REST-API Create a page not working

[Rainer Rauschenberg]

I'm trying to reproduce the example for creating a page with a POST-request from https://developer.atlassian.com/server/confluence/confluence-rest-api-examples/ but get a strange server-response. 'curl -v' says:

> POST /rest/api/content/327825/ HTTP/1.1
> Host: 52.174.142.121:8090
> Authorization: Basic cmF1c2NoZW5iZXJnOlN0YXJ0MA==
> User-Agent: curl/7.55.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 170
>
* upload completely sent off: 170 out of 170 bytes
< HTTP/1.1 405 Method Not Allowed
< Server: Apache-Coyote/1.1
< X-ASEN: SEN-11472629
< Set-Cookie: JSESSIONID=689AA46918798EB74687224A6C6E874B; Path=/; HttpOnly
< X-Seraph-LoginReason: OK
< X-AUSERNAME: rauschenberg
< Allow: HEAD,DELETE,GET,OPTIONS,PUT
< X-Content-Type-Options: nosniff
< Content-Length: 0
< Date: Thu, 17 Jan 2019 14:38:03 GMT

I looked around but can't figure out why I get the "405 Method Not Allowed" which I think means that the server isn't accepting the POST-request.

Any ideas? Thanks in advance.

Rainer Rauschenberg

[Thomas Deiler]

Dear @Rainer Rauschenberg,

beside setting the header

"accept", "application/json"

try to set additionally the following header

"Origin", "https://<FQDN of your Confluence server>"

You can read more details following this article.

So long

Thomas

[Rainer Rauschenberg]

First of all: Thank you for answering.

I tried adding the additional headers, but that didn't change anything. But that lead me to checking if I may have done sth else wrong and I realised, that the url (which gave results with "GET") was slightly different from the example: I had http://<site>:<port>/rest/api/content/ instead of http://<site>:<port>/confluence/rest/api/content/ . After changing this I get "HTTP/1.1 200 OK" and a webpage (HTML) as return (no JSON), but I still can't find any newly created page ...

[Thomas Deiler]

Can you please post your full request (URL + json data).

[Rainer Rauschenberg]

curl -v -u user:passwd -X POST -H "Content-Type: application/json" -d "@data.json" http://server:port/confluence/rest/api/content/

With "data.json" containing:

{"type":"page","title":"new page", "ancestors":[{"id":327825}], "space":{"key":"TST"},"body":{"storage":{"value":"<p>This is another new page</p>","representation":"storage"}}}

"327825" is the id of an existing page.

curl had the following output:

Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying server...
* TCP_NODELAY set
* Connected to server (server) port port (#0)
* Server auth using Basic with user 'user'
> POST /confluence/rest/api/content/ HTTP/1.1
> Host: server:port
> Authorization: Basic cmF1c2NoZW5iZXJnOlN0YXJ0MA==
> User-Agent: curl/7.55.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 176
>
* upload completely sent off: 176 out of 176 bytes
< HTTP/1.1 200 OK
< Server: Apache-Coyote/1.1
< X-ASEN: SEN-11472629
< X-Confluence-Request-Time: 1548162488125
< Set-Cookie: JSESSIONID=58652AB996EF554470BD91AA89C88300; Path=/; HttpOnly
< X-Seraph-LoginReason: OK
< X-AUSERNAME: user
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< Content-Security-Policy: frame-ancestors 'self'
< X-Accel-Buffering: no
< Content-Type: text/html;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Tue, 22 Jan 2019 13:08:08 GMT

[Thomas Deiler]

Dear @Rainer Rauschenberg,

• The "Origin" header is not set in your curl command
• Silly question, but do you have the REST API enabled in Confluence
• Can you figure out if this request is successful?:

curl -v -u user:passwd  -H "Content-Type: application/json" https://server:port/confluence/rest/api/space?spaceKey=TST

So long

Thomas

[Rainer Rauschenberg]

curl -v -u user:passwd -H "Content-Type: application/json" http://server:port/confluence/rest/api/space?spaceKey=TST
*   Trying server...
* TCP_NODELAY set
* Connected to server (server) port port (#0)
* Server auth using Basic with user 'user'
> GET /confluence/rest/api/space?spaceKey=TST HTTP/1.1
> Host: server:port
> Authorization: Basic cmF1c2NoZW5iZXJnOlN0YXJ0MA==
> User-Agent: curl/7.55.1
> Accept: */*
> Content-Type: application/json
>
< HTTP/1.1 404 Not Found
< Server: Apache-Coyote/1.1
< X-ASEN: SEN-11472629
< Set-Cookie: JSESSIONID=B1644E8381C6C1F90949D4DE5D617479; Path=/; HttpOnly
< X-Seraph-LoginReason: OK
< X-AUSERNAME: user
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< Content-Security-Policy: frame-ancestors 'self'
< X-Accel-Buffering: no
< Content-Type: text/html;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Wed, 23 Jan 2019 14:43:48 GMT
<

