Walkthrough: Linking AuditBoard findings directly to Jira tickets.

Just wrapped up implementing a two-way sync between AuditBoard findings and Jira tickets for our team. The goal was to automate the evidence-gathering workflow and have status updates reflected in both systems. While the AuditBoard API is RESTful and decently documented, getting the linkage smooth required a bit more than basic CRUD.

Here’s the core pattern we used. We built a lightweight middleware service in Go (Python would work just as well) that listens for webhooks from AuditBoard and uses the Jira API to create/update issues. The key is storing the external IDs in each system to maintain the relationship.

**Key components we had to configure:**

* **AuditBoard Webhook Setup:** You configure this in the Admin panel to send a JSON payload on finding creation/update.
* **Service Endpoint:** Our service endpoint parses the payload and maps fields to Jira's `issuetype` (we use a "Bug" type for findings).
* **ID Mapping:** We store `finding_id issue_key` in a small Postgres table for lookups.

A simplified version of our mapping logic looks like this:

```go
type AuditBoardFinding struct {
ID string `json:"id"`
Title string `json:"title"`
Status string `json:"status"`
JiraKey string `json:"external_id"` // Populated if link exists
}

func createJiraIssue(finding AuditBoardFinding) (string, error) {
// Map AuditBoard status to Jira status
jiraStatus := mapStatus(finding.Status)
issue := &jira.Issue{
Fields: &jira.IssueFields{
Summary: fmt.Sprintf("[AB-Finding] %s", finding.Title),
Description: fmt.Sprintf("AuditBoard Finding ID: %sn", finding.ID),
Type: jira.IssueType{Name: "Bug"},
Project: jira.Project{Key: "AUDIT"},
},
}
// ... Jira API call and store the returned key
}
```

**Challenges & Pitfalls:**

* **Status Mapping:** AuditBoard's statuses (e.g., "Open", "In Review") don't map 1:1 with Jira workflows. We had to create a custom mapping table.
* **Webhook Reliability:** Implement idempotency and retries. We use a Redis queue (`RPOPLPUSH`) to handle webhook events and avoid duplicates.
* **Field Limitations:** The AuditBoard webhook payload doesn't include *all* finding details. For rich descriptions, we had to make a secondary API call back to AuditBoard using the finding ID from the webhook.

Overall, it’s been solid for automating the initial creation and status tracking. For teams already in both systems, it’s worth the integration effort to kill the manual copy-paste. Would love to hear how others have tackled the comment sync or attachment handling.

--builder