As JIRA is a web application, it is generally possible to construct a URL which will trigger an operation, such as creating or commenting on an issue. This is often a simple alternative to SOAP or XML-RPC.

For example, To create a Bug in the 'TST' project on jira.atlassian.com, click on:

http://jira.atlassian.com/secure/CreateIssueDetails.jspa?pid=10420&issuetype=1&summary=My+Test+Issue&os_username=soaptester&os_password=soaptester

This URL contains various parameters (pid, issuetype, summary) that are either hidden or submitted in HTML forms. Here is another variant, setting a custom field, but not submitting the form (ie. prepopulating a field):

http://jira.atlassian.com/secure/CreateIssueDetails.jspa?pid=10420&issuetype=1&customfield_10010=hooray

So the task is to discover exactly what parameters are required for a particular operation.

Discovering HTTP parameters

HTTP parameters are most easily discovered with the LiveHTTPHeaders plugin for Firefox.
Install this plugin, and then navigate to the point before the operation you're interested in (eg. Step 2 in the issue creation process). Now open the LiveHTTPHeaders window, and submit the JIRA form to proceed with the operation. In the LiveHTTPHeaders window you will see the HTTP POST operation:

POST /secure/CreateIssueDetails.jspa HTTP/1.1
Host: jira.atlassian.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://jira.atlassian.com/secure/CreateIssue.jspa
Cookie: jira.conglomerate.cookie=navigator.filter.subheading.workratio=0; jira.conglomerate.cookie=;JSESSIONID=aWtQgyV8UTO9JioJG-; s_cc=true; s_sq=%5B%5BB%5D%5D
Content-Type: multipart/form-data; boundary=---------------------------20848862422003718001775908787
Content-Length: 2665
-----------------------------20848862422003718001775908787
Content-Disposition: form-data; name="summary"

My test issue
-----------------------------20848862422003718001775908787
Content-Disposition: form-data; name="description"

Test description
.....
-----------------------------2084886242200378001775908787

Content-Disposition: form-data; name="customfield_10061:1"

10104
-----------------------------20848862422003718001775908787
Content-Disposition: form-data; name="customfield_10170"


-----------------------------20848862422003718001775908787
Content-Disposition: form-data; name="pid"

10420
-----------------------------20848862422003718001775908787
Content-Disposition: form-data; name="issuetype"

1
-----------------------------20848862422003718001775908787
Content-Disposition: form-data; name="Create"

Create
-----------------------------20848862422003718001775908787--

From this, get the POST header URL:

/secure/CreateIssueDetails.jspa

then find the section for each field you're interested in, and construct a name:value pair for it, eg:

pid=10420
issuetype=1
summary=My test issue
description=Test description

Now construct a full URL, separating the URL from the parameters with '?', and each parameter from others with '&':

http://jira.atlassian.com/secure/CreateIssueDetails.jspa?pid=10420&issuetype=1&summary=My test issue&description=Test description

Finally for authentication, either:

• append &os_authType=basic and supply the login details outside the URL (-u username:password for curl, --username=user --password=pass for wget). This has the advantage of not showing your login details in access logs.
• append the special os_username and os_password parameters, which will log you in as a user to perform the operation:
  http://jira.atlassian.com/secure/CreateIssueDetails.jspa?pid=10420&issuetype=1&summary=My test issue&description=Test description&os_username=soaptester&os_password=soaptester

You can automate the submission of a URL like this with command-line
tools like wget or curl.

Scripting multi-stage operations

Some operations in JIRA require the accumulation of server-side state (in the user's session), and span multiple page requests. For this, you will need to store and reuse a cookie to tie multiple requests together.

With wget, this can be done as follows:

justin@asahi ~
$ wget --save-cookies cookies.txt --post-data 'os_username=justin&os_password=XXXX&os_cookie=true' http://localhost:8090/jira/login.jsp

This command perform the initial request to log you into your JIRA instance and also create a file in your home directory called cookies.txt.

