Interpreting permissions from the Confluence REST API

Question

I can get a list of permissions from the Confluence REST API (using PythonConfluenceAPI):

p = api.get_space_information(space_key, expand="permissions")['permissions']

I get a list of dictionaries, with information about operations and subjects. But there are mismatches between the information from the API, and the permissions displayed in Confluence:

There are operations in the API that are not in the browser (update blogpost).
There are operations in the browser that are not in the API (space export, space admin, mail delete).
There are entries in the API list that have no operation specified at all, and these entries often duplicated appear multiple times.

What I really want to get is a list of space admins. I'm hoping someone can explain these permission structures the API is giving me.

score 3 · Answer 1 · answered May 01 '17 at 00:07

Like you I wasn't able to use the RPC api that seemed to have been removed entirely. There is a few things you can use if you want to grab a list of the space admins.

The simple way would be to use the /rest/api/group/confluence-administrators/member route, that will return you the list of all the members of the confluence administrators that would automatically be space admins.

If you don't have a lot of users, you could also use the Space Permissions Handler add-on that you can install on the administration panel. It will provide you an api with all the permissions of a given user, with the same type of format that were returned by the old getSpacePermissionSets.

But still it might be a pain and not the most helpful thing if you have a lot of users to check them individually. I created a Confluence add-on that would allow me to use the java api, and leverage the getAdmins method of the SpaceDirectoryEntity.

The single endpoint is pretty straightforward:

@GET
@Produces(MediaType.APPLICATION_JSON)
@Path("/{key}")
public Response getAdmins(@PathParam("key") String key) {
  Space space = spaceManager.getSpace(key);
  if (space == null) {
    return Response.status(Response.Status.NOT_FOUND).build();
  }

  List<User> admins = spaceManager.getSpaceAdmins(space);
  List<Object> out = new ArrayList<Object>();

  for (User admin: admins) {
      Map<String, String> item = new HashMap<String, String>();
      item.put("fullName", admin.getFullName());
      item.put("name", admin.getName());
      item.put("email", admin.getEmail());
      out.add(item);
  }

  Gson gson = new Gson();
  String json = gson.toJson(out);
  return Response.ok(json).build();
}

And would give this kind of response if given a valid space key:

[
  {
    "name": "admin",
    "fullName": "admin",
    "email": "admin@hehe.com"
  },
  {
    "name": "admin2",
    "fullName": "admin2",
    "email": "admin2@hehe.com"
  }
]

Might need a little more work to cleanup the add-on if you want me to open-source it, just tell me if you would be interested.

@Nedatchelder Tell me if I'm missing anything – Preview May 04 '17 at 15:50 — Preview, May 04 '17 at 15:50

score 0 · Answer 2 · answered Apr 20 '17 at 08:39

Unfortunately, there is no proper documentation across the REST API and the way that you can get the Space Admin Permission via this. However, I believe you are able to use the old JSON-RPC API to get the list of the space permissions. It's accessible via:

http://<confluence-url>/rpc/json-rpc/confluenceservice-v2/getSpacePermissionSets

It technically returns the response like following:

