Confluence API Token Scope Missing

Hello,

Overview

  • I am trying to get the descendants of a folder in my Confluence space
  • When I create an API Token with no scopes (so all permissions) it works. However, when I create one with scopes it does not, as the permissions needed in the documentation is not shown in the console when creating the token

Information

Failed for folder REDACTED: 401 - <!doctype html><html lang="en"><head><title>HTTP Status 401 – Unauthorized</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 401 – Unauthorized</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> Basic Authentication Failure</p><p><b>Description</b> The request has not been applied to the target resource because it lacks valid authentication credentials for that resource.</p><hr class="line" /><h3>Apache Tomcat/9.0.105</h3></body></html>

Question
Am I missing something, or is this permission just not available using scoped API tokens?

Hey @aaronstarr

Thanks for your question!

The scope you mention is an oauth 2 & forge scope, are you using Oauth or basic auth to generate the token?

Authorization for basic authentication is based on the permissions of the user you used to generate the API token.

Hope this clarifies.
Cheers,
Mel

Hello Mel,

So my understanding is there are currently 3 types of API tokens,
Basic Auth Full Access Token: Deprecated and should move away from
Basic Auth Scoped Token: Used to prevent overprovisioning of token, but does not support all of v2 API, and is not really a replacement for OAuth. Best used for some internal use of older API.
Created in: Atlassian account

OAuth 2.0 Token/App: Recommended use case going forward and offers full support for both API’s
Created in: Developer console

I’ll see about moving to OAuth 2.0

Thank you,
Aaron