What's the best practice to call RESTful APIs of Confluence?

NGPILOT

I'm new to atlassian and learning its APIs to build apps.

 

Ever I developed a MVP app for JIRA used RESTful API like:

```node.js

 

const res = await api.asUser().requestJira(route`/rest/api/2/issue/${key}/comment`, {

headers: {

'Accept': 'application/json'

}

});

const data = await res.json();

```

It works without any error.

Then I was trying to make an example code to work from official `Build a Confluence keyword extractor with Forge and OpenAI`

https://developer.atlassian.com/platform/forge/build-confluence-keyword-extractor-with-openai/#update-the-manifest-to-include-the-required-permissions

 

It uses RESTful APIs for Confluence: 

```node.js

const response = await asUser().requestConfluence(route`/wiki/api/v2/pages/${payload.contentId}?body-format=storage`, { headers: { 'Accept': 'application/json' } });

```

 

It does not work as before! I see the error throw in the console log:

```

Uncaught (in promise) Error: There was an error invoking the function - Error while getContent with contentId 12156995: 401 Unauthorized

```

 

After some searches from the community, seems like that if you want to use RESTful APIs you should put your AUTHENTATION headers in the APIs call.

 

But I'm confusing why JIRA's RESTful APIs don't need the `Authentation` header and Confluence RESTful APIs must have ?

 

If I'm wrong, so what's the best practice to make RESTful APIs call, and how to correct the `401` Unauthorized error.

 

Thanks in advance!

Humashankar VJ

Hi @NGPILOT 

When calling Confluence RESTful APIs, consider the following key points. Authentication differences between Jira and Confluence setups often cause issues. Jira API calls may work seamlessly due to pre-configured authentication methods, such as the asUser() function. Besides that, Confluence API calls require explicit authentication, which is likely missing, resulting in 401 Unauthorized errors.

To ensure successful Confluence API calls, follow best practices: 

• Use Atlassian SDK or Forge for app development, as they handle authentication complexities.
• Include authentication in direct REST API calls using Basic Auth or OAuth 2.0 (recommended for production).
• Utilize API tokens instead of username and password combinations. 

For the 401 Unauthorized error, modify your Confluence API call to include authentication: 

- Generate an API token and store it securely.

- Use Basic Auth with the API token and email address.

Consistency is crucial, include proper authentication in all API calls, even if some seem to work without it.

Environment differences and configurations may also impact API behavior. When using Atlassian Forge, ensure necessary permissions are set in your manifest file

To learn more on the - (API Capabilities, Authentication Methods, Best Practices, API Endpoints, Learning Path) - The Confluence Cloud REST API

Hope this helps - Happy to help further!!
Thank you very much and have a great one!
Warm regards