Create a page with REST API and directly set permissions

[Robin]

Hi folks,

I want to create a page within Confluence Data Center with REST API. But the content is confidential and I have to take care to directly set restrictions to the page.

For sure I had a look into the current API documentation (https://developer.atlassian.com/server/confluence/rest/v1010/api-group-content-resource/#api-rest-api-content-post). And there is a teaser which attributes should be passed, but I am not able to get this run.

Tested it with something like this:

curl --location 'https://my-server/confluence/rest/api/content/' \
--header 'Content-Type: application/json' 
--data '{
    "type":"page",
    "title":"test4",
    "ancestors": [
        {
            "id":627248505
        }
    ], 
    "space": {
        "key":"Testspace"
    },
    "restrictions": { 
        "operation": "update", 
        "restrictions": { 
            "group": [ "Testgroup"] 
        }
    },
    "body": {
        "storage": {
            "value":"<at:declarations /><ac:layout>foobar</ac:layout>",
            "representation":"storage"
        }
    }
}'

I get no error message. My page is created but the restrictions are missing. I created dozens of versions with the restrictions parameter. Please help me.. :(

[Ryan M]

I think the correct way to form the restrictions portion is as follows

    "restrictions": {
        "update": {
            "restrictions": [
                {
                    "type": "group",
                    "name": "Testgroup"
                }
            ]
        }
    }, 

 However I don't have a test environment handy I can try it in right now, but you may want to try that. 

[Robin]

This is also not working. The page is created with HTTP 200 but the permissions are missing in the end.

Maybe it is related that I should not lock me out and so I have to add also my User for the permissions. But I tried that also with no success.

[Florian Bonniec]

Hi @Robin 

SO you get response that the page is created but the page is empty ? Is it in the UI or same if you then fetch the page using the API ?

Regards

[Robin]

sorry for confusion. I missed to have a look for the storage format. My page is created with my content. Just the permissions are missing. sorry for that.

[Florian Bonniec]

I think you have to do 2 calls. 

1. Create page
2. Add restriction

If there is a risk for the content to be access between the 2 calls, that I'm not sure is possible you can apply restriction on the parent first.

1. Apply restriction on the parent
2. Create page
3. Apply restriction on the page
4. Remove restriction on the parent

Regards

[Robin]

i would prefer the documented solution with directly add the restrictions. It is not that easy to implement the other case. What is when the parent is also restricted? Then I have to read all of that, save that, extend that, push the extended. After I have to read all, remove my added and push the others back. This is to much overhead for a workaround and will make problems.