "https://support.appfire.com/space/SUPPORT/3317301249/JMWE%20Cloud%3A%20Allow%20app%20to%20access%20restricted%20Team-managed%20projects"
format: markdown
---
> ℹ️ **Applies to**: Jira Cloud, Team-managed projects, JMWE Global/Event-based Actions
> ℹ️ 
> ℹ️ **Symptom**: JMWE actions fail with 404 “Issue does not exist or you do not have permission to see it” when the target issue type is restricted using Team-managed “Restrict work items.”
> ℹ️ 
> ℹ️ **Root cause**: The JMWE app user does not have a role that matches the Team-managed issue type restriction.

> Macro (toc)

## Overview

Team-managed projects offer a “Restrict work items” control per issue type. When enabled, only members of the selected project role(s) can see or act on those issues. JMWE Cloud executes API calls as the app user for many operations (including event-based actions). If the app user isn't part of a role allowed by the restriction, Jira returns 404/permission errors even when the action is configured to “Run as current user.”

This page explains how to grant the JMWE app user access to restricted Team-managed issue types by adding the app user to the relevant project role via the Jira Cloud REST API.

## When you need this

- You run JMWE event-based or global actions against a Team-managed project.
- Issue types in that project are restricted using “Restrict work items” (for example, restricted to Administrators).
- JMWE logs show 404 “Issue does not exist or you do not have permission to see it,” or test calls in Nunjucks return the same message for the app user.

## Before you start

- You'll need to be a Jira administrator or a project administrator with permission to manage roles in the target Team-managed project.
- Have the target project key ready. The examples below use **TEAM** as the sample project key.
- You'll use JMWE's Nunjucks and Jira Expression tester to run a few REST calls conveniently.

## Quick fix: add the JMWE app user to the restricted role

The fix is to add the JMWE app user to the same project role that the issue type is restricted to (for example, Administrator). In Team-managed projects, add-on/app users don't appear in the People/Access UI and can't be added there; you'll need to add them via the Jira Cloud REST API.

For Steps 1, 2, and 3, test each provided Nunjucks script in JMWE's [Nunjucks and Jira Expression tester](https://appfire.atlassian.net/servicedesk/customer/portal/11/article/465373737) before moving to the next step. To open the tester, go to **Jira settings** ⚙️ > **Apps** > **Nunjucks and Jira expression tester** under **Jira Misc Workflow Extensions**. Set **Type** to **Nunjucks script**, paste the script into the editor, click **Test Nunjucks Template…**, select an issue to use as the test context, and then click **Test**. Review the output returned by the tester and use it for the next step where required.

### Step 1: identify the JMWE app user accountId

```nunjucks
{% set myself = "/rest/api/3/myself" | callJira(dontFail=true) %}
{{ myself | dump(2) }}
```

Copy the **accountId** from the output. This is the JMWE app user accountId.

### Step 2: get the project role IDs for the Team-managed project

```nunjucks
{% set roles = "/rest/api/3/project/TEAM/role" | callJira(
  impersonate = true,
  dontFail = true
) %}
{{ roles | dump(2) }}
```

Locate the role used by your “Restrict work items” setting (for example, Administrator) and note its **roleId**.

### Step 3: add the JMWE app user to the restricted role

```nunjucks
{% set projectKey = "TEAM" %}
{% set jmweAccountId = "<JMWE_ACCOUNT_ID>" %}
{% set restrictedRoleId = "<TARGET_ROLE_ID>" %}

{% set addRole = "/rest/api/3/project/:projectKey/role/:roleId" | callJira(
  verb = "POST",
  params = {
    "projectKey": projectKey,
    "roleId": restrictedRoleId
  },
  body = {
    "user": [jmweAccountId]
  },
  impersonate = true,
  dontFail = true
) %}
{{ addRole | dump(2) }}
```

If successful, the response confirms that the app user was added to the role.

### Step 4: test the permissions and your action

- Re-run or trigger your JMWE event-based action; it should now complete without the 404 error.

## Rollback (optional)

If you need to remove the JMWE app user from the role later, use:

```nunjucks
{% set projectKey = "TEAM" %}
{% set jmweAccountId = "<JMWE_ACCOUNT_ID>" %}
{% set roleId = "<TARGET_ROLE_ID>" %}

{% set remove = "/rest/api/3/project/:projectKey/role/:roleId?user=:accountId" | callJira(
  verb = "DELETE",
  params = {
    "projectKey": projectKey,
    "roleId": roleId,
    "accountId": jmweAccountId
  },
  impersonate = true,
  dontFail = true
) %}
{{ remove | dump(2) }}
```

## Why this happens

- Team-managed “Restrict work items” enforces visibility/operation at the issue-type level based on project roles.
- JMWE often performs its API calls as the app user. If that app user isn't in an allowed role, Jira denies access, returning a 404/permission error, even if the trigger is configured to run as the current user.
- Team-managed projects don't expose add-on/app users in the People/Access UI, so you can't add them from there. You'll need to add the JMWE app user via the Jira Cloud REST API for project role actors.

## Best practices and notes

**Match the restriction**: Add the app user only to the project role that is explicitly used by “Restrict work items” for the affected issue type(s). Avoid granting broader roles than necessary.

- If multiple issue types have different restrictions, repeat the add-to-role process for each relevant role.
- Document the change in your project's admin notes for future maintenance and audits.
- If the restriction settings change later, revisit app user role membership to keep JMWE working.

## Verification checklist

- [ ] Identified JMWE app user accountId
- [ ] Retrieved project roles and captured the ID of the restricted role
- [ ] Added the JMWE app user to the restricted role via REST
- [ ] Re-tested JMWE action without 404/permission errors
- [ ] Logged the change for future admins

## Troubleshooting

<details>
<summary>Still getting 404 after adding the role?</summary>

- Confirm you used the correct project key throughout the calls.
- Re-check the issue type's “Restrict work items” setting, did it reference a different role?
- Trigger the action again and inspect JMWE logs for a different error signature.
</details>

<details>
<summary>Can I do this from the UI?</summary>

No. Add-on/app (Connect) users can't be added to Team-managed project roles from the UI. You'll need to use the REST calls shown above.
</details>

<details>
<summary>Is this safe?</summary>

Yes, provided you add the app user only to the minimal role required by the restriction. This grants JMWE the visibility it needs to execute the automation while keeping access scoped to the project and role.
</details>

## References

- [https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-project-role-actors/#api-rest-api-3-project-projectidorkey-role-id-put](https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-project-role-actors/#api-rest-api-3-project-projectidorkey-role-id-put)