nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Confluence Automation Error Details

Nico Maikranz

Hello Community,

I have an automation in Confluence Cloud with the "Page edited" trigger and on some executions I get the following error:

"The flow actor doesn't have permission to view the event that triggered this flow".

I know that the error must be related to space or page permissions for the executing user but how can I determine which space or page I need to have a look at?

I have also added the "Add value to the audit log" action but when the automation fails due to the error from above nothing is added to the log, as you can see in the second picture.

Any ideas how I can get the affected pages or spaces?

Thanks in advance

Accepted answers

Germán Morales

Hi Nico Maikranz, the audit log can't tell you, unfortunately. That error is raised on the trigger itself, before any action runs, which is why your "Add value to the audit log" step never writes anything: the rule doesn't get as far as reading the page, so there's no {{page}} to log. There's an open suggestion to add the page details to that error, CONFCLOUD-80629, worth a vote.

With a Global rule, the usual explanation is the scope. Every page edit on the site fires the trigger, including pages in personal spaces or behind page restrictions that the rule's actor can't see. Those executions fail straight away, even though most of them would never have passed your label condition.

So rather than hunting for the pages, I'd narrow the scope to the spaces where your approval labels are actually used, since global rules can be scoped to multiple spaces. If the error disappears, it was coming from outside those spaces. If it still shows up, it's a restricted page inside them, and the fix is to give the rule's actor access to it, because Confluence automation always runs as the actor, not as the person who edited the page.

All comments

Germán Morales

Sami Shaik

@Germán Morales makes the right call on scope; the steps below are for finding the page when you need to know which one it was.

@Nico Maikranz that error means the account the rule runs as (the Actor in the rule’s Settings) could not read the page that fired the “Page edited” trigger. Nothing after the trigger runs, which is why your “Add value to the audit log” action never writes anything: the rule stops before it reaches any action. So the log action will not help you find the page; here is what does.

1. Expand the trigger row in the audit log. In the rule’s audit log, each execution has a trigger row with a chevron. On a successful run, expanding it shows the title of the page that triggered the rule (checked on a Premium site this morning). Open one of the failed executions and expand the trigger row the same way. If the title is there, you have your page. If the entry is empty for the failed runs, that is the permission error itself: the actor could not read the event, so no page data reached the rule, and you need step 2.

2. Check the actor’s access the way Confluence admins do it. Confluence administration > User access, search for the actor. You can download the space permissions report, which lists every space that user can view or admin, so any space missing from it is a candidate. On Premium, the same screen lets you type a page name and check whether that user can view it. For a single suspect page, the restrictions (lock) icon on the page has an Inspect permissions link that reports Allowed or Denied at page, space and site level.

3. Narrow the rule to find the source. Your rule has Scope: All spaces. Change it to the spaces where the actor is known to have access and watch whether the failures stop; then add spaces back one at a time. Slow, but it finds the space without guessing.

4. The fix once you know. Either give the actor view access to the restricted pages or spaces, or change the actor. The Actor field in Settings is a dropdown of users on your site, so you can pick a dedicated admin account that has view access everywhere the rule should run. That is a change from the older advice on this forum (and from CONFCLOUD-80002, which asked for exactly this ability); on the sites I checked today the field is editable.

One caution: the actor’s access is the rule’s access. An actor who can read every space will also act in every space the rule matches, so pair a broad actor with a tight Scope rather than All spaces.

References, read today: Inspect a user’s permissions, How to check which spaces someone has access to with the User Access feature, CONFCLOUD-80002.

Nico Maikranz

Hi @Germán Morales ,

thank you for the quick response and the technical details why I dont get the expected results in my audit log.

I will tell the person who created the rule to indentify the spaces where this rule should be run and update the settings.

Thanks again and have a nice day.

Nico

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

cloud