Jira account provisioning failed: Atlassian access request API error troubleshooting

TL;DR

Validate the site, the request payload, and the product access state before retrying the create. Check whether the user already has an Atlassian account, whether the site requires admin approval, and whether the API caller has site admin rights, then submit a corrected request or grant access directly and confirm the hire can sign in and open the intended projects.

Jira account provisioning failed: Atlassian access request API error

Use this when

• The provisioning job calls the Atlassian access request or user APIs and receives a 400 or 403 style error.
• Some hires provision while others fail, often those with existing Atlassian accounts from other sites.
• The Jira site shows no pending access request for the failed hires.

Not for this skill when

• The hire can sign in but cannot see a specific project. That is project permission configuration, not provisioning.
• The whole Atlassian site is unavailable. Wait for the vendor incident to resolve first.

Steps

1. Capture the exact API response body from the provisioning log, including the error code and field details, and note the endpoint and site the job called. Atlassian errors are specific, and the body usually names the invalid field or the missing permission. Verify: the full response body is recorded for the failing hire
2. Check the hire in Atlassian Administration under User management for the site: look for an existing Atlassian account with the same email, a suspended account, or a pending invitation from another product such as Confluence or Bitbucket. Verify: the account pre-state in Atlassian is known
3. Confirm the API caller identity is a site or organization admin for that specific site, because access request endpoints reject product-only admins and personal accounts without the admin role. Test the same call with an admin session if the log is ambiguous. Verify: the caller admin role on the target site is confirmed
4. Correct the request: use the exact site identifier, send only supported fields with valid values, and when approval is required either create the access request for an admin to approve or grant product access directly through user management. Match the product list to the role, typically Jira Software for engineering hires. Verify: the corrected request returns success or a visible pending approval
5. Confirm the hire completes account setup, signs in, and opens the team project with the expected permission level, then record the Atlassian account id on the onboarding record so later group sync steps reference it. Verify: the hire has working sign-in and project access
6. Update the provisioning job to look up the account first and branch between create, invite, request approval, and direct grant, and log the branch taken per hire so future failures show their context immediately. Verify: the job logs the chosen branch for a test hire

Why it happens

Atlassian separates the account, the site access request, and product access into different layers, each with its own API rules and admin requirements. A job written against one layer fails on another with a generic API error, especially when the person already holds an account from a different Atlassian product or site. Approval-required sites add a human step the API alone cannot complete. Mapping the job to the layered model, look up first, then create, request, or grant as appropriate, makes each hire take the path that matches their actual state.

Variants and edge cases

Existing account from a personal Atlassian signup

Users who tried Jira with the same email own that account already. Invite the existing account to the site rather than creating a new one, and guide the hire through the merge prompts.

Managed accounts and domain claim

If the domain is claimed by another Atlassian organization, invites route to that org. Coordinate with that org admin or use the verified corporate domain for the hire account.

Access request approved but product still missing

Approval grants site access, not always product access. Check the product access groups for the site and add the hire group explicitly.

Compatibility: Applies to Jira Cloud with Atlassian Administration user management and access requests. Requires site admin or organization admin rights.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VFCTWD5ZoILTWky74sKNtg