AssetPilot for Jira runs inside Atlassian Forge without external calls. AssetPilot Connect is in beta and adds connections to services your admins configure.
AssetPilot for Jira
App key com.pluginsfactory.assetpilot.
Atlassian cloud
Jira UIAssetPilot pages and the issue panel (Custom UI in an iframe)
Forge functionsResolvers, daily digest, app REST API (0.2, in Marketplace review)
Forge storageAssets, settings, audit log
Jira REST APISame Jira site only. Calls run as the user; the digest runs as the app.
Outside AtlassianNothing. The manifest declares no external hosts.
AssetPilot Connect
App key com.pluginsfactory.assetpilot-connect. Beta (pre-release). Connect requires AssetPilot’s app REST API, which is not in production.
Atlassian cloud
Admin UIJira settings page (Custom UI)
Forge functionsScheduled sync, delivery queue, public API web trigger
Forge storageSettings, run and delivery logs, key hashes; secrets in secret storage
AssetPilot app REST APIOAuth 2.0 (3LO) with custom scopes, through api.atlassian.com
Services your admins configure
MDM (read)Microsoft Intune, Jamf Pro, Kandji
Chat (send)Slack, Microsoft Teams
Webhooks (send)Your https endpoints, signed with HMAC-SHA256
Your scripts (call in)Connect API with an
X-API-Key headerAuthentication
| Entry point | How callers are authenticated |
|---|---|
| AssetPilot and Connect pages in Jira | Atlassian session and Forge app context |
| AssetPilot app REST API | OAuth 2.0 (3LO) access token with AssetPilot’s custom scopes |
| Connect API web trigger | Scoped API key (apk_…), compared against its SHA-256 hash, with a rate limit per key |
| Connect OAuth callback web trigger | Single-use state value bound to the authorization request |
| Outgoing webhooks | Receivers verify X-AssetPilot-Signature (see the webhook docs) |
Review data handling for storage, retention and deletion details.