If remote API is enabled by default, how to secure

[Atflex]

Hello,

If remote API is enabled by default how can this be secured?

Does the REST follow the security structure of my Cloud instance?

How do I prevent users to extract data via API/REST from my confluence instance?

Regards,

Alexander

[Nic Brough -Adaptavist-]

The REST API has the same security as the web-ui, it respects all the permissions etc.

[Robert Massaioli (Atlassian)]

How do I prevent users to extract data via API/REST from my confluence instance?

What prevents your users from simply scraping pages that they can see?