Bulk remove users from 'confluence-users-xxxxx' group as user license cleanup API errors

[Darren Johnston]

Using python script to connect to atlassian API

was working 6  months ago.
Now getting:
03 Error - ['{"statusCode":403,"message":"com.atlassian.confluence.mvc.rest.common.exception.StacklessResponseStatusException: 403 FORBIDDEN \\"Request rejected because caller cannot access Confluence\\""}']

using this  endpoint

https://{BASE_URL}/wiki/rest/api/group/user

last admin was using 

endpoint 

f"https://{BASE_URL}/rest/api/3/group/user"  which is a Jira  endpoint but auth fail error for that one.

 any hints on what I doing wrong here??

[Tomislav Tobijas]

Hey @Darren Johnston ,

Are you using the user's API token or service account for this?

Can you try using scoped API tokens as described here: Scoped API Tokens in Confluence Cloud?
Note that you'll have to use a slightly different format here:

https://api.atlassian.com/ex/confluence/{cloudId}/wiki/rest/api/group/user

When talking about scripts and authentication, you can use these two methods:

• Basic Auth (Recommended for scripts): You must Base64-encode the string email:api_token.

  • Header: Authorization: Basic <base64_encoded_credentials>

• Bearer Token: If you are using a Service Account API key specifically designed for Bearer auth, use:

  • Header: Authorization: Bearer <api_key>

Can you try configuring these and see how that will go?

Cheers,
Tobi

[Darren Johnston]

HI Tomislav,
tried scoped 
with 

https://{BASE_URL}/ex/confluence/{CLOUD_ID}/wiki/rest/api/group/user

also tried 

https://{BASE_URL}/admin/v1/orgs/{ORG_ID}/directory/groups/{GROUP_ID}/memberships/{account_id}"
#getting Unauthorized error
and
"Request rejected because caller cannot access Confluence

[Tomislav Tobijas]

@Darren Johnston are you using an API token from your account or service account? There's a difference between the two as explained above.
Also, which scopes have you selected?

I could try/test this in the coming days to see what response I get when using one or the other.

[Darren Johnston]

Hi using my account
adding most of the scopes available as thought maybe something missing there.

Read
read:account
read:configuration:confluence
read:confluence-content.all
read:confluence-content.permission
read:confluence-content.summary
read:confluence-groups
read:confluence-props
read:confluence-space.summary
read:confluence-user
read:content-details:confluence
read:content:confluence
read:analytics.content:confluence
read:app-data:confluence
read:attachment:confluence
read:audit-log:confluence
read:blogpost:confluence
read:comment:confluence
Manage
manage:confluence-configuration
manage:org
Delete
delete:attachment:confluence
delete:blogpost:confluence
delete:comment:confluence
delete:content:confluence
delete:custom-content:confluence
delete:database:confluence
delete:embed:confluence
delete:folder:confluence
delete:page:confluence
delete:space:confluence
delete:whiteboard:confluence

[marc -Collabello--Phase Locked-]

Just a guess: maybe your API key expired.

[Darren Johnston]

Thanks but have created new api key