So for any further requests you just need to reference the cookies.txt file and use a normal URL without appending any user details:

justin@asahi ~
$ wget --load-cookies cookies.txt -p http://localhost:8090/jira/browse/WEB-3

With curl, first use --cookie-jar to save the cookies on login:

$ curl  -u justin:XXXX --cookie-jar cookies.txt 'http://localhost:8080/secure/Dashboard.jspa?os_authType=basic' --head

Then use --cookie cookies.txt on subsequent requests.

Uploading file attachments

In JIRA 4.3 or later

The Atlassian REST API allows adding attachments:

$ curl -H "X-Atlassian-Token: no-check" -u justin:XXXX 'http://localhost:8080//rest/api/2.0-alpha1/issue/<issuekey>/attachments' -X POST -F file=@/path/to/file

Substitute in your own base URL, username/password, issue key, and file. You can specify multiple file parameters to upload multiple attachments. You can also explicitly set the name of the attachment, by using -F "file=@/path/to/file;filename=attachmentname".

In JIRA 4.1 or earlier

The simplest way to upload an attachment from the command-line is with curl (though I'm sure it's possible with wget too). Assuming you want to upload a file test.txt to JIRA at http://localhost:8080, you'd run:

curl -H "X-Atlassian-Token: no-check" 'http://localhost:8080/secure/AttachFile.jspa?id=10000&os_username=test&os_password=test' -F filename.1=@small.txt

The issue ID (10000) can be discovered by looking at the URLs for operations on the JIRA issue (comment, assign etc).

Bulk adding custom field options

If you need to add a lot of custom field options:

This operation can be easily scripted. Use LiveHTTPHeaders to analyse one submission:

POST /secure/admin/EditCustomFieldOptions!add.jspa HTTP/1.1

Host: localhost:8080

.....

Content-Type: application/x-www-form-urlencoded

Content-Length: 87

addValue=second&fieldConfigId=10031&selectedParentOptionId=&addSelectValue=true&Add=Add

So the URL is:

/secure/admin/EditCustomFieldOptions!add.jspa?
addValue=second&fieldConfigId=10031&selectedParentOptionId=&addSelectValue=true&Add=Add

Prepending the hostname, appending authentication parameters and moving the value to the end gives:

http://localhost:8080/secure/admin/EditCustomFieldOptions\!add.jspa?fieldConfigId=10031&selectedParentOptionId=&addSelectValue=true&os_username=test&os_password=test&addValue=second (http://localhost:8080/secure/admin/EditCustomFieldOptions\!add.jspa?fieldConfigId=10031&selectedParentOptionId=&addSelectValue=true&os_username=test&os_password=test&addValue=second)

So now we can add a third value from the command-line:

$ wget --header="X-Atlassian-Token: no-check" -q 'http://localhost:8080/secure/admin/EditCustomFieldOptions!add.jspa?fieldConfigId=10031&selectedParentOptionId=&addSelectValue=true&os_username=test&os_password=test&addValue=third'

or even bulk add options from a file or script:

$ for user in `cat /etc/passwd \| cut \-d: \-f1`; do
    wget --header="X-Atlassian-Token: no-check" -q 'http://localhost:8080/secure/admin/EditCustomFieldOptions!add.jspa?fieldConfigId=10031&selectedParentOptionId=&addSelectValue=true&os_username=test&os_password=test&addValue='$user
done

Bypassing XSRF protection

Many actions on JIRA have XSRF protection on them to ensure that they can't be executed using XSRF. One of the limitations of an XSRF attack is that an attacker cannot control the HTTP headers submitted by their victims browser. Hence JIRA has a custom HTTP header that can be used to bypass the XSRF token check. The name of this header is X-Atlassian-Token, and its value must be "no-check". To use this with wget, supply --header="X-Atlassian-Token: no-check", or with curl -H "X-Atlassian-Token: no-check".