Jira Schema

        graph LR
    JiraGroup -- ADMIN_OF --> JiraTenant
    JiraGroup -- HAS_PERMISSION --> JiraPermissionGrant
    JiraGroup -- MEMBER_OF --> JiraProjectRole
    JiraPermissionGrant -- APPLIES_TO --> JiraProject
    JiraProjectRole -- HAS_PERMISSION --> JiraPermissionGrant
    JiraProjectRole -- ROLE_OF --> JiraProject
    JiraTenant -- RESOURCE --> JiraGroup
    JiraTenant -- RESOURCE --> JiraPermissionGrant
    JiraTenant -- RESOURCE --> JiraProject
    JiraTenant -- RESOURCE --> JiraProjectRole
    JiraTenant -- RESOURCE --> JiraUser
    JiraUser -- HAS_PERMISSION --> JiraPermissionGrant
    JiraUser -- LEADS --> JiraProject
    JiraUser -- MEMBER_OF --> JiraGroup
    JiraUser -- MEMBER_OF --> JiraProjectRole
    

JiraGroup

A Jira group and its API-reported administrative access levels.

ADMIN_OF reflects the experimental group accessType filters, not arbitrary global permission grants, organization admins, or effective per-user access. Group names are never used to infer administrative privileges.

Properties

Field	Index	Description
id	Yes	Cloud ID, group kind, and URL-escaped groupId.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp of the last sync that observed this node.
admin_access_types		Experimental group/bulk accessType filters matching this group: admin or site-admin; not exhaustive effective privileges.
group_id		group/bulk groupId, independent of group name.
name		group/bulk name.
tenant_id		Jira Cloud ID.

Relationships

• (:JiraGroup)-[:ADMIN_OF]->(:JiraTenant): An admin or site-admin group reported by Jira group accessType.

• (:JiraGroup)-[:HAS_PERMISSION]->(:JiraPermissionGrant): The principal is the configured holder of this permission grant.

• (:JiraGroup)-[:MEMBER_OF]->(:JiraProjectRole): A group is an actor in this project role.

• (:JiraUser)-[:MEMBER_OF]->(:JiraGroup): A user belongs to this group, including inactive memberships.

• (:JiraTenant)-[:RESOURCE]->(:JiraGroup): The Jira Cloud tenant contains this resource.

JiraPermissionGrant

A permission-scheme grant applied to a project.

Conditional holders such as reporter, assignee, application roles, custom fields, and anyone remain configuration facts without inferred holder edges. Grants referencing deleted-user tombstones are retained without user links. Licensing, account suspension, issue security, and service-project portal rules can further restrict access.

Properties

Field	Index	Description
id	Yes	Cloud ID, grant kind, and URL-escaped project, scheme, and grant IDs.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp of the last sync that observed this node.
grant_id		permissionscheme/{id} permissions[].id within the scheme.
holder_parameter		Original permissions[].holder.parameter, such as group name or role ID.
holder_type		permissions[].holder.type, including conditional or app-specific holders.
holder_value		Original permissions[].holder.value, such as group ID.
permission	Yes	permissions[].permission, such as BROWSE_PROJECTS or ADMINISTER_PROJECTS.
scheme_id		Assigned permissionscheme id.
tenant_id		Jira Cloud ID.

Relationships

• (:JiraPermissionGrant)-[:APPLIES_TO]->(:JiraProject): This configured permission grant applies to the project.

• (:JiraGroup)-[:HAS_PERMISSION]->(:JiraPermissionGrant): The principal is the configured holder of this permission grant.

• (:JiraProjectRole)-[:HAS_PERMISSION]->(:JiraPermissionGrant): The principal is the configured holder of this permission grant.

• (:JiraUser)-[:HAS_PERMISSION]->(:JiraPermissionGrant): The principal is the configured holder of this permission grant.

• (:JiraTenant)-[:RESOURCE]->(:JiraPermissionGrant): The Jira Cloud tenant contains this resource.

JiraProject

A live Jira project; archived and deleted projects are excluded.

Team-managed projects include role actors, but their permission schemes and project access-level policy are not exported. Permission grants describe configuration, not effective issue access.

Properties

Field	Index	Description
id	Yes	Cloud ID, project kind, and URL-escaped project id.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp of the last sync that observed this node.
key		project/search key; mutable.
name		project/search name.
permission_scheme_id		project/{id}/permissionscheme id for company-managed projects.
permission_scheme_supported		Derived from style; false for next-gen projects, whose scheme grants are not exported.
project_id		project/search id.
project_type		project/search projectTypeKey.
style		project/search style: classic or next-gen (team-managed).
tenant_id		Jira Cloud ID.

Relationships

• (:JiraPermissionGrant)-[:APPLIES_TO]->(:JiraProject): This configured permission grant applies to the project.

