How do i download attachments from pages with scoped token

[Arpit autviz]

I'm unable to download attachments from Confluence pages using a scoped API token with all the read scopes. The attachment metadata API works fine, but the actual download fails with 401 Unauthorized.

Setup:

• Using scoped API token from a service account (not personal account)

• Scopes: all read scopes granular and classic

• Service account has view permissions on the target spaces/pages

• Calling via api.atlassian.com/ex/confluence/{cloudId}/wiki/api/v2/pages/{pageId}/attachments — this succeeds and returns attachment metadata with downloadLink

The downloadLink from the metadata returns a relative path like /wiki/download/attachments/{pageId}/{filename}?api=v2. When I:

1. Build the full URL: https://{domain}.atlassian.net/wiki/download/attachments/{pageId}/{filename}?api=v2 + Bearer {token}

2. Or call: api.atlassian.com/ex/confluence/{cloudId}/wiki/download/attachments/{pageId}/{filename}?api=v2 Bearer {token}

3. Or use the dedicated download endpoint: /wiki/rest/api/content/{pageId}/child/attachment/{attId}/download + Bearer {token}

All return 401 Unauthorized

Questions:

1. Does the download endpoint require additional scopes beyond read:attachment:confluence?

2. Is there a different download endpoint for scoped tokens? (e.g. always use /content/{id}/child/attachment/{attId}/download?)

3. Does the service account need explicit attachment download permissions beyond space/page view access?

[Tomislav Tobijas]

Hi @Arpit autviz ,

Have you tried using Basic auth instead of Bearer? I have to see how we got this configured on our instance, but @Rebekka Heilmann _viadee_ created a great article series related to service accounts: 👇

• A Guide to Service Accounts in Atlassian Cloud - Part 1: What they are (for) 
• A Guide to Service Accounts in Atlassian Cloud - Part 2: Setting up a service account 
• A Guide to Service Accounts in Atlassian Cloud - Part 3: Service Accounts in Practice 

This should definitely clarify some things.

As for differences related to service accounts - there might be some, but I'm not entirely sure when it comes to fetching attachments.

For example, if you can get attachments when you call that specific endpoint and the service account can't, that might just be a limitation of the system (these are, still, relatively new) 🆕

If you're app admin, you or some other app admin on your instance could reach out to Atlassian Support to confirm this and get confirmation of the scopes required to fetch this information. 👀

Cheers,
Tobi

[Arpit autviz]

Hi @Tomislav Tobijas

Yes i have tried basic auth, but it does not work with the scoped token with classic token can Basic auth email+token i am able to download the attachment, but with the scoped token having issue.