Administrator can see restricted pages in browser but not in API

Question

I have a page P created by user A where he granted view+edit permissions to user B.

Now I have created user C and assigned him to the exact same groups as user B - one of these groups is "administrators".

The tricky part and where my question comes from:

When using user B:

* I am able to see the restricted page in Confluence (via the browser)
* I am able to see the restricted page via the REST API - when searching for all pages where "creator=A"

When using user C:

* I am able to see the restricted page in Confluence (via the browser) ----> Why???
* I am not able to see the restricted page via the REST API - when searching for all pages where "creator=A"

Can someone please explain why browser and REST API are behaving differently?

Anton_vb03wj · Answer

Hi, thanks for the hint. I missed this one while browsing through the open issues.

However I cannot really consider this to be helping me further on because the workaround mentions that I can access the restricted child page directly via the API. That is fine but how can I retrieve the ID of the child page in the first place when I do not know it.
I just have the user provided. Any suggestion on this?

Thanks

Darryl Lee · Answer

Hi - unfortunately it's a known bug:

CONFSERVER-62994 - When making CQL REST API calls on a parent page using the Confluence Admin account, pages that are restricted to not include the administrator account will not show in the API results.