A Jira issue that returns 404 to a Forge app may still exist: in one Jira Cloud test, organization policy hid the issue from the app while the same issue remained readable to a user. Before treating a 404 or empty search as deletion, check the project’s data-policy metadata and handle blocked-content events as policy signals—not proof that every object in the project is blocked.
Why a 404 or empty search is not enough to establish deletion
In a test run on 2026-09-28, a Forge app’s issue read returned HTTP 404 with the message Issue does not exist or you do not have permission to see it. A JQL search returned HTTP 200 with an empty issues array. The project remained readable, and the author could read the issue as a user. These are observations from one personal Jira Cloud test site, not confirmation that every Jira site responds the same way.
As an Amazon Associate I earn from qualifying purchases.
The practical distinction is that an app’s response can reflect policy-limited visibility as well as missing content. An empty search is not a reliable deletion signal either: the report found that the app’s search omitted the blocked issue.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCheck project policy metadata before acting on an issue response
The report found that the Jira endpoint /rest/api/3/data-policy/project?ids=<projectId> remained available for the tested blocked project and returned anyContentBlocked: true. Use the project-level value as a policy check before interpreting a 404 or empty result as evidence that content was deleted.
#1 Best Overall
- Identify the issue’s project. Obtain the project ID associated with the issue or search context.
- Request the project policy state. Call
/rest/api/3/data-policy/project?ids=<projectId>using the app’s Jira API access. - Inspect
anyContentBlocked. If it is true, treat the missing issue or empty search as potentially policy-related; do not delete cached user data solely on that basis. - Apply the result to the right scope. The project-level flag identifies a project with blocked content; it does not identify which individual issues are blocked.
The endpoint and response behavior above come from a single test report. Confirm the endpoint’s current contract and your app’s permissions against Atlassian’s current documentation before relying on it in production.
Use each blocked event for the signal it provides
The report names two blocked event types. Subscribe according to whether your app needs object-level identification or project-level awareness:
| Signal | What the report says it identifies | Implementation use |
|---|---|---|
avi:ecosystem.app_policy:blocked:app_access_to_objects.v2 |
Blocked objects | Use when the app needs to identify affected issues or other objects. |
avi:ecosystem.app_policy:blocked:app_access_to_objects_in_container.v2 |
The affected project container | Use to learn that a project has policy impact; do not infer that every object in it is blocked. |
The test log contained 36 deliveries of each event type in that single run. That is a run-specific observation, not a typical delivery rate or a service-wide statistic.
Make event handling safe to repeat
The author observed container events delivered more than once with different event IDs but matching type, payload data, and time. Because this duplicate delivery was observed in only one test, it should not be treated as a documented frequency. It is still prudent to make event-driven work idempotent: repeated handling should not duplicate destructive actions, notifications, or records.
- Use the event type, payload data, and time as deduplication inputs where suitable for your event processing.
- Make side effects safe to repeat even when deduplication misses a duplicate.
- Do not assume a container event lists every affected issue; use object-level events when object identification is required.
Check policy state at startup and after changes
The report observed no event when an app was installed while a block was already active, and no event when access was unblocked. An event-only design can therefore miss both pre-existing blocks and the return of access.
- At app startup, check policy state for relevant projects rather than relying only on events received after installation.
- Recheck affected projects when your app needs to determine whether access has returned.
- When a result may be incomplete, tell users that organization policy can limit what the app can see instead of labeling unseen content as deleted.
Keep the report’s limits in view
The test was conducted on a personal Jira Cloud site on 2026-09-28, using Forge CLI 12.21.0 and @forge/api 8.1.0. It is a single-site field report, so its observations should guide defensive handling rather than be generalized as universal Jira behavior.
Some behavior remains unexplained or untested in that report. The site-level /rest/api/3/data-policy flag reportedly stayed true after the tested project block was removed, although the project-level value changed to false. A publishDraftPolicies deletion request returned 202 without removing the tested policies, while a versioned policy-delete call restored access; the report does not establish why. It also did not test Confluence, the object-event splitting threshold, or whether a container policy could be published by itself. Do not build an implementation assumption around these observations.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
