How to use Automation REST API to get Confluence Automation rules using Service Account?

[Peter Rossum_ van]

I try to update the actor for an Automation Rule in Confluence to a Service Account.
As this is not possible in the UI, I thought to use the Automation Rest API (The Automation REST API).
To start I used the GET-Rule-By-UUID to get the info on the rule I like to update.
The endpoint I use is this:

https://api.atlassian.com/automation/public/confluence/$($cloudID)/rest/v1/rule/$($ruleId)
For Authorization I use the email-adres and a token of the Service Account.
The result of the API call is 

{ "code": 401, "message": "Unauthorized; scope does not match" }

The documentation does not mention anything about any scope for the autorisation.
If I am able the get the GET-Rule-By-UUID working, I might be able to change the actor.

How can I get this working.

[Akash Singh · Accepted solution]

@Peter Rossum_ van Did you encode your credentials before adding them to the request header? Here is a working implementation in Python below,

import base64
import requests

def encode_base64(text: str) -> str:
  text_bytes = text.encode("utf-8")
  encoded_bytes = base64.b64encode(text_bytes)
  return encoded_bytes.decode("utf-8")

url = f"https://api.atlassian.com/automation/public/jira/{CLOUD_ID}/rest/v1/rule/summary"

cred = f"{JIRA_USERNAME}:{JIRA_ACCESS_TOKEN}"
encoded_credentials = encode_base64(cred)

headers = {
"Accept": "application/json",
"Authorization": f"Basic {encoded_credentials}"
}

response = requests.request(
"GET",
url,
headers=headers,
)

print(json.dumps(json.loads(response.text), sort_keys=True, indent=4, separators=(",", ": ")))

[Peter Rossum_ van]

@Akash Singh , Thanks for quick response.
I do encode the credentials. I use PowerShell this way:

$email = <email-adres of the Service Account>
$APItokenFixed = <the API-token of the Service Account>
$cloudID = <our cloudID>

$pair      = "$email`:$APItokenFixed"
$bytes     = [System.Text.Encoding]::UTF8.GetBytes($pair)
$base64    = [System.Convert]::ToBase64String($bytes)
$AuthHeader = @{
    "Authorization" = "Basic $base64"
    "Accept"        = "application/json"
}

$url = "https://api.atlassian.com/automation/public/confluence/$($cloudID)/rest/v1/rule/summary"
$response = Invoke-RestMethod -Method Get -Uri $url -Headers $AuthHeader
$response | get-member

--
{ "code": 401, "message": "Unauthorized; scope does not match" }

Do you use a Service Account or a regular account with a token?

And I see you use the Jira part, while I try to use the Confluence part. Could that make a difference?

[Akash Singh]

@Peter Rossum_ van Querying Jira or Confluence wouldn’t change the outcome in this case. In my case the request was authenticated using my personal API token.

I also explored creating credentials for a service account. While Atlassian provides an option to create a non-scoped API token, it still requires selecting scopes on the following screen. As @Marc -Devoteam- rightly pointed out, the Automation REST API does not currently support authentication via Forge or OAuth 2.0 apps.

At the moment, the only viable options are to use a personal API token or to create a licensed “service account” user and authenticate using that user’s credentials.

[Bill Sheboy]

Hi @Peter Rossum_ van 

Before you bulk-change the rule actors, I have a suggestion...

You describe the UX does not support selection of a service account for a rule actor in the user-picker for the field.  I wonder if that value is also validated for rule updates.

I suggest trying the REST API to update one test rule's actor, and then try to edit that same rule for a different change (e.g., an action) with the UX and publish any changes, testing cases of both enabled and disabled rules.  This will save time if the service account user is not supported for persistence from the UX as any API-updated rule actors will prevent future UX edits.

Kind regards,
Bill

[Peter Rossum_ van]

@Bill Sheboy ,
I understand your warning. Thanks for the tip!

[Marc -Devoteam-]

Hi @Peter Rossum_ van 

This can be done within the rule details, depending the rule is for a single space, if the rule is from multiple spaces, then this needs to be done within the Global automation section with Confluence adminstration.

[Peter Rossum_ van]

@Marc -Devoteam- ,
Thanks for your response.
I do know how to modify a rule using the UI in Confluence Administration.
However, When I update the rule on that page and try to modify the actor to fill out the Service Account as actor, first of all I cannot find the Service Account as an account to choose from, second I get the error that I cannot set the actor to another user then myself.
I remembered that in one of my previous posts you suggested to update the actor using the API. So I tried. No luck sofar.

[Marc -Devoteam-]

Hi @Peter Rossum_ van 

I don't think you can use a scopes token with the automation API.

See feature requests, AUTO-2139 and in relation JRACLOUD-95867