• (:JiraUser)-[:LEADS]->(:JiraProject): The user is the project lead; this alone does not grant permissions.

• (:JiraTenant)-[:RESOURCE]->(:JiraProject): The Jira Cloud tenant contains this resource.

• (:JiraProjectRole)-[:ROLE_OF]->(:JiraProject): The role assignment belongs to this project.

JiraProjectRole

A project-scoped role with its user and group actors. Membership alone does not grant access.

Properties

Field	Index	Description
id	Yes	Cloud ID, role kind, and URL-escaped project and role IDs.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp of the last sync that observed this node.
admin		Project role admin flag; does not infer effective permissions.
description		Project role description.
name		Project role name.
role_id		project/{id}/role/{roleId} id; assignments are scoped to the project.
tenant_id		Jira Cloud ID.

Relationships

• (:JiraProjectRole)-[:HAS_PERMISSION]->(:JiraPermissionGrant): The principal is the configured holder of this permission grant.

• (:JiraGroup)-[:MEMBER_OF]->(:JiraProjectRole): A group is an actor in this project role.

• (:JiraUser)-[:MEMBER_OF]->(:JiraProjectRole): A user is a direct actor in this project role.

• (:JiraTenant)-[:RESOURCE]->(:JiraProjectRole): The Jira Cloud tenant contains this resource.

• (:JiraProjectRole)-[:ROLE_OF]->(:JiraProject): The role assignment belongs to this project.

JiraTenant

A Jira Cloud site with the Tenant ontology label.

Ontology Mapping: This node uses the ontology label Tenant.

Properties

Ontology-generated fields are shown in italics.

Field	Index	Description
id	Yes	Stable Cloud UUID supplied by –jira-cloud-id.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp of the last sync that observed this node.
domain		Hostname parsed from serverInfo.baseUrl.
name		serverInfo.serverTitle.
url		serverInfo.baseUrl.
_ont_domain	Yes	Normalized field sourced from domain.
_ont_name	Yes	Normalized field sourced from name.
_ont_source		Module that populated this node’s ontology fields.

Relationships

• (:JiraGroup)-[:ADMIN_OF]->(:JiraTenant): An admin or site-admin group reported by Jira group accessType.

• (:JiraTenant)-[:RESOURCE]->(:JiraGroup): The Jira Cloud tenant contains this resource.

• (:JiraTenant)-[:RESOURCE]->(:JiraPermissionGrant): The Jira Cloud tenant contains this resource.

• (:JiraTenant)-[:RESOURCE]->(:JiraProject): The Jira Cloud tenant contains this resource.

• (:JiraTenant)-[:RESOURCE]->(:JiraProjectRole): The Jira Cloud tenant contains this resource.

• (:JiraTenant)-[:RESOURCE]->(:JiraUser): The Jira Cloud tenant contains this resource.

JiraUser

A Jira account. Only account_type=atlassian carries the UserAccount ontology label.

Visible emails can link these accounts to canonical User nodes. The complete user listing supplies profile fields; nested profiles supply fields only for otherwise unlisted accounts. Inactive deleted-user tombstones with accountId unknown are omitted, and references to them remain unlinked.

Conditional Labels:

• UserAccount (ontology label) when account_type equals atlassian. An identity on a specific system or service.

Properties

Ontology-generated fields are shown in italics.

Field	Index	Description
id	Yes	Cloud ID, user kind, and URL-escaped accountId.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp of the last sync that observed this node.
account_id		Atlassian accountId from a user profile or actor/holder reference.
account_type		User profile accountType: atlassian, app, customer, or unknown; absent for reference-only accounts.
active	Yes	User profile active flag; absent for reference-only accounts.
display_name		User profile displayName, subject to profile visibility.
email		User profile emailAddress if visible; absent addresses are not inferred.
tenant_id		Jira Cloud ID.
_ont_active	Yes	Normalized field sourced from active.
_ont_email	Yes	Normalized field sourced from email.
_ont_fullname	Yes	Normalized field sourced from display_name.
_ont_source		Module that populated this node’s ontology fields.

Relationships

• (:User)-[:HAS_ACCOUNT]->(:JiraUser)

• (:JiraUser)-[:HAS_PERMISSION]->(:JiraPermissionGrant): The principal is the configured holder of this permission grant.

• (:JiraUser)-[:LEADS]->(:JiraProject): The user is the project lead; this alone does not grant permissions.

• (:JiraUser)-[:MEMBER_OF]->(:JiraGroup): A user belongs to this group, including inactive memberships.

• (:JiraUser)-[:MEMBER_OF]->(:JiraProjectRole): A user is a direct actor in this project role.

• (:JiraTenant)-[:RESOURCE]->(:JiraUser): The Jira Cloud tenant contains this resource.