Authenticate to the Jira Cloud REST API using an API token (generated at id.atlassian.com) with HTTP Basic auth (user email + token) or OAuth 2.0; use the base URL https://{your-domain}.atlassian.net/rest/api/3/.
Before creating a ticket, search for an existing issue with the same vulnerability fingerprint (CVE ID + asset ID) using POST /rest/api/3/issue/picker or GET /rest/api/3/search with a JQL query such as project={PROJECT} AND labels={CVE-ID} AND labels={ASSET-ID} AND statusCategory != Done to prevent duplicates.
Create a new issue with POST /rest/api/3/issue if no duplicate is found; populate summary, description (vuln title, CVE, CVSS score, affected asset, remediation guidance), labels (CVE ID, asset ID, severity), priority, and a due date calculated from an SLA policy (e.g., Critical: 7 days, High: 30 days).
Store the Jira issue key (e.g., SEC-1234) back in your vulnerability management system against the finding, to enable bidirectional status sync and prevent re-creation on subsequent pipeline runs.
Implement a daily sync job that queries your vulnerability scanner for findings whose status changed to Fixed, then transitions the corresponding Jira issue to Done via POST /rest/api/3/issue/{issueId}/transitions using the correct transition ID obtained from GET /rest/api/3/issue/{issueId}/transitions.
Known gotchas
Jira transition IDs are project-specific and cannot be hard-coded across projects; always fetch available transitions dynamically via GET /transitions before attempting a status change to avoid HTTP 400 errors.
Using only CVE ID as a dedup key will conflate the same CVE across multiple assets into a single ticket, masking blast radius; always include the asset identifier in the dedup fingerprint.
Jira Cloud API v3 uses Atlassian Document Format (ADF) for description fields, not plain text or HTML; passing a plain string in the description field returns HTTP 400 — construct ADF objects or use a helper library.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp