User Management and License Optimizer for Jira and ConfluenceUser Management and License Optimizer for Jira and Confluence

Combining Webhooks and Rovo for Audit-Aware Automation

User Manager 3.16.0 ships structured webhook payloads. User Manager 3.18.0 ships the User Manager Rovo agent. Together they close the loop: the webhook fires when something happens; the agent turns the payload into a human-readable summary that you can route to Confluence, Slack, or a Jira incident issue.

This page is a cookbook. Each recipe is self-contained: trigger, agent prompt, final action, and a sanitized JSON export you can import into Atlassian Automation.

Scope. Webhooks fire on Automated Tasks (taskSuccess / taskFailure) and the Organization API Key 7-day expiry check (orgKeyExpiry). Interactive Bulk Operations do not fire webhooks.

How the recipes are wired

Every recipe is the same three-step shape. Only the final action changes.

recipe1-flow-builder.webp
Three-step shape shared by every recipe: Incoming webhook, Use agent (User Manager), Final action.
  1. Incoming webhook (no work items) -> Use agent (User Manager) -> Final action

{{webhookData.*}} smart values are available everywhere downstream. The agent step exposes its formatted output as {{agentResponse}} for the final action to consume.

Shared setup (do once per recipe)

  1. Atlassian Automation -> Create flow -> Incoming webhook trigger.

  2. Set Work item criteria = No work items from the webhook. The other two options reject the request because the body carries no Jira work items.

  3. Save or enable the flow. The Webhook URL and Secret appear only after the first save.

  4. Add the steps for the recipe you want (below).

  5. In User Manager: Settings -> Notification Settings -> Add Webhook. Paste the URL + Secret. Pick the trigger(s) the recipe needs. Save.

Use the recipe's agent prompt verbatim. The prompts are tuned to call search-task-results with the processId from the webhook, resolve user / group / app IDs to human names, and emit a format the final action can render directly.

Recipe 1: Auto-published Confluence audit page per task run

When: Every Automated Task completes. You want a stakeholder-friendly summary on a dated Confluence page.

Triggers: Task Success and Task Failure.

Sample result page:

working-flow-confluence-result.webp
Recipe 1 result: a dated Confluence page containing the webhook payload and per-user changes.

Agent prompt

  1. You receive a User Manager (UCM) webhook payload for a completed automated task.
  2. Format as Markdown.
  4. # Webhook payload
  6. | Field | Value |
  7. | --- | --- |
  8. | trigger | {{webhookData.trigger}} |
  9. | processId | {{webhookData.processId}} |
  10. | name | {{webhookData.name}} |
  11. | actionTypes | {{webhookData.actionTypes}} |
  12. | deepLink | {{webhookData.deepLink}} |
  14. Then call your `search-task-results` action with processId
  15. `{{webhookData.processId}}` and append:
  17. # Per-user changes
  19. | User | Email | Groups added | Groups removed | App access removed | Suspended |
  20. | --- | --- | --- | --- | --- | --- |
  22. One row per user from `userChanges[]`. Resolve user names + group names
  23. (no UUIDs). Use `-` for empty cells.
  25. Return only the Markdown. No preamble, no commentary.
  26. Make the deepLink clickable. The link on a user must point to the User Browser
  27. filtered to that user, not the Atlassian `/people/...` profile.

Final action

Publish new page in Confluence. Space + parent page = your stakeholder hub. Title: User Changes {{now()}}. Body: {{agentResponse}}.

Sanitized JSON

Recipe 2: Slack alert with affected-user summary

When: Every Automated Task completes (success or failure). You want a real-time message in a Slack channel.

Triggers: Task Success and Task Failure.

Sample Slack post:

recipe-slack-rendered.webp
Recipe 2 result: Slack message with status, run summary, and affected-user list.

Flow shape:

recipe-slack-flow-builder.webp
Recipe 2 flow shape: Incoming webhook, Use agent (User Manager), Send message (Slack integration).

Agent prompt

  1. You receive a User Manager (UCM) webhook payload from an Automated Task that
  2. has just completed. Format output as Slack mrkdwn (NOT Markdown). Slack does
  3. not render Markdown tables, so use compact lines and bullets instead.
  5. Payload
  7. trigger: {{webhookData.trigger}}
  8. processId: {{webhookData.processId}}
  9. name: {{webhookData.name}}
  10. actionTypes: {{webhookData.actionTypes}}
  11. deepLink: {{webhookData.deepLink}}
  13. Call your `search-task-results` action with processId
  14. `{{webhookData.processId}}` and produce output in this exact shape:
  16. ----
  17. {status_emoji} *{{webhookData.name}}* - `{{webhookData.trigger}}`
  19. Actions: `{{webhookData.actionTypes}}`
  20. <{{webhookData.deepLink}}|Open in User Manager>
  22. *Run summary*
  23. - Users updated: `{usersUpdated}` (`{failedCount}` failed)
  24. - Group ops: +`{groupsAdded}` / -`{groupsRemoved}`
  25. - App access removed: `{appAccessRemoved}`
  26. - Suspended: `{usersSuspended}` - Restored: `{usersRestored}`
  28. *Affected users* ({totalUserChanges})
  29. - <user-browser-link|Name> (email) - _action summary_
  30. - ...one bullet per user, max 10. If more, append "...and N more."
  32. If totalUserChanges is 0, replace the "Affected users" section with a
  33. single line: "_No per-user changes._"
  35. ----
  37. Rules:
  38. - {status_emoji} = `:white_check_mark:` if trigger=taskSuccess and failedCount=0;
  39. `:warning:` if taskSuccess and failedCount>0; `:x:` if taskFailure.
  40. - Backticks around all values to keep them monospaced in Slack.
  41. - Links use Slack format `<url|label>`, never `[label](url)`.
  42. - Bold uses single `*`, not `**`.
  43. - Action summary per user: comma-joined human-readable strings. Resolve
  44. group UUIDs to group names. Resolve app types to display names
  45. (Confluence, Jira, Assets, Customer Service - not raw `confluence` /
  46. `cmdb`). Examples: `+deactivated_users, -admins, -Confluence access`,
  47. `suspended`.
  48. - Replace any default `/people/...` link on a username with the User
  49. Browser deep link filtered to that user.
  50. - Output ONLY the Slack mrkdwn block above (between the dashed lines but
  51. WITHOUT the dashes). No preamble, no commentary, no triple-backtick wrapper.

Final action

Send message (Slack integration). Authorise Slack on first use. Pick your channel. Message payload: {{agentResponse}}.

Sanitized JSON

Recipe 3: Auto-create a Jira incident on taskFailure

When: An Automated Task reports failure (or partial failure) and you want the on-call admin to investigate without context-switching.

Triggers: Task Failure. In production, configure the User Manager webhook with Task Failure only - the rule should not run on every success.

Sample incident issue:

recipe3-wr3-incident.webp
Recipe 3 result: Jira incident issue with resolved per-user changes in the description.

Flow shape:

recipe3-flow-builder.webp
Recipe 3 flow shape: Incoming webhook, Use agent (User Manager), Create work item.

Agent prompt

  1. An Automated Task in User Manager has FAILED. Webhook payload:
  3. trigger: {{webhookData.trigger}}
  4. processId: {{webhookData.processId}}
  5. name: {{webhookData.name}}
  6. actionTypes: {{webhookData.actionTypes}}
  7. deepLink: {{webhookData.deepLink}}
  9. Call your `search-task-results` action with processId
  10. `{{webhookData.processId}}` and produce a concise incident report in Markdown:
  12. # Incident: {{webhookData.name}} failed
  14. **processId**: `{{webhookData.processId}}`
  15. **Open in User Manager**: {{webhookData.deepLink}}
  17. ## Affected users
  19. A Markdown table with columns: User | Email | Action attempted | Outcome.
  20. One row per user from `userChanges[]`. Resolve user names + group names +
  21. app types. Mark `failedCount > 0` rows clearly. Use `-` for empty cells.
  23. ## Recommended next steps
  25. Two or three bullet points based on the action types and failure pattern.
  27. Return only the Markdown.

Final action

Create work item in your admin project. Pick an explicit Issue type - leaving "Same work type" fails validation because the webhook trigger carries no work item. Summary: UCM Task Failed. Description: {{agentResponse}}.

Sanitized JSON

- includes the trigger + Use agent + Create work item chain. After import, reconnect Rovo, point Create work item at your project, and add a fresh webhook URL in User Manager Settings.

Recipe 4: API key expiry escalation

When: An Organization API key enters the 7-day expiry window.

Triggers: Organization Key Expiry.

No Rovo step needed - the payload is self-contained.

Steps

  1. (Optional) Add a condition: {{webhookData.trigger}} equals orgKeyExpiry. Skip if the User Manager webhook is wired to only this trigger.

  2. Send email. Recipients: ops alias. Subject: UCM API key '{{webhookData.name}}' expires {{webhookData.expiresAt}}. Body: includes {{webhookData.settingsUrl}} so the recipient lands on the Webhooks settings page.

  3. Create work item. Pick an admin project + explicit issue type. Summary: Rotate UCM API key: {{webhookData.name}}. Description references {{webhookData.apiKeyId}} + {{webhookData.settingsUrl}}. Due date: {{webhookData.expiresAt}} minus 2 days. Priority P2.

(No agent step. The agent can help during the rotation if someone asks "which webhooks rely on the key expiring on 2026-05-27?")

What the agent will tell you that the payload will not

Question

Payload alone

Payload + Rovo

Task finished

yes (trigger)

yes

Task name and actions

yes

yes

Which users were touched

no

yes - resolved names

Which items failed inside the run

no

yes - via search-task-results per processId

Which groups were added or removed per user

no

yes - resolved names

Whether the result modal opens to the right run

yes via deepLink

yes

Whether a different recent task touched the same users

no

yes - ask Rovo

Limits worth knowing

  • The Rovo agent is read-only. Recipes can post messages, create issues, and open pages; they cannot reverse a user-management action automatically.

  • taskSuccess and taskFailure are top-level statuses. Use search-task-results for partial-failure detail.

  • The webhook URL field in User Manager accepts only Atlassian Automation endpoints. To reach Slack or email, route through an Automation rule.

  • Bulk Operations do not fire webhooks. Convert recurring bulk ops into Automated Tasks if you want them in these recipes.

  • Atlassian Automation hides the resolved smart-value contents of action steps in its Audit Log. To inspect actual webhookData values, route them through a visible artifact: a Confluence page (Recipe 1), a Slack message (Recipe 2), or a Jira issue description (Recipe 3).

Delivery

Webhook delivery uses a CapacityLimiter and a webhook-delivery fail-recovery strategy. Transient delivery failures are retried up to 3 times. Treat the Audit Log of the receiving Atlassian Automation rule as the authoritative record of arrival; if the webhook does not arrive there at all, contact User Manager support.