403 not authorized when connecting to API with scoped token

[David Soucie]

I am attempting to write a CustomGPT that will combine data from several sources, one of which is confluence.  

If I go to https://id.atlassian.com/manage-profile/security/api-tokens and generate a token without scopes, encode it with my username and use it in the request, it works fine, but if I try and limit the scopes in any way, it returns a 403.

I don't think the issue is the baseURL or pageID I'm providing because it works with an an unscoped token, but doesn't work with a scoped token

[Jayesh Raghuvanshi]

@David Soucie 

Scoped API tokens in Confluence Cloud only work via the Atlassian platform domain and require your site’s cloudId, so calling your site URL with a scoped token returns 403 even though an unscoped (classic) token works against the site URL. Use https://api.atlassian.com/ex/confluence/{cloudId}/… with Basic auth (email:scopedToken) and ensure the token includes the scopes needed for the endpoint you’re hitting.

Base URL: https://api.atlassian.com/ex/confluence/{cloudId}/… with Basic auth, using email:scoped_token (curl -u) or Authorization: Basic base64(email:token)

Example (audit log):
curl --request GET --url 'https://api.atlassian.com/ex/confluence/<cloudId>/wiki/rest/api/audit' --user 'your_email:scoped_api_token' --header 'Accept: application/json'

Get it from your site: https://your-site.atlassian.net/_edge/tenant_info returns {"cloudId":"<id>"} which you then place in the platform URL path

Thanks
Jayesh R

[marc -Collabello--Phase Locked-]

Scoped and unscoped tokens use different urls.  Unscoped use yourinstance.atlassian.net, and scoped use api.atlassian.com.

[Benjamin Anderson]

403 with a scoped token usually means it lacks the required permissions for that API call. Make sure all necessary scopes for Confluence are included.

[Thiago P _Atlassian Support_]

Hey there @David Soucie ,

Complementing on what @marc -Collabello--Phase Locked- mentioned, the URL used for scoped API tokens is the following:

https://api.atlassian.com/ex/confluence/<cloud-id> --user user@domain.com:api-token

For further details, make sure to review Manage API tokens for your Atlassian account.

Hope this helps! =]