How do i download attachments from pages with scoped token

[Arpit autviz]

I'm unable to download attachments from Confluence pages using a scoped API token with all the read scopes. The attachment metadata API works fine, but the actual download fails with 401 Unauthorized.

Setup:

• Using scoped API token from a service account (not personal account)

• Scopes: all read scopes granular and classic

• Service account has view permissions on the target spaces/pages

• Calling via api.atlassian.com/ex/confluence/{cloudId}/wiki/api/v2/pages/{pageId}/attachments — this succeeds and returns attachment metadata with downloadLink

The downloadLink from the metadata returns a relative path like /wiki/download/attachments/{pageId}/{filename}?api=v2. When I:

1. Build the full URL: https://{domain}.atlassian.net/wiki/download/attachments/{pageId}/{filename}?api=v2 + Bearer {token}

2. Or call: api.atlassian.com/ex/confluence/{cloudId}/wiki/download/attachments/{pageId}/{filename}?api=v2 Bearer {token}

3. Or use the dedicated download endpoint: /wiki/rest/api/content/{pageId}/child/attachment/{attId}/download + Bearer {token}

All return 401 Unauthorized

Questions:

1. Does the download endpoint require additional scopes beyond read:attachment:confluence?

2. Is there a different download endpoint for scoped tokens? (e.g. always use /content/{id}/child/attachment/{attId}/download?)

3. Does the service account need explicit attachment download permissions beyond space/page view access?

[Tomislav Tobijas]

Hi @Arpit autviz ,

Have you tried using Basic auth instead of Bearer? I have to see how we got this configured on our instance, but @Rebekka Heilmann _viadee_ created a great article series related to service accounts: 👇

• A Guide to Service Accounts in Atlassian Cloud - Part 1: What they are (for) 
• A Guide to Service Accounts in Atlassian Cloud - Part 2: Setting up a service account 
• A Guide to Service Accounts in Atlassian Cloud - Part 3: Service Accounts in Practice 

This should definitely clarify some things.

As for differences related to service accounts - there might be some, but I'm not entirely sure when it comes to fetching attachments.

For example, if you can get attachments when you call that specific endpoint and the service account can't, that might just be a limitation of the system (these are, still, relatively new) 🆕

If you're app admin, you or some other app admin on your instance could reach out to Atlassian Support to confirm this and get confirmation of the scopes required to fetch this information. 👀

Cheers,
Tobi

[Arpit autviz]

Hi @Tomislav Tobijas

Yes i have tried basic auth, but it does not work with the scoped token with classic token can Basic auth email+token i am able to download the attachment, but with the scoped token having issue.

[John Price]

@Arpit autviz We had some users with the same problem recently. I think the issue is that the 

/download/attachments/{id}/{id}

Endpoint has been deprecated and was removed sometime between April 14th and now. See https://developer.atlassian.com/cloud/confluence/changelog/#CHANGE-2735 . Atlassian kept delaying the removal but you can scroll through the change log and see the various mentions. The last one is in January.  

I'd love someone to correct me but in my testing what I found is that if I use the V2 API to get a list of attachments, it is still giving me that old download links, which fail with a 401. Workaround is to use the v1 endpoint to get the file contents. It's annoying because you can use the V2 api for the rest of your work but then have to switch over to get the download in your code:

/wiki/rest/api/content/{pageid}/child/attachment/{attachmentId}/download

 I found some cloud suggestions but nothing that matches this exactly. Hope this helps- I've tested this method! 

[John Price]

Oh in fairness I should say that I've done this with an unscoped token using the API hosted at

yoursite.atlassian.net

and not 

api.atlassian.com 

Let me know whether it works or not.