Can't Enable upgrade mode using REST api due to "XSRF checks failed"

[ZPS GPM]

Hi!

I'm trying to automate the upgrade process for our Confluence 7.13 Data Center installation. Therefore I want to use the /rest/zdu/start endpoint to enable upgrade mode via a script.

But I'm stuck right at the beginning on my test system.

It's possible to get the state of the cluster:

curl -k -H "Authorization: Bearer <token>" https://conf-test.server/rest/zdu/state

But when I try 
curl -k -H "Authorization: Bearer <token>" https://conf-test.server/rest/zdu/start

there is no console output and in atlassian-confluence.log it says:

2022-01-24 15:58:19,378 WARN [http-nio-8090-exec-6] [common.security.jersey.XsrfResourceFilter] passesAllXsrfChecks XSRF checks failed for request: https://conf-test.server/rest/zdu/start , origin: null , referrer: null
-- url: /rest/zdu/start | traceId: 039e827a3833ec22 | userName: admin

XSRF seems to be a big problem while using the api, but I can't see any reason why /state works and /start doesn't!?!?

Any hint is appreciated!

Thx!

[Joshua Sneed Contegix · Accepted solution]

Hi ZPS GPM,

I'm not API guy, but maybe something like --header "X-Atlassian-Token: no-check in there. Otherwise I would check out: https://developer.atlassian.com/server/confluence/confluence-rest-api-examples/

Cheers!

[ZPS GPM]

Hi @Joshua Sneed Contegix 

that did the trick! Thx a lot!

I didn't get that from the examples and all the other community posts... :-(((

Here is the complete curl command for other users seeking help (with personal access token):

curl -k -H "Authorization: Bearer <token>" -H "X-Atlassian-Token: no-check" -X POST https://conf-test.server/rest/zdu/start

[Joshua Sneed Contegix]

Welcome ZPS GPM!
It isn't explicitly clear, but makes sense when you realize there are a handful of cookies/tokens that are handled by the browser and checked by Confluence. It is necessary to tell the API that you don't need some of those (because you are not a browser) and then you are allowed to do what you need. Happy automation, cheers!