Functional users

A functional user is a non-human service account designed to facilitate automated tasks and system-to-system integrations. Unlike standard users, functional users are not tied to a specific individual or email address, ensuring that automated workflows remain uninterrupted even when team members change or leave the organization.

Creating functional users

For security, only an Administrator can create functional users, and only through the API.

Use the /api/v4/User/CreateFunctionalUser API endpoint to create a functional user. Include at least the following parameters:

FirstName: A descriptive account name (for example, "Jira_Automation_Service").
RoleId: The role to assign to the functional user. Retrieve the RoleId using the following API:
```
api/v4/Roles
```

Tip:

An active email address is optional, but you can assign one if needed.
If the user is not an Administrator, associate the user with asset groups. You can add this later, but it is essential for the user to perform tasks in application-related contexts.
Retrieve the AssetGroupIds by using the following API:
```
api/v4/AssetGroups
```

After a successful POST request, the response includes the API key, and the system creates a functional user with an automatically generated username in the format <FirstName>_Func_<OrgID>.

Important: The API key is displayed only once. Copy it immediately and store it in a secure location (such as a secrets manager). It will not be visible in the UI or accessible via subsequent API calls.

Managing functional users in the UI

After you create them via the API, functional users appear in the User Management table alongside all other users and are treated as standard users. For available actions, see the User management page.

To filter the list of functional users, search for the keyword "func".

API key rotation

You can rotate API keys when needed.

Process: Perform key rotation through the API.
Immediate expiration: When you generate a new API key, the previous key expires immediately. Update your automation scripts and integrations right away to prevent downtime.
One-time view: As with initial creation, the new key is returned only once in the API response and must be saved locally.