Non-Administrator users can access REST API Browser by going directly to URL?

[James Roberts]

We have installed the Atlassian REST API Browser in our Confluence instance and have noticed that any user can get to the REST API Browser if they input the URL directly into their browser. Is this by design? Shouldn't the REST API Browser be limited to only confluence-administrators or some kind of configuration?

[Nic Brough -Adaptavist- · Accepted solution]

The REST API is for everyone.  They'll still have to authenticate, and it respects the security granted.

[James Roberts]

@Nic Brough -Adaptavist-, thanks for the quick response. I'm not concerned with the REST API itself as that should be available for anyone to use. I am looking at the Atlassian REST API Browser add-on from Atlassian Labs. The only way to get to it through the UI is through the Admin Console which is only available to confluence-administrators. However the REST API Browser can be navigated to by a normal Confluence user if they just type in the URL for the REST API Browser directly into their web browser.

[Nic Brough -Adaptavist-]

Ok, but why?  What is the problem?

[James Roberts]

If the only way to get there is through an Admin interface then users shouldn't be able to get there by navigating to the URL. They can also access Private APIs through the browser. I just wanted to make sure that this was by design or if it was something that needed to be addressed.

[Nic Brough -Adaptavist-]

It's by design, all the REST APIs are public.  The built in REST browser just has functionality that's additionally available on a url, which is shown to admins for their convenience, and not to users because most don't need it.

[chandler]

Hi Nic,

 If Single sign is enabled can the users still make REST API calls to Confluence ?

Thank you.