[
  {
    "type": "SETSPACEPERMISSIONS",
    "spacePermissions": [
      {
        "type": "SETSPACEPERMISSIONS",
        "userName": null,
        "groupName": "confluence-administrators"
      }
    ]
  },
  {
    "type": "EXPORTSPACE",
    "spacePermissions": [
      {
        "type": "EXPORTSPACE",
        "userName": null,
        "groupName": null
      },
      {
        "type": "EXPORTSPACE",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "EXPORTSPACE",
        "userName": null,
        "groupName": "confluence-administrators"
      }
    ]
  },
  {
    "type": "SETPAGEPERMISSIONS",
    "spacePermissions": [
      {
        "type": "SETPAGEPERMISSIONS",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "SETPAGEPERMISSIONS",
        "userName": null,
        "groupName": "confluence-administrators"
      }
    ]
  },
  {
    "type": "REMOVEMAIL",
    "spacePermissions": [
      {
        "type": "REMOVEMAIL",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "REMOVEMAIL",
        "userName": null,
        "groupName": "confluence-administrators"
      },
      {
        "type": "REMOVEMAIL",
        "userName": null,
        "groupName": null
      }
    ]
  },
  {
    "type": "REMOVEBLOG",
    "spacePermissions": [
      {
        "type": "REMOVEBLOG",
        "userName": null,
        "groupName": null
      },
      {
        "type": "REMOVEBLOG",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "REMOVEBLOG",
        "userName": null,
        "groupName": "confluence-administrators"
      }
    ]
  },
  {
    "type": "EXPORTPAGE",
    "spacePermissions": [
      {
        "type": "EXPORTPAGE",
        "userName": null,
        "groupName": null
      },
      {
        "type": "EXPORTPAGE",
        "userName": null,
        "groupName": "confluence-administrators"
      },
      {
        "type": "EXPORTPAGE",
        "userName": null,
        "groupName": "confluence-users"
      }
    ]
  },
  {
    "type": "REMOVEATTACHMENT",
    "spacePermissions": [
      {
        "type": "REMOVEATTACHMENT",
        "userName": null,
        "groupName": null
      },
      {
        "type": "REMOVEATTACHMENT",
        "userName": null,
        "groupName": "confluence-administrators"
      },
      {
        "type": "REMOVEATTACHMENT",
        "userName": null,
        "groupName": "confluence-users"
      }
    ]
  },
  {
    "type": "CREATEATTACHMENT",
    "spacePermissions": [
      {
        "type": "CREATEATTACHMENT",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "CREATEATTACHMENT",
        "userName": null,
        "groupName": null
      },
      {
        "type": "CREATEATTACHMENT",
        "userName": null,
        "groupName": "confluence-administrators"
      }
    ]
  },
  {
    "type": "VIEWSPACE",
    "spacePermissions": [
      {
        "type": "VIEWSPACE",
        "userName": null,
        "groupName": "confluence-administrators"
      },
      {
        "type": "VIEWSPACE",
        "userName": null,
        "groupName": null
      },
      {
        "type": "VIEWSPACE",
        "userName": null,
        "groupName": "confluence-users"
      }
    ]
  },
  {
    "type": "EDITBLOG",
    "spacePermissions": [
      {
        "type": "EDITBLOG",
        "userName": null,
        "groupName": null
      },
      {
        "type": "EDITBLOG",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "EDITBLOG",
        "userName": null,
        "groupName": "confluence-administrators"
      }
    ]
  },
  {
    "type": "REMOVEPAGE",
    "spacePermissions": [
      {
        "type": "REMOVEPAGE",
        "userName": null,
        "groupName": "confluence-administrators"
      },
      {
        "type": "REMOVEPAGE",
        "userName": null,
        "groupName": null
      },
      {
        "type": "REMOVEPAGE",
        "userName": null,
        "groupName": "confluence-users"
      }
    ]
  },
  {
    "type": "REMOVECOMMENT",
    "spacePermissions": [
      {
        "type": "REMOVECOMMENT",
        "userName": null,
        "groupName": null
      },
      {
        "type": "REMOVECOMMENT",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "REMOVECOMMENT",
        "userName": null,
        "groupName": "confluence-administrators"
      }
    ]
  },
  {
    "type": "EDITSPACE",
    "spacePermissions": [
      {
        "type": "EDITSPACE",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "EDITSPACE",
        "userName": null,
        "groupName": "confluence-administrators"
      },
      {
        "type": "EDITSPACE",
        "userName": null,
        "groupName": null
      }
    ]
  },
  {
    "type": "COMMENT",
    "spacePermissions": [
      {
        "type": "COMMENT",
        "userName": null,
        "groupName": "confluence-users"
      },
      {
        "type": "COMMENT",
        "userName": null,
        "groupName": "confluence-administrators"
      },
      {
        "type": "COMMENT",
        "userName": null,
        "groupName": null
      }
    ]
  }
]

If you don't have any limitation and you are able to run the query against the database, you can also use following Query:

SELECT s.SPACENAME, u.username FROM SPACES s 
 JOIN SPACEPERMISSIONS p ON s.SPACEID = p.SPACEID
 JOIN user_mapping u ON p.PERMUSERNAME = u.user_key 
  WHERE p.PERMTYPE = 'SETSPACEPERMISSIONS';

Above query returns the list of the space administrators for all spaces across your instance.

Thanks. I'm having trouble finding examples of using Python to access the JSON-RPC API. I get 404's when I try posting with requests. Should it be available on my wiki? https://openedx.atlassian.net/wiki/display/OXA/Open+edX+Answers — Ned Batchelder, Apr 20 '17 at 10:39
ahhh you are on Atlassian Cloud I don't think SOAP is available for Cloud version. Well, check this REST API then and see if it suits (https://docs.atlassian.com/confluence/REST/latest/#space-space) . Note that, if you just need it for one time, may be you can check with Atlassian Support to see if they can run that query for you or not :-) — Saleh Parsa, Apr 20 '17 at 10:52
That REST API is where I started, and where I am getting strange half-populated permissions lists... Thanks anyway. — Ned Batchelder, Apr 20 '17 at 11:06
No worries Ned. Wish I could help but unfortunately, API doc is still not complete and no enough resource for it specially for Cloud with all restrictions. — Saleh Parsa, Apr 20 '17 at 11:07

Interpreting permissions from the Confluence REST API

2 Answers2