Configure TWG CLI permissions

Permissions control what the Teamwork Graph CLI (TWG CLI) can do across your connected tools - essentially what it can read, write, manage, and delete. Configuring permissions correctly lets you give teams the access they need while protecting sensitive data in your organization.

For an overview of all CLI settings, see Manage TWG CLI settings for your organization.

Permission categories and default state

TWG CLI groups OAuth permissions into three categories:

• Read
• Write and manage
• Delete

By default, Allow all permissions by default is on. In this mode, TWG CLI can request all current OAuth permissions shown in Atlassian Administration, and new TWG CLI permissions added later are allowed automatically.

To manage permissions individually, turn Allow all permissions by default off. Each category then opens a side panel where you can select all permissions in that category, clear all permissions, or choose individual permissions.

These settings apply to personal OAuth 2.1 sign-in. Bitbucket commands use a separate token, and admin commands use an Atlassian Admin API key; these credentials aren't controlled by the OAuth permission settings. See How authentication works.

Change permissions

To change permissions:

1. Go to Atlassian Administration. Select your organization if you have more than one.
2. In the sidebar, select Rovo, then select Teamwork Graph CLI.
3. In Permissions, turn off Allow all permissions by default if you want to customize permissions.
4. Select a permission category: Read, Write and manage, or Delete.
5. In the side panel, use Select all or the individual permission toggles to choose which OAuth permissions TWG CLI can request.
6. Select Save.
7. Choose whether to Save without revoking or Save and revoke sessions.
8. Repeat for any other permission categories.

To block TWG CLI OAuth access for your organization, turn off Allow all permissions by default, clear the permissions in each category, save your changes, and choose Save and revoke sessions.

Revoke active sessions

When you save permission changes, Atlassian Administration asks whether to revoke active TWG CLI sessions.

• Save without revoking saves the new settings, but users may continue using existing sessions until they need to re-authenticate.
• Save and revoke sessions saves the new settings and requires users to authenticate again before TWG CLI can use the updated permissions.

Revoking sessions is recommended when you remove permissions or clear a permission category.

Server-side enforcement

OAuth permissions are enforced server-side by Atlassian, alongside the user's existing product permissions. Modifying the CLI binary or local config can't grant additional access. Permission changes can leave existing sessions usable until re-authentication; choose Save and revoke sessions when you need those sessions to use the updated permissions.

IP and location allowlists

IP and location allowlists configured in your Atlassian organization also apply to CLI requests. If a request originates from a blocked IP address, it's rejected regardless of the user's permissions.

Diagnose a blocked command

A blocked command appears as restricted, and you'll need to re-authenticate. If a command is unexpectedly blocked, check that:

• The OAuth permission the command needs is allowed in the relevant permission category.
• The request isn't originating from an IP address outside your organization's allowlist.
• The user has re-authenticated after recent permission changes or session revocation.

Next steps

• Manage TWG CLI settings for your organization
• Troubleshoot TWG CLI