Granular token authorization principles

Follow these rules when you add granular token authorization to an endpoint. For the syntax, see the REST API implementation guide and the GraphQL implementation guide.

The token authorizes the API call

A granular token check applies to the resource named in the request path.

An operation might touch other resources too. The token check does not apply to those. The user permission check handles them, because the request runs as the token owner.

For example, an issue move also touches the target project, but the token only authorizes the call on the project in the request path.