what OAuth scope is required for accessing databases

[Yoav Romach]

We are trying to programmatically read the rows/entries of a Confluence database page via the REST API v2 and the official Atlassian MCP server, and hitting a wall on both paths.

What we have:

Our OAuth 2.0 (3LO) app has all published Confluence scopes granted, including:
read:database:confluence, write:database:confluence, read:custom-content:confluence, read:content:confluence, read:page:confluence, read:confluence-content.all, and all other granular scopes listed in the Confluence OAuth scopes documentation.

What works:

GET /wiki/api/v2/databases/{id} — returns database metadata (title, version, spaceId, etc.) ✅

What doesn't work:

All sub-endpoints return 401 Unauthorized; scope does not match (header x-failure-category: FAILURE_CLIENT_SCOPE_CHECK):

- GET /wiki/api/v2/databases/{id}/entries → 401
- GET /wiki/api/v2/databases/{id}/content → 401
- GET /wiki/api/v2/databases/{id}/children → 401
- GET /wiki/api/v2/databases/{id}/export → 401

We also tried the Atlassian MCP server (mcp.atlassian.com) — its getConfluencePage tool and CQL search (ancestor = {id}) return no results for database content.

The problem:

The published scope list only documents three database scopes (read, write, delete). There is no scope for reading database entries. The responses include no WWW-Authenticate header that would hint at the required scope name.

Questions:

1. Is there a scope for reading database entries that is not yet listed in the public documentation?
2. Is reading database entries via OAuth 3LO supported at all?
3. Is there a roadmap item for exposing this via the public API?

[Marc -Devoteam-]

Hi @Yoav Romach 

Welcome to the community.

There is only a single scope available for DB's, see https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-database/#api-group-database 

You need : write:database:confluence

[Yoav Romach]

Thanks for the response. We already have write:database:confluence granted in our token — along with read:database:confluence — but the sub-endpoints still return 401 Unauthorized; scope does not match.

To be specific: GET /wiki/api/v2/databases/{id} works fine with read:database:confluence. The problem is specifically with sub-endpoints like /entries, /content, /children — all of which return 401 with x-failure-category: FAILURE_CLIENT_SCOPE_CHECK regardless of whether read:database:confluence or write:database:confluence is in the token.

You're right that the docs only list those three scopes — but the sub-endpoints clearly exist (they return 401, not 404), so either:
1. They require a scope not listed in the public documentation, or
2. They are intentionally not accessible to OAuth 3LO apps (only Forge/Connect)

Could anyone from Atlassian confirm which of these is the case? The endpoints exist, but the required scope isn't documented anywhere we can find.

[Marc -Devoteam-]

Hi @Yoav Romach 

Where did you find sub-endpoints, I can't find any documentation around these?

Currently, Atlassian only exposes create/get/delete endpoints for the database container itself, not the row-level data inside it.

[Yoav Romach]

Deleted