API token-based Basic authentication not working for /download/attachments/ endpoint

[Anjana V K]

Hi,

API token-based Basic authentication works correctly for all Confluence REST API endpoints EXCEPT the /download/attachments/ endpoint, which consistently returns HTTP 401 Unauthorized.

**Observed Behavior**
The following REST API calls succeed with Basic Auth (email + API token):
- GET /wiki/rest/api/content/{pageId} — returns page data ✓
- GET /wiki/rest/api/content/{pageId}/child/page — returns child pages ✓
- GET /wiki/rest/api/content/{pageId}/child/attachment — returns attachment metadata including download URLs ✓

However, when using the download URL returned by the attachment metadata API (e.g. /wiki/download/attachments/{pageId}/{filename}?version=1&...), the same Basic Auth credentials return:

  HTTP 401 Unauthorized

The attachment metadata API itself confirms the file exists and returns a valid download URL. The credentials are correct — they work on all other endpoints in the same session.

**Questions**
1. Is Basic Auth intentionally disabled for the /download/attachments/ endpoint on Confluence Cloud?
2. If so, is there a supported REST API alternative endpoint for downloading attachment content using API token authentication?
3. Is this restriction documented anywhere? I was unable to find any reference to this in the Confluence Cloud REST API documentation.

Any guidance or a supported alternative approach would be greatly appreciated.

[Arkadiusz Wroblewski · Accepted solution]

Hello @Anjana V K 

The /wiki/download/attachments/... path is meant for the browser UI, which is why it's throwing a 401. Instead, grab the attachment ID from the metadata endpoint and use the official REST path: GET /wiki/rest/api/content/{pageId}/child/attachment/{attachmentId}/download.

Make sure to include the -L flag if you're using curl, as this endpoint returns a redirect to the storage location. If you still get blocked, ensure your client sends the Authorization header upfront, or switch to the [api.atlassian.com/ex/confluence/](https://api.atlassian.com/ex/confluence/){cloudId} URL format if you're using a scoped OAuth token.

[Anjana V K]

Ok, will try it out and update. Thanks for the suggestion. 

[Anjana V K]

Thank you @Arkadiusz Wroblewski . This worked. 

[Arkadiusz Wroblewski]

@Anjana V K 

That’s awesome, glad to hear it. 🙂

Have a good day!