Bulk remove users from 'confluence-users-xxxxx' group as user license cleanup API errors

[Darren Johnston]

Using python script to connect to atlassian API

was working 6  months ago.
Now getting:
03 Error - ['{"statusCode":403,"message":"com.atlassian.confluence.mvc.rest.common.exception.StacklessResponseStatusException: 403 FORBIDDEN \\"Request rejected because caller cannot access Confluence\\""}']

using this  endpoint

https://{BASE_URL}/wiki/rest/api/group/user

last admin was using 

endpoint 

f"https://{BASE_URL}/rest/api/3/group/user"  which is a Jira  endpoint but auth fail error for that one.

 any hints on what I doing wrong here??

[Tomislav Tobijas]

Hey @Darren Johnston ,

Are you using the user's API token or service account for this?

Can you try using scoped API tokens as described here: Scoped API Tokens in Confluence Cloud?
Note that you'll have to use a slightly different format here:

https://api.atlassian.com/ex/confluence/{cloudId}/wiki/rest/api/group/user

When talking about scripts and authentication, you can use these two methods:

• Basic Auth (Recommended for scripts): You must Base64-encode the string email:api_token.

  • Header: Authorization: Basic <base64_encoded_credentials>

• Bearer Token: If you are using a Service Account API key specifically designed for Bearer auth, use:

  • Header: Authorization: Bearer <api_key>

Can you try configuring these and see how that will go?

Cheers,
Tobi

[Darren Johnston]

HI Tomislav,
tried scoped 
with 

https://{BASE_URL}/ex/confluence/{CLOUD_ID}/wiki/rest/api/group/user

also tried 

https://{BASE_URL}/admin/v1/orgs/{ORG_ID}/directory/groups/{GROUP_ID}/memberships/{account_id}"
#getting Unauthorized error
and
"Request rejected because caller cannot access Confluence

[Tomislav Tobijas]

@Darren Johnston are you using an API token from your account or service account? There's a difference between the two as explained above.
Also, which scopes have you selected?

I could try/test this in the coming days to see what response I get when using one or the other.

[Darren Johnston]

Hi using my account
adding most of the scopes available as thought maybe something missing there.

Read
read:account
read:configuration:confluence
read:confluence-content.all
read:confluence-content.permission
read:confluence-content.summary
read:confluence-groups
read:confluence-props
read:confluence-space.summary
read:confluence-user
read:content-details:confluence
read:content:confluence
read:analytics.content:confluence
read:app-data:confluence
read:attachment:confluence
read:audit-log:confluence
read:blogpost:confluence
read:comment:confluence
Manage
manage:confluence-configuration
manage:org
Delete
delete:attachment:confluence
delete:blogpost:confluence
delete:comment:confluence
delete:content:confluence
delete:custom-content:confluence
delete:database:confluence
delete:embed:confluence
delete:folder:confluence
delete:page:confluence
delete:space:confluence
delete:whiteboard:confluence

[Tomislav Tobijas]

Thanks @Darren Johnston !

I'm going to set a reminder to test this out in the next couple of days (prob. Thursday or Friday, or potentially the weekend), and I can let you know if I manage to get it to work.

[Tomislav Tobijas]

Hey @Darren Johnston ,

Can you check this and follow steps from the video to see if you'll manage to get it to work?

[Darren Johnston]

Hi Tomislav,
thankyou for your support and patience.

 I used a personal token   but still getting cannot find user or group error.
 auth appears fine.

suspecting the endpoint.

went back to basics.
Python code:

import requests

from requests.auth import HTTPBasicAuth

url = "https:x?????.atlassian.net/wiki/rest/api/group/userByGroupId"

auth = HTTPBasicAuth("xxxxx@xxxx.edu.au", "token value")

query = {

  'groupId': 'groupid here',

  'accountId': 'account id here'

}

response = requests.request(

   "DELETE",

   url,

   params=query,

   auth=auth

)

print(response.text)

***THIS  WORKS ****

---

 updated my code
 and still user  or group not found!

---

[Tomislav Tobijas]

@Darren Johnston I've tried 

https://<sitename>.atlassian.net/wiki/rest/api/group/userByGroupId

and I got this as a response.

Then I looked at the official REST API docs, but it would appear that some v1 endpoints do not have a counterpart in v2 > see CONFCLOUD-82717: Missing REST API endpoints in Confluence API V2 

You could probably work around with available endpoints, but it might be tricker than it used to be with the endpoint you've shared 👀

[marc -Collabello--Phase Locked-]

Just a guess: maybe your API key expired.

[Darren Johnston]

Thanks but have created new api key