[Rainer Rauschenberg]

But:

curl -v -u rauschenberg:Start0  -H "Content-Type: application/json" http://server:port/rest/api/space?spaceKey=TST
*   Trying server...
* TCP_NODELAY set
* Connected to server (server) port port (#0)
* Server auth using Basic with user 'user'
> GET /rest/api/space?spaceKey=TST HTTP/1.1
> Host: server:port
> Authorization: Basic cmF1c2NoZW5iZXJnOlN0YXJ0MA==
> User-Agent: curl/7.55.1
> Accept: */*
> Content-Type: application/json
>
< HTTP/1.1 200 OK
< Server: Apache-Coyote/1.1
< X-ASEN: SEN-11472629
< Set-Cookie: JSESSIONID=458B8DF2FBB245250F3CCE10A0E4AD4D; Path=/; HttpOnly
< X-Seraph-LoginReason: OK
< X-AUSERNAME: user
< Cache-Control: no-cache, must-revalidate
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< X-Content-Type-Options: nosniff
< Content-Type: application/json
< Transfer-Encoding: chunked
< Date: Wed, 23 Jan 2019 14:49:10 GMT
<
{"results":[],"start":0,"limit":25,"size":0,"_links":{"base":"http://server:port","context":"","self":"http://server:port/rest/api/space?spaceKey=TST"}}* Connection #0 to host server left intact

[Rainer Rauschenberg]

Not-so-silly-question ... I didn't know that the REST API could be disabled in Confluence ...

[Thomas Deiler]

So your problem is solved?

[Rainer Rauschenberg]

No, not solved.

GET works, POST not (as expected), i.e. I don't know how to create a page via the REST-API.

[Thomas Deiler]

Dear @Rainer Rauschenberg,

Best you use a browser plugin or postman to fire request against Confluence. They quickly show whats going on.

One working request looks like this:

{
 "type":"page",
 "title":"new page",
 "ancestors":
 [
 {
 "id":1234567
 }
 ],
 "space":
 {
 "key":"TST"
 },
 "body":
 {
 "storage":
 {
 "value":"<p>This is a new page</p>",
 "representation":"storage"
 }
 }
 "version":
 { 
 "number":2 (optional)
 }
} 

So long

Thomas

[Rainer Rauschenberg]

I thought that https://developer.atlassian.com/server/confluence/confluence-rest-api-examples/ uses curl to show the API-calls, because it quickly shows what's going on ...

[Thomas Deiler]

Graphical support with syntax highlighting is much more comfortable than curl output. I am personally using "REST Client" extension for Firefox.

[Rainer Rauschenberg]

Ok, it worked for me, I created a page via the REST-API with a POST-Request. Really tricky and far from cutting-and-pasting the code from the examples-page ...

I'll try to have a deeper look on monday to figure out what parts of what I did where really necessary and I will write it down here.

[Rainer Rauschenberg]

My findings while trying to create a new page in Confluence via the REST-API with a POST-Request:

• The example from https://developer.atlassian.com/server/confluence/confluence-rest-api-examples/ works, if the client (i.e. curl) is running on the same machine as the Confluence-server.
• To use a POST-request from a different machine you need to disable whitelisting in Confluence (or maybe you could configure it, but I did not manage to).
• To use a POST-request from a different machine you need to send an Origin-header with the POST-request.
• RESTClient extension for Firefox refuses to send an Origin-header (claiming that XMLHttpRequest will not send it), even when whitelisting is disabled in Confluence and Confluence would accept it.
• RESTED extension for Firefox will send an Origin-header (and apparently XMLHttpRequest sends it to the Confluence-server with whitelisting disabled).

[Thomas Deiler]

Ok, nice forensic analysis. The RESTClient always worked fine for me. This whitelisting is intersting. I never had to set this or disable. Was it configured before? Are these new default settings? Which Confluence version do you use?

So long

Thomas