Manage Teamwork Graph CLI settings

Who can do this?Role: Organization admin, Site adminAtlassian Cloud: Standard, Premium, Enterprise plansAtlassian Government Cloud: Not availableYou can control which OAuth permissions Teamwork Graph CLI (TWG CLI) can request for your organization. These settings don't install or remove twg on anyone's device - they only govern what TWG CLI can do when users authenticate with OAuth.These settings don't install or remove Teamwork Graph CLI on anyone's device: they only govern how CLI access is permitted and under what rules.To learn how authentication works, see How does Teamwork Graph CLI authentication work?Access Teamwork Graph CLI settingsGo to Atlassian Administration. Select your organization if you have more than one. If you have access to only one site, it's selected automatically.Select Connectors, then Teamwork Graph CLI.By default, Allow all permissions by default is on. In this mode, TWG CLI can request all current OAuth permissions in the settings page, and new TWG CLI permissions added later are allowed automatically.Choose the default permission modeTo review and manage permissions individually, turn Allow all permissions by default off. You can then configure permissions in the Read, Write and manage, and Delete categories.There isn't a separate organization-level enable or disable toggle in the current OAuth settings. To block TWG CLI OAuth access, turn off Allow all permissions by default, clear the permissions in each category, save your changes, and choose Save and revoke sessions.Configure permission scopesUse write and delete access with cautionWhen write and delete permissions are enabled, users can create, edit, manage, or delete objects in your connected apps - such as Jira work items and Confluence pages - using the CLI. Only enable the permissions your organization genuinely needs.Use permissions to control what TWG CLI can do across your connected apps and tools. These permissions apply to OAuth 2.1, which is the only authentication method TWG CLI supports, except for Bitbucket commands.Revoke active sessions after changesWhen you save permission changes, Atlassian Administration asks whether to revoke active TWG CLI sessions:Save without revoking saves the new settings, but users may continue using existing sessions until they need to re-authenticate.Save and revoke sessions saves the new settings and requires users to authenticate again before TWG CLI can use the updated permissions.Revoking sessions is the fastest way to make permission reductions take effect for active users.Authentication postureEach user authenticates with OAuth 2.1 during setup. Authentication happens at the user level, while organization settings control the OAuth permissions TWG CLI is allowed to request.Bitbucket is the only exception to OAuth support. Bitbucket commands require a separate Bitbucket token and aren't controlled by these OAuth permission settings.How TWG CLI shows up in audit logsTWG CLI actions are visible in Atlassian audit logs. Go to Atlassian Administration, then Insights, then Audit log. The captured event details include the following fields:Name of the command (for example, jira workitem get)Family of the command (for example, jira.workitem)Type of command (read, write, or delete)Status code of the command callInvocation source (user or agent)Permissions used to make the command callTWG CLI version used in the command callTrace ID for debuggingAny command run by a user who's logged in sends an event to the audit log. Audit logs are organized in Atlassian Administration by the user's org ID. You can filter logs by:Activity dropdown — select Invoked TWG CLI command to view all TWG CLI logs.Command name (such as jira workitem get).Actor — always the user's name, not an AI agent.Each entry contains the full JSON event and associated event details.IP allowlist behaviorTWG CLI respects all the IP allowlists configured for your organization. Share feedback or report a bug