Cloud Admin module

API reference

class atlassian.cloud_admin.CloudAdmin(admin_api_key, *args, **kwargs)

Client for Atlassian Administration’s organization APIs.

This client is separate from product clients because it uses organization admin API keys and the api.atlassian.com/admin API surface. API keys need the scopes required by each operation, such as read:orgs:admin.

activate_user(account_id)

Reactivate a deactivated managed account.

add_control_policy_resource(org_id, policy_id, data, version='v2')

Associate a resource with a policy.

add_users_to_auth_policy(org_id, policy_id, data)

Start a V1 task assigning users to an authentication policy.

archive_classification_level(org_id, level_id)

Archive one classification level; published content becomes unclassified.

cancel_user_deletion(account_id)

Cancel deletion during its grace period and reactivate the account.

create_classification_level(org_id, data)

Create a draft DLP classification level.

create_control_policy(org_id, data, version='v2')

Create an Admin Control policy.

create_oauth_client(org_id, data)

Create an OAuth client.

create_scim_group(directory_id, data)

Create a SCIM group resource.

create_scim_user(directory_id, data)

Create a SCIM user from a SCIM 2.0 User resource.

create_service_account(org_id, data)

Create a service account.

deactivate_user(account_id, message=None)

Deactivate a managed account; an optional message is shown to the user.

delete_control_policy(org_id, policy_id, version='v2')

Delete an Admin Control policy.

delete_control_policy_resource(org_id, policy_id, resource_id)

Remove one V1 policy resource.

delete_control_policy_resources(org_id, policy_id, version='v2')

Remove all resources associated with a policy.

delete_oauth_client(org_id, client_id)

Delete an OAuth client.

delete_org_api_tokens(org_id, data)

Delete organization API tokens selected by the API Access request body.

delete_scim_group(directory_id, group_id)

Delete a SCIM group.

delete_scim_user(directory_id, user_id)

Delete a user from the SCIM directory.

delete_scim_user_from_database(org_id, account_id)

Delete only the SCIM database record; use only for repair workflows.

delete_service_account(org_id, service_account_id)

Delete a service account.

delete_service_account_api_tokens(org_id, account_id, data)

Delete selected service-account API tokens.

delete_user(account_id)

Schedule permanent deletion of a managed account after its grace period.

delete_user_api_token(account_id, token_id)

Revoke one user API token.

get_auth_policy_task(org_id, task_id)

Return status for an asynchronous authentication-policy task.

get_classification_level(org_id, level_id)

Return one DLP classification level.

get_classification_levels(org_id)

List DLP classification levels (read:classification-levels:admin).

get_control_policies(org_id, version='v2', **params)

List Admin Control policies (V2 by default).

get_control_policy(org_id, policy_id, version='v2')

Return one Admin Control policy.

get_control_policy_resources(org_id, policy_id, version='v2')

List resources associated with a policy.

get_directories(org_id, account_id=None, directory_ids=None, search_term=None, cursor=None, limit=None)

Return organization directories, optionally filtered or cursor-paged.

get_directory_user(org_id, directory_id, user_id)

Return details for one directory user.

get_directory_users_count(org_id, directory_id)

Return the number of users in a directory.

get_domain(org_id, domain_id)

Return one verified domain.

get_domains(org_id, cursor=None, limit=None)

Return verified domains for an organization.

get_event(org_id, event_id)

Return one organization audit event.

get_events(org_id, cursor=None, limit=None)

Return organization audit events.

get_group(org_id, directory_id, group_id)

Return one directory group.

get_groups(org_id, directory_id, cursor=None, limit=None, search_term=None)

Return groups in a directory.

get_oauth_client(org_id, client_id)

Return one OAuth client.

get_oauth_client_count(org_id, data=None)

Return OAuth-client count, optionally using API Access filters.

get_oauth_clients(org_id, **params)

List organization OAuth clients.

get_org_api_key_count(org_id)

Return API-key count for an organization.

get_org_api_keys(org_id, **params)

List API keys in an organization.

get_org_api_token_count(org_id)

Return API-token count for an organization.

get_org_api_tokens(org_id, **params)

List organization API tokens.

get_organization(org_id)

Return one organization (requires read:orgs:admin).

get_organizations(cursor=None)

Return organizations accessible to the admin API key.

get_scim_group(directory_id, group_id)

Return one SCIM group.

get_scim_groups(directory_id, **params)

List SCIM groups; pass SCIM filters as keyword arguments.

