The JSON endpoint will be requested by frontend using a JWT that
Atlassian provides via Javascript. This JWT will likely use a
context-qsh because Atlassian don't know for which
endpoint it will be used.

Read more about context JWT here:
https://developer.atlassian.com/cloud/jira/platform/understanding-jwt-for-connect-apps/