Connect Atlassian (Jira + Bitbucket)

What it pulls

Jira: projects, 30-day throughput, created→resolved lead time, open/aging issues. Bitbucket (optional): repository count + pipeline cadence & failure rate across a repo sample.

The exact fields the connect form asks for — and where to find each value.

Jira site URL

Your Jira web address — the part before /jira, e.g. https://acme.atlassian.net.

Atlassian account email

The email you log into Atlassian with — it must be the account that created the API token below.

API token

id.atlassian.com → Security → API tokens → Create API token → copy the value (shown once).

Bitbucket workspace (optional)

Only for Bitbucket DORA metrics — the workspace in bitbucket.org/<workspace>. Skip to use Jira only.

Bitbucket username (optional)

Your Bitbucket username (Personal settings → Account).

Bitbucket app password (optional)

Bitbucket → Personal settings → App passwords → Create with Repositories: Read + Pipelines: Read (separate from the Jira token).

1. 1

   Identify your Jira site

   Put your site root in Jira site URL — it must be https://your-domain.atlassian.net, not a path like /browse or /jira.

2. 2

   Use the email that owns the token

   Basic auth pairs the API token with the account that created it, so put THAT exact Atlassian account email in Atlassian account email — a mismatch returns 401.

3. 3

   Create a Jira API token

   Open id.atlassian.com → Security → API tokens → Create API token, label it “ShipReady Metrics”, copy the value, and paste it into the API token field (shown once).

4. 4

   Optional — add Bitbucket for DORA

   For deployment frequency + change-failure rate: Bitbucket → Personal settings → App passwords → Create with Repositories: Read and Pipelines: Read. Paste the app password (NOT the Jira token) plus the Bitbucket workspace and username. Leave blank to skip.

5. 5

   Connect

   Click Connect — we validate the email + token against Jira (and Bitbucket if provided), encrypt the credentials at rest, then sync.

Signals this integration collects that are relevant to audit readiness across SOC 2, ISO 27001, NIST CSF, CIS, PCI DSS, and SOX. This is a map of coverage, not a pipeline: the integration writes metrics and security findings, and does not file compliance evidence for you. Nothing here becomes a control verdict on its own — cite these signals yourself when assembling evidence.

Bitbucket default-branch protection + required PR reviews / passing builds

Change Management

Atlassian Guard SSO, two-step (MFA), and SCIM lifecycle enforcement

Access Control & Identity Governance

Jira Service Management resolved incidents + linked response plan

Incident Response

Confluence current information-security policy + approved procedure pages

Policy & Procedure Management

Opsgenie on-call rotation, escalation policy, and 24/7 coverage

Operational Resilience

Compass service-catalogue components (classified + owned)

Asset Inventory

Registered Atlassian AI systems (Intelligence / Rovo) + acceptable-use + oversight

AI Governance