Return SCIM links for an Atlassian account.

Return SCIM links associated with an email address.

get_scim_resource_types(directory_id, resource_type=None)

Return SCIM resource types, or a single User/Group resource type.

get_scim_schemas(directory_id, schema_id=None)

Return all SCIM schemas or one schema by URN.

get_scim_service_provider_config(directory_id)

Return supported SCIM features for a directory.

get_scim_user(directory_id, user_id)

Return one SCIM user.

get_scim_users(directory_id, **params)

List SCIM users; pass SCIM filters such as filter or startIndex as keywords.

get_service_account_api_token_count(org_id, data)

Return service-account API-token count using the supplied filter body.

get_service_account_api_tokens(org_id, account_id, **params)

List API tokens belonging to a service account.

get_service_accounts(org_id, **params)

List organization service accounts.

get_user_api_tokens(account_id)

Return API tokens for a user when the API key has the required privilege.

get_user_management_permissions(account_id, privileges=None)

Return privileges the API key has for managing an account.

get_user_profile(account_id)

Return an account profile through the User Management API.

get_users_auth_policies(org_id, data)

Return authentication-policy information for managed users in bulk.

patch_scim_group(directory_id, group_id, operations)

Apply SCIM PATCH operations to a group, including membership changes.

patch_scim_user(directory_id, user_id, operations)

Apply SCIM PATCH operations to a user.

publish_classification_levels(org_id, level_ids)

Publish one or more draft classification levels.

publish_control_draft_policies(org_id, data=None)

Publish V2 draft policies; this applies pending organization controls.

reorder_classification_levels(org_id, level_ids)

Set classification-level order; the most sensitive level ranks first.

replace_scim_group(directory_id, group_id, data)

Replace a SCIM group with a complete Group resource.

replace_scim_user(directory_id, user_id, data)

Replace a SCIM user with a complete User resource.

restore_classification_level(org_id, level_id)

Restore an archived classification level as a draft.

revoke_org_api_key(org_id, api_key_id, data=None)

Revoke an organization API key.

search_directory_groups(org_id, directory_id, data=None)

Search groups in a directory using the V2 request-body filters.

search_directory_users(org_id, directory_id, data=None)

Search directory users with the V2 request body (for example searchTerm or emails).

set_user_email(account_id, email)

Set a managed user’s verified email address and invalidate active sessions.

Unlink a SCIM user from an Atlassian account without deleting either resource.

update_classification_level(org_id, level_id, data)

Replace/edit a DLP classification level.

update_control_policy(org_id, policy_id, data, version='v2')

Replace an Admin Control policy.

update_control_policy_resource(org_id, policy_id, resource_id, data)

Update one V1 policy resource.

update_service_account(org_id, data)

Patch a service account using the API Access request body.

update_user_profile(account_id, data)

Patch profile fields permitted by the account’s profile.write privilege.

validate_control_policy(org_id, policy_id)

Validate a V1 policy without changing it.

class atlassian.cloud_admin.CloudAdminOrgs(admin_api_key, *args, **kwargs)
get_managed_accounts_in_organization(org_id, cursor=None)

Returns a list of accounts managed by the organization :param org_id: :param cursor: :return:

get_organization(org_id)

Returns information about a single organization by ID :param org_id: :return:

get_organizations()

Returns a list of your organizations (based on your API key). :return:

search_users_in_organization(org_id, account_ids=None, account_types=None, account_statuses=None, name_or_nicknames=None, email_usernames=None, email_domains=None, is_suspended=None, cursor=None, limit=10000, expand=None)

Returns a list of accounts in the organization that match the search criteria. The API is available for customers using the new user management experience only. How the new user management experience works Returns a list of users within an organization, offering search functionality through multiple parameters for more precise results. :param org_id: :param account_ids: Unique ID of the users account. The format is [a-zA-Z0-9_|-:]{1,128} :param account_types: The type of account Valid values: atlassian, customer, app :param account_statuses: The lifecycle status of the account :param name_or_nicknames: :param email_usernames: :param email_domains: :param is_suspended: Suspended users with no access. This is independent of the user account status :param cursor: Starting point marker for page result retrieval :param limit: The number of items to return. Default = max = 10000 :param expand: Valid values: NAME, EMAIL, EMAIL_VERIFIED, PRODUCT_LAST_ACCESS, GROUPS :return:

class atlassian.cloud_admin.CloudAdminUsers(admin_api_key, *args, **kwargs)
get_profile(account_id)

