Can non-admin users easily block a group of users from a single Confluence page in a space?

[Laura Bridges]

We have a large group of users that we don't want to access specific pages in a wiki space. Adding them all manually would be too time-consuming so for now, we prohibit them from accessing the entire space instead of just the dozen or so pages they should not be able to access. 

Is there a way to do this quickly, perhaps at the API level or by using the CQL? 

Thanks!

[Jayesh Raghuvanshi]

@Laura Bridges 

Yes—bulk page restrictions aren’t available in the Cloud UI, but you can do this quickly by scripting the Confluence Cloud REST API: use CQL to find the target pages, then apply “allowlist” page restrictions to permitted groups or users in a loop

Confluence Cloud restrictions are “allowlists,” so to block a large group from a set of pages, grant view access only to the specific group(s)/users who should still see them, ensuring the blocked group is not included in any allowed group. CQL is read-only, but it’s perfect for selecting the pages you want to update; then use the Content Restrictions endpoints to add or replace restrictions programmatically

Bulk via API

Discover the allowed group id(s) with the Group API, then reuse those ids when adding restrictions.

For each page id, call PUT /wiki/rest/api/content/{id}/restriction to replace existing restrictions, or POST to add without replacing

Use CQL

Query page ids by space, label, or ancestor with /wiki/rest/api/search?cql=..., then paginate through results

Examples: type=page AND space=ABC AND label=confidential, or ancestor=123456 for a whole subtree

Reference articles

https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-search/

https://community.atlassian.com/forums/App-Central-articles/How-to-bulk-change-page-restrictions-in-Confluence-Cloud/ba-p/2978471
https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-content-restrictions/#api-group-content-restrictions
https://support.atlassian.com/confluence-cloud/docs/manage-permissions-on-the-page-level/

Thanks
Jayesh R

[Christos Markoulatos]

Hey @Laura Bridges 

Here’s the straight answer: Confluence doesn’t have a quick “block this group from one page” feature unless you use page restrictions, and those require edit rights plus the “Restrict” permission in the space. So if you’re not a space admin (or don’t have that permission), you can’t do it natively.

Can you use groups?

Yes! Instead of typing names, use Confluence groups in the restriction dialog. That’s the easiest way to manage access consistently. If you don’t have a group for “allowed users,” create one and add only those who should see the page. Everyone else is excluded.

API or CQL options?

• REST API (Cloud): You can automate restrictions with /wiki/rest/api/content/{id}/restriction endpoints. These let you set view/edit restrictions for users or groups programmatically.
• CQL: It’s for querying content, not applying restrictions. So you can find pages but not change permissions with CQL alone.

In my opinion, the API approach is difficult because it involves scripting, authentication, and managing page IDs for every restriction, far more complex than simply using groups in the UI. A quicker alternative is applying a restriction to a parent page and using groups, so you only manage membership once instead of editing multiple pages.

Workarounds if you have many pages

• Bulk update via apps: Tools like Panorama for Confluence or ScriptRunner let you apply restrictions to multiple pages at once.

Links that might help:

• Manage permissions at the page level
• Page restrictions explained

Hope this helps!

[Calvin]

Heya, we do something similar, we provide access to the entire space, but for certain users we allow them to add "restrictions" to pages, this can be done via the "Share" button (formerly the padlock) on the confluence space.

That way the others users don't even know it exists.

Add restriction to a certain page so only certain users can view:

Allow certain users or groups to be able to add or remove that restriction: