Deprecation of obsolete Jira Cloud download attachment and thumbnail URLs

[Tara]

What is changing?
We have just deprecated a number of obsolete download attachment and thumbnail APIs. The following APIs will be removed and replaced in Jira Cloud:

1. /secure/attachment/{attachmentId}/{attachmentName}
2. /servicedesk/customershim/secure/attachment/{attachmentId}/{attachmentName}
3. /secure/thumbnail/{thumbnailId}/{thumbnailName}
4. /servicedesk/customershim/secure/thumbnail/{thumbnailId}/{thumbnailName}

What do I need to do?
Developers are encouraged to migrate to their replacements as the APIs will be removed in 3 months:

1. /rest/api/{v:2|3|latest}/attachment/content/{attachmentId}
2. /rest/servicedeskapi/request/{issueIdOrKey}/attachment/{attachmentId}
3. /rest/api/{v:2|3|latest}/attachment/thumbnail/{thumbnailId}
4. /rest/servicedeskapi/request/{issueIdOrKey}/attachment/{thumbnailId}/thumbnail

By when do I need to do it?
The new APIs are now available in all Jira Cloud instances.

The deadline is 04 February 2023. At any point after that, the old endpoints may be removed.

[matthias]

Hey @Tara,

thank you for the notification. May I ask what’s the reason to deprecate this already after 3 months instead of the usual 6 months as stated in your deprecation policy?

Cheers,
Matthias.

[Tara]

Hi @matthias ,
We’ve chosen to deprecate this in 3 months rather than our usual 6 months as OAuth scopes are not correctly enforced on these APIs and the use of user-generated content within the URI as part of the attachment name leaves a larger surface area for exploitable vulnerabilities. To ensure we close security gaps within an acceptable timeframe, we’ve chosen to shorten the deprecation period.
These APIs also do not come under the standard deprecation policy as they are not officially supported as part of our public REST API documentation
However, we understand the deprecated APIs have existed for a long time so we would like to give consumers ample time to migrate to the new endpoints. If for any reason there are unexpected issues with migration, we are happy to revisit the 3-month deprecation period.

Regards,
Tara.