how to download an attachment in enterprise jira using curl

Question

Jira Version -- Jira v9.6.0 I am trying to download an attachment using the below curl command curl -k --header 'Authorization: Bearer ' https:///secure/attachment/161500/RiasDataDump_2022-11-02_10_59_15.zip --output /path/filename.zip When checking using curl in verbose, I could see the below error. I am using an API token. PAT is disabled. * Mark bundle as not supporting multiuse < HTTP/1.1 302 < X-AREQUESTID: 360x20550x1 < Referrer-Policy: strict-origin-when-cross-origin < X-XSS-Protection: 1; mode=block < X-Content-Type-Options: nosniff < X-Frame-Options: SAMEORIGIN < Content-Security-Policy: frame-ancestors 'self' < Strict-Transport-Security: max-age=31536000 < Set-Cookie: atlassian.xsrf.token=BGAS-FQ5Y-WA7O-P1CH_0b907bdaf280eab8aae0f9720d36bf9e3b51ecf0_lout; Path=/; Secure; SameSite=None < X-AUSERNAME: anonymous < Location: /login.jsp?permissionViolation=true&os_destination=%2Fsecure%2Fattachment%2F161500%2FRiasDataDump_2022-11-02_10_59_15.zip&page_caps=&user_role= < Content-Type: text/html;charset=UTF-8 < Content-Length: 0 < Date: Sat, 25 Feb 2023 12:00:14 GMT I have set up a local Jira instance, where I am able to download attachments using this format. I have tried some other curl and wget options as well, but nothing has worked so far. wget -d --header="X-Auth-Token: Authorization Bearer " --header="X-AUSERNAME: " "https:///secure/attachment/161500/RiasDataDump_2022-11-02_10_59_15.zip" --no-check-certificate curl "https:///secure/attachment/161500/RiasDataDump_2022-11-02_10_59_15.zip" -u "Authorization Bearer :" -o /path/filename I can download attachments from the browser. With the API token, I am able to create Tasks, update Task Status, and add comments.

Blesson Mathew · Answer

Thanks @Radek Dostál for your update. In the enterprise Jira I see this option to configure API Key, I don't have permission to create an API key, but when created by the admin I can use it and we are executing all API requests using these API keys instead of PAT.

I can see in the below links enabling API token as a native offering from Atlassian

https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/#Create-an-API-key

https://www.atlassian.com/software/access/guide/api-token-controls#what-are-api-token-controls

I'm using SSO credentials to login into JIRA, so can't use the Basic Auth approach.

Radek Dostál · Answer

If this is on premise (server/dc), what do you mean by API token? If PAT is disabled as you say, then I only know of Basic (username:password) and JSESSIONID cookie. I have never seen or heard of any API token, unless that comes from some plugin. So with basic, that would be 'Authorization: Basic ' or 'curl -u myusername:mypassword ..' With JSESSIONID, that would be 'curl -H "JSESSIONID=LOREMIPSUM" ..' With PAT, that is 'Authorization: Bearer ' - but need to stress here that Bearer only works with PAT, as far as I know.