Guest users not visible in /api/search and are not External Collaborators

Confluence Development Confluence Cloud
,
1

Hi all,

With Atlassian’s decision to allow Guest users access to apps after RFC-9: Blocking Guest Access to Apps, we started looking into the API changes needed in our apps to support this and identify guests. So far 2 items that appear to be blockers. I assume these will affect other vendors as well.

#1 User Search
Today we use /wiki/rest/api/search?cql=user.fullname~(query) to source a user picklist in our app. As of today it appears that guest users are not returned? Is there an alternate API that has the guest users?

#2 User isExternalCollaborator
And if the isExternalCollaborator flag is supposed to indicate guest users in the /wiki/rest/api/user, it isn’t working yet. We can lookup a guest user by accountId but the isExternalCollaborator is reporting false currently.

Both of these API’s are going to be necessary for our Confluence apps to work with Guest users. Would appreciate any updates from Atlassian on an ETA, or if there are alternate API’s we should be using.

Chris
Digital Rose

2 Likes
2

Thanks for the report Chris!

We’re currently working on a guide for how to handle external collaborators in apps. We’ll investigate these two questions and ensure they’re addressed in the content. I’ll follow up here once the guide is ready.

cheers,
Tim

1 Like
3

Hi all, it appears like Atlassian has done some work on this over the past month as the /search/users API does now have a filter to include guests (externalCollabators). See https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-search/#api-wiki-rest-api-search-user-get

In our test the search does now return guest users if the new filter is used. The flag “isExternalCollaborator” is still wrong though (false).

PS. If this is a new API and these users are now known as “Guest” users, I think it would be easier to understand the API if it referred to these account types as guest users instead of “ExternalCollaborators”.

1 Like
4

Hi @tpettersen ,
Is there a timeline when we can expect the guide for app developers for guest users? It seems guest users are out of beta.

5

@tpettersen This guest user feature is all very poorly thought out and executed.

It seems that the “get current user” api cannot be relied on to return anything truthful.

  • It always returns "accountType": "atlassian", even if the user is a guest. It even states this in the docs. Who knows what other values might be valid.
  • "isExternalCollaborator" is always false - for normal users and also guests. Again, there is no documentation on when the condition would be true.

If you’re developing for Forge, I can’t see any way to determine if the current user is a guest user.

For Atlassian Connect, we can at least add the request parameter &isExternalCollaborator={user.isExternalCollaborator} to our connect URLs.

It’s really time for Atlassian to get this fixed and write some documentation on the APIs that can be relied on for truthful data.

1 Like
6

I’ve looked into this some more and notice that the user rest apis are actually expandable on isExternalCollaborator.

This means that unless you specifically add ?expand= isExternalCollaborator onto the URL, isExternalCollaborator is displayed in the response, but it is not truthful.

Examples:

:x: Incorrect data / "isExternalCollaborator": false:

GET: https://hiya.atlassian.net/wiki/rest/api/user/current

{
	"type": "known",
	"accountId": "****:************",
	"accountType": "atlassian",
	"email": "myguestuser@gmail.com",
	"publicName": "myguestuser",
	"profilePicture": {
		...
	},
	"displayName": "myguestuser",
	"isExternalCollaborator": false,
	"_expandable": {
		"operations": "",
		"personalSpace": ""
	},
	"_links": {
		"self": "https://hiya.atlassian.net/wiki/rest/api/user?accountId=****:************",
		"base": "https://hiya.atlassian.net/wiki",
		"context": "/wiki"
	}
}

:white_check_mark: Correct data / "isExternalCollaborator": true:

GET: https://hiya.atlassian.net/wiki/rest/api/user/current?expand=isExternalCollaborator

{
	"type": "known",
	"accountId": "****:************",
	"accountType": "atlassian",
	"email": "myguestuser@gmail.com",
	"publicName": "myguestuser",
	"profilePicture": {
		...
	},
	"displayName": "myguestuser",
	"isExternalCollaborator": true,
	"_expandable": {
		"operations": "",
		"personalSpace": ""
	},
	"_links": {
		"self": "https://hiya.atlassian.net/wiki/rest/api/user?accountId=****:************",
		"base": "https://hiya.atlassian.net/wiki",
		"context": "/wiki"
	}
}

Of course, it was not listed in _expandable , but actually is mentioned in the docs if you fully expand expand.

This is likely to be similar for
/wiki/rest/api/user?accountId=xxx&expand=isExternalCollaborator, but I have not tried it yet.

1 Like