how to download an attachment in enterprise jira using curl

[Blesson Mathew]

Jira Version -- Jira v9.6.0

I am trying to download an attachment using the below curl command

curl -k --header 'Authorization: Bearer <API TOKEN>' https://<host:port>/secure/attachment/161500/RiasDataDump_2022-11-02_10_59_15.zip --output /path/filename.zip

When checking using curl in verbose, I could see the below error. I am using an API token. PAT is disabled.

* Mark bundle as not supporting multiuse
< HTTP/1.1 302 
< X-AREQUESTID: 360x20550x1
< Referrer-Policy: strict-origin-when-cross-origin
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< Content-Security-Policy: frame-ancestors 'self'
< Strict-Transport-Security: max-age=31536000
< Set-Cookie: atlassian.xsrf.token=BGAS-FQ5Y-WA7O-P1CH_0b907bdaf280eab8aae0f9720d36bf9e3b51ecf0_lout; Path=/; Secure; SameSite=None
< X-AUSERNAME: anonymous
< Location: /login.jsp?permissionViolation=true&os_destination=%2Fsecure%2Fattachment%2F161500%2FRiasDataDump_2022-11-02_10_59_15.zip&page_caps=&user_role=
< Content-Type: text/html;charset=UTF-8
< Content-Length: 0
< Date: Sat, 25 Feb 2023 12:00:14 GMT 

I have set up a local Jira instance, where I am able to download attachments using this format.  

I have tried some other curl and wget options as well, but nothing has worked so far.

wget -d --header="X-Auth-Token: Authorization Bearer <API Token>" --header="X-AUSERNAME: <Userid>" "https://<host:port>/secure/attachment/161500/RiasDataDump_2022-11-02_10_59_15.zip" --no-check-certificate

curl "https://<host:port>/secure/attachment/161500/RiasDataDump_2022-11-02_10_59_15.zip" -u "Authorization Bearer <user email address>:<token>" -o /path/filename

I can download attachments from the browser. With the API token, I am able to create Tasks, update Task Status, and add comments.

[Radek Dostál]

If this is on premise (server/dc), what do you mean by API token?

If PAT is disabled as you say, then I only know of Basic (username:password) and JSESSIONID cookie. I have never seen or heard of any API token, unless that comes from some plugin.

So with basic, that would be 'Authorization: Basic <base64 username:password>' or 'curl -u myusername:mypassword ..'

With JSESSIONID, that would be 'curl -H "JSESSIONID=LOREMIPSUM" ..'

With PAT, that is 'Authorization: Bearer <PAT>' - but need to stress here that Bearer only works with PAT, as far as I know.

[Blesson Mathew]

Thanks @Radek Dostál for your update. In the enterprise Jira I see this option to configure API Key, I don't have permission to create an API key, but when created by the admin I can use it and we are executing all API requests using these API keys instead of PAT.

I can see in the below links enabling API token as a native offering from Atlassian

https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/#Create-an-API-key

https://www.atlassian.com/software/access/guide/api-token-controls#what-are-api-token-controls

I'm using SSO credentials to login into JIRA, so can't use the Basic Auth approach.