# Deprecation of obsolete Jira Cloud download attachment and thumbnail URLs

**URL:** <https://community.developer.atlassian.com/t/deprecation-of-obsolete-jira-cloud-download-attachment-and-thumbnail-urls/63171>\
**Category:** Jira Cloud Announcements\
**Tags:** jira-cloud, rest-api\
**Created:** [November 4, 2022, 3:48am UTC](https://community.developer.atlassian.com/t/deprecation-of-obsolete-jira-cloud-download-attachment-and-thumbnail-urls/63171 "2022-11-04T03:48:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tara](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/tara/32/46584_2.png) [@Tara](https://community.developer.atlassian.com/u/Tara)\
**Post date:** [November 4, 2022, 3:48am UTC](https://community.developer.atlassian.com/t/deprecation-of-obsolete-jira-cloud-download-attachment-and-thumbnail-urls/63171/1 "2022-11-04T03:48:41Z")

</div>

**What is changing?**  
We have just deprecated a number of obsolete download attachment and thumbnail APIs. The following APIs will be removed and replaced in Jira Cloud:

1. /secure/attachment/{attachmentId}/{attachmentName}
2. /servicedesk/customershim/secure/attachment/{attachmentId}/{attachmentName}
3. /secure/thumbnail/{thumbnailId}/{thumbnailName}
4. /servicedesk/customershim/secure/thumbnail/{thumbnailId}/{thumbnailName}

**What do I need to do?**  
Developers are encouraged to migrate to their replacements as the APIs will be removed in 3 months:

1. /rest/api/{v:2|3|latest}/attachment/content/{attachmentId}
2. /rest/servicedeskapi/request/{issueIdOrKey}/attachment/{attachmentId}
3. /rest/api/{v:2|3|latest}/attachment/thumbnail/{thumbnailId}
4. /rest/servicedeskapi/request/{issueIdOrKey}/attachment/{thumbnailId}/thumbnail

**By when do I need to do it?**  
The new APIs are now available in all Jira Cloud instances.

The deadline is _ **04 February 2023** _. At any point after that, the old endpoints may be removed.

---

<div class="post-metadata">

**Author:** ![matthias](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/matthias/32/54680_2.png) [@matthias](https://community.developer.atlassian.com/u/matthias)\
**Post date:** [November 4, 2022, 7:02am UTC](https://community.developer.atlassian.com/t/deprecation-of-obsolete-jira-cloud-download-attachment-and-thumbnail-urls/63171/2 "2022-11-04T07:02:13Z")

</div>

Hey @Tara,

thank you for the notification. May I ask what’s the reason to deprecate this already after 3 months instead of the usual 6 months as stated in [your deprecation policy](https://developer.atlassian.com/platform/marketplace/atlassian-rest-api-policy/#deprecation-policy)?

Cheers,  
Matthias.

---

<div class="post-metadata">

**Author:** ![Tara](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/tara/32/46584_2.png) [@Tara](https://community.developer.atlassian.com/u/Tara)\
**Post date:** [November 4, 2022, 1:00pm UTC](https://community.developer.atlassian.com/t/deprecation-of-obsolete-jira-cloud-download-attachment-and-thumbnail-urls/63171/3 "2022-11-04T13:00:33Z")

</div>

Hi @matthias ,  
We’ve chosen to deprecate this in 3 months rather than our usual 6 months as OAuth scopes are not correctly enforced on these APIs and the use of user-generated content within the URI as part of the attachment name leaves a larger surface area for exploitable vulnerabilities. To ensure we close security gaps within an acceptable timeframe, we’ve chosen to shorten the deprecation period.  
These APIs also do not come under the standard deprecation policy as they are not officially supported as part of our public REST API documentation  
However, we understand the deprecated APIs have existed for a long time so we would like to give consumers ample time to migrate to the new endpoints. If for any reason there are unexpected issues with migration, we are happy to revisit the 3-month deprecation period.

Regards,  
Tara.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/atlassiandeveloper/original/3X/7/8/78672baa5ba80cd9164376457051d0eec038b082.png) [@system](https://community.developer.atlassian.com/u/system)\
**Post date:** [December 4, 2022, 1:01pm UTC](https://community.developer.atlassian.com/t/deprecation-of-obsolete-jira-cloud-download-attachment-and-thumbnail-urls/63171/4 "2022-12-04T13:01:31Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.