CloudAdmin

CloudAdmin is the modern organization-administration client for https://api.atlassian.com/admin. It requires an Atlassian Administration API key, not a Jira or Confluence API token. Give the key the scopes required by each operation.

from atlassian import CloudAdmin

admin = CloudAdmin(admin_api_key="<admin-api-key>")
organizations = admin.get_organizations()
directories = admin.get_directories("<org-id>", search_term="engineering")
users = admin.search_directory_users(
    "<org-id>", "<directory-id>", {"searchTerm": "ada", "limit": 50}
)
domains = admin.get_domains("<org-id>")
events = admin.get_events("<org-id>", limit=100)

# User Management API: check privileges before a lifecycle change.
permissions = admin.get_user_management_permissions("<account-id>")
admin.update_user_profile("<account-id>", {"nickname": "Ada"})
admin.set_user_email("<account-id>", "ada@example.com")
admin.deactivate_user("<account-id>", message="Offboarding")
admin.activate_user("<account-id>")
admin.delete_user_api_token("<account-id>", "<token-id>")

It also exposes directory user/group details and counts, verified domains, and individual audit events. CloudAdminOrgs and CloudAdminUsers remain for backwards compatibility with the older Administration API endpoints.

The User Management methods expose permissions, profile reads/updates, email updates, user API-token revocation, and deactivate/activate/delete/cancel-delete lifecycle operations. Deletion is destructive after Atlassian’s grace period; prefer deactivation when account recovery may be needed.

User provisioning (SCIM)

The same client supports the directory-scoped SCIM 2.0 provisioning API. SCIM resource bodies and PATCH operations are passed through unchanged.

users = admin.get_scim_users(
    "<directory-id>", filter='userName eq "ada@example.com"', count=10
)
user = admin.create_scim_user("<directory-id>", {"userName": "ada@example.com", "active": True})
admin.patch_scim_group(
    "<directory-id>", "<group-id>",
    [{"op": "add", "path": "members", "value": [{"value": user["id"]}]}],
)

delete_scim_user and delete_scim_group delete directory resources. delete_scim_user_from_database is a repair-only operation and deletes only the SCIM database record; use it only with a documented recovery procedure.

Data Loss Prevention (DLP)

Classification-level management is available through the DLP API. These operations require read:classification-levels:admin or write:classification-levels:admin on the administration API key.

levels = admin.get_classification_levels("<org-id>")
level = admin.create_classification_level("<org-id>", {"name": "Restricted"})
admin.publish_classification_levels("<org-id>", [level["id"]])
admin.reorder_classification_levels("<org-id>", [level["id"]])

Archiving a published level makes associated pages and issues unclassified. Restoring creates a draft, which must be published again before it is usable.

Admin Control

Admin Control policies and their resources use V2 by default. Use version for compatible V1 calls. Publishing draft policies applies pending organization controls; resource and policy deletion remove existing controls.

policy = admin.create_control_policy("<org-id>", {"name": "Require MFA"})
admin.add_control_policy_resource("<org-id>", policy["id"], {"resourceId": "<resource-ari>"})
admin.publish_control_draft_policies("<org-id>")

Authentication-policy user assignment returns an asynchronous task. Poll it with get_auth_policy_task(org_id, task_id) until completion.

API Access

API Access management covers organization API tokens and keys, OAuth clients, and service accounts. Listing and count methods are read-only; revoke and delete methods immediately affect credentials or accounts.

tokens = admin.get_org_api_tokens("<org-id>", limit=100)
service_account = admin.create_service_account("<org-id>", {"name": "automation"})
client = admin.create_oauth_client("<org-id>", {"name": "integration"})
admin.revoke_org_api_key("<org-id>", "<api-key-id>")

CloudAdminOrgs

# Returns a list of your organizations
cloud_admin_orgs.get_organizations()

# Returns information about a single organization by ID
cloud_admin_orgs.get_organization(org_id)

# Returns a list of accounts managed by the organization
cloud_admin_orgs.get_managed_accounts_in_organization(org_id, cursor=None)

# Returns a list of accounts in the organization that match the search criteria.
cloud_admin_orgs.search_users_in_organization(org_id, account_ids=None, account_types=None,account_statuses=None,
                                 name_or_nicknames=None, email_usernames=None, email_domains=None, is_suspended=None,
                                 cursor=None, limit=10000, expand=None)

#

CloudAdminUsers

# Returns information about a single Atlassian account by ID
cloud_admin_users.get_profile(account_id)