Admin user receives 404 on specific REST queries

[clstewar]

My goal is to retrieve all Spaces and their assigned categories via REST. Some notes: 

• I have an user granted system admin privileges (Settings -> Global Permissions -> Individual Permission).
• I am able to authenticate this user via rest and return a full list of existing Spaces.
• I am able to return categories on Spaces that have Anonymous Access Enabled. Via Python:

import urllib.request
my_url = '<my_URL>/rest/api/space/<mySpaceKey>?expand=metadata.labels'
with urllib.request.urlopen(my_url) as response:
    html = response.read()

• The above, I'm able to process the return for what I need, where name key is my category, bolded for readability:

"metadata":{"labels":{"results":[{"prefix":"team","name":"general_category","id":"15686785"}

• The same user, I query a space that has Anonymous Access Disabled, and a 404 returns via Rest. When turning Anonymous Access on, I'm able to return what I'm looking for via REST.
• The same user, Anonymous Access Disabled, I access the query via web browser and I'm able to see the data I seek.

How can I access this data via REST without turning on Anonymous Access for all my Spaces? Thanks so much in advance!

[clstewar · Accepted solution]

Quick follow up to this as I found my issue / solution - Huge thanks to @Kishan Sharma as our conversation put me on the right path. Inevitably, this was a permissions issue.

My project is utilizing atlassian-python-api · PyPI to simplify my REST calls between Python and Confluence.  A shortfall of the package version I'm using (3.10.0) is that there are no direct calls to grab the Category of a Space, so I created a function to enable my own custom rest calls.

My error was thinking that authentication with my Confluence Rest Object (using atlassian-python-api) would propagate/cache existing credentials - this was not the case.  After updating my urllib calls from the original question to the below, I was successful.

import urllib
from requests import get

full_url = urllib.parse.urljoin(base_url, rest_url)
response = get(full_url, auth=(username, password))
html = response.content
tmp_json = html.decode("utf8")
rest_call_as_dictionary = json.loads(tmp_json)

[Kishan Sharma]

Welcome to the Atlassian Community @clstewar 

404 response is returned if the calling user does not have permission to view the content. For the space where you have anonymous access disabled, can you confirm if you also have space permissions added for the calling user ? If not, you will get a 404 error. You can try adding the calling user to space permissions and re-run the REST call to see the result.

[clstewar]

Hey @Kishan Sharma thanks so much for your response!

For the space where you have anonymous access disabled, can you confirm if you also have space permissions added for the calling user ?

My user has admin privileges set via Settings -> Global Permissions -> Individual Permission and has Green Check Marks for Personal Space, Create Space(s), Confluence Administrator, and System Administrator.  Do you know if this is the correct way to give a user global permissions?

What's weird is as logged in as that user when I access the rest call via web browser (https://<my_URL>/rest/api/space/<mySpaceKey>?expand=metadata.labels) I can see the data I expect (no 404), but when authenticated as the same user and making the same call via python, I get the 404 - but only on that page. I'm able to make successful rest calls with that user elsewhere.

I'm wondering if there are additional permissions settings with REST that I'm missing in Confluence.  I already have a similar instruction set working within Jira.

Thanks again!

[Kishan Sharma]

Hi @clstewar Yes, the settings you mentioned about global permissions are correct.

System admin user has complete control and access to all administrative functions. One thing you can check - if that user have permissions to the space either as a member of a group or individual permissions. But since you mentioned that you can see the data when you hit the rest call via web browser, the permissions looks fine to me,  which also means that it should work via REST.

I don't think any additional permissions settings are needed here while making REST call. Do you have Postman by any chance ? If yes, please try to GET using it to see what response do you get.

[clstewar]

@Kishan Sharma Thanks for confirming the global permissions settings!

One thing you can check - if that user have permissions to the space either as a member of a group or individual permissions.

It was my hope that a user w/ global System Administrator would not have to be explicitly added to each space where I want to query Category Labels. However, your comment made me think of another troubleshooting step - I added my user explicitly to a Space that I'm failing on and REST calls continue to fail.  So it appears I am only able to query a Space Category if that space has Anonymous Access enabled..

Do you have Postman by any chance ?

I do not, but willing to try anything at this point.  What are the benefits of using Postman vs using Python to make REST queries? Looking at it, I'm struggling with finding differences.

Thanks again!

[Kishan Sharma]

@clstewar You are right, I wanted to check whether adding the user explicitly to the space works or not. Since its still failing it's quite strange behavior. I would also suggest raising a case with Atlassian Support for further troubleshooting.

No worries if you don't have Postman, its simply user interface and several other features are popular amongst developers and most of them use it.