Scoped API Token returns Unauthorized for simple query

[Luis Blanche]

Hi, I am trying to use the Confluence API, end while everything works when I am using an API token without scope, whenever I try to switch to a scope token I get 401  Unauthorized errors. 

Here is an exemple from i took from the API doc :

import json

import os

import requests

from requests.auth import HTTPBasicAuth

url = f"https://{your_domain}/wiki/api/v2/pages/{page_id}"

auth = HTTPBasicAuth(my_email, os.getenv("CONFLUENCE_API_TOKEN_READ_PAGE"))

headers = {"Accept": "application/json"}

response = requests.request("GET", url, headers=headers, auth=auth)

print(json.dumps(json.loads(response.text), sort_keys=True, indent=4, separators=(",", ": ")))



So when I set  CONFLUENCE_API_TOKEN_READ_PAGE to my token without scopes this works and returns 200

But when I create a scoped token with scope : read:page:confluence

Then i get a 401 Unauthorized HTTP Error. 

I am following the snippet from the doc almost exactly and the only thing that changes between the working version and the failing one is the Token. 

[Oliver Siebenmarck _Polymetis Apps_ · Accepted solution]

Hi @Luis Blanche ,

Welcome to the community!

The scoped API tokens are relatively new and unfortunately not well-documented. One particular difference to the unscoped tokens is how the endpoint URL is constructed. Whereas unscoped tokens use an endpoint like the one you tried, the scoped tokens need endpoints constructed like this:

https://api.atlassian.com/ex/confluence/{cloudid}/{api} 

There's a bit more info on this type of endpoint available here, but please not that the endpoint should be the only change you need to make to your code.

As for obtaining the cloudid, the approach outlined in the OAuth documentation did not work for me, I typically just inspect traffic from Confluence's UI to the backend and look for GraphQL calls: they often include the cloudid. I am sure there other ways, but I do not know a more convenient one.

Anyway hope that helps and props for using a scoped token! Security matters and scoped tokens are a fantastic way to reduce risk.

Best regards,
 Oliver from Polymetis Apps

[Luis Blanche]

Hi @Oliver Siebenmarck _Polymetis Apps_ 
Thanks for answering. 
For the cloud_id I was able to find it following this link : 

 https://{your-domain}.atlassian.net/_edge/tenant_info

Then using the different endpoint like you said worked out ! Thank you