Confluence Audit CCP connector: "Atlassian Confluence organization URL" field/placeholder is misleading for scoped API tokens (401 Unauthorized)
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 3.8k
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 125
Description
# Confluence Audit CCP connector: "Atlassian Confluence organization URL" field/placeholder is misleading for scoped API tokens (401 Unauthorized)
**Labels (if available):** bug, documentation, Connector, Confluence
## Summary
The "Atlassian Confluence organization URL" field in the Confluence Audit CCP connector's Connect UI only shows the placeholder `.atlassian.net`, and its tooltip/label give no indication that Atlassian scoped API tokens require a different URL format. Following the UI as designed produces a 401 Unauthorized when using a scoped token, even when the token has correct scopes and permissions.
## Environment
- Solution: Atlassian Confluence Audit
- Connector: Atlassian Confluence Audit (via Codeless Connector Platform)
- Package version tested: 3.0.7 (also present in earlier CCP versions back to 3.0.3)
## Steps to Reproduce
1. Create an Atlassian scoped API token (`read:audit-log:confluence`, etc.) per https://support.atlassian.com/confluence/kb/scoped-api-tokens-in-confluence-cloud/
2. Deploy the Confluence Audit CCP connector, click "Add organization"
3. Enter your Confluence organization URL exactly as the placeholder suggests: `.atlassian.net`
4. Enter service account username and the scoped API token
5. Deploy / test connectivity
**Screenshot of the Connect dialog:**
## Expected
Connector authenticates successfully, or the UI clearly indicates the URL format required for scoped tokens.
## Actual
```
Connectivity check failed. ConnectorId: ConfluenceAuditLogsPoller,
Status code: Unauthorized,
Message: Call failed with status code 401 (Unauthorized):
GET https://.atlassian.net/wiki/rest/api/audit?startDate=...&endDate=...&limit=1000
```
## Root Cause
In `Solutions/AtlassianConfluenceAudit/Package/mainTemplate.json`, the request endpoint is built as:
```json
"apiEndpoint": "[concat('https://', parameters('confluenceorganizationurl'), '/wiki/rest/api/audit')]"
```
Per Atlassian's own documentation on scoped API tokens (https://support.atlassian.com/atlassian-cloud/kb/401-unauthorized-error-when-service-account-accesses-jira-or-confluence-api/), scoped tokens must call the gateway endpoint `https://api.atlassian.com/ex/confluence/{cloudId}/...` rather than `.atlassian.net`. A classic (unscoped) token against `.atlassian.net` works fine; the exact same call with a scoped token returns 401 — not because of missing scopes/permissions, but because it's the wrong host entirely.
The `confluenceorganizationurl` parameter itself has no format validation (`"validations": {"required": true}` only), so it **can** accept `api.atlassian.com/ex/confluence/{cloudId}` and produce a working URL — but nothing in the label, tooltip, or placeholder communicates this. Users following the UI's own example are led directly into the 401.
For comparison, the companion Jira Audit CCP connector's polling logic constructs the equivalent gateway URL (`api.atlassian.com/ex/jira/{cloudId}/rest/api/3/auditing/record`) — so Jira's connector behavior with scoped tokens is more discoverable/consistent than Confluence's, even though the underlying template pattern (free-text org URL field) is similar.
## Suggested Fix
- Update the field label/placeholder/tooltip for `confluenceorganizationurl` to note that scoped API tokens require the value `api.atlassian.com/ex/confluence/{cloudId}` instead of `.atlassian.net`, and link to where users can find their cloud ID (`https://.atlassian.net/_edge/tenant_info`).
- Ideally, add a dedicated "Cloud ID" input and construct the gateway URL automatically when a scoped token is used, matching what appears to already work for Jira — rather than relying on users to know they can override the "domain" field with a full path.
- Cross-reference: #13260 (related confusion around scoped token support in Jira/Confluence CCF connectors).
## Additional Context
Verified against `mainTemplate.json` in the 3.0.7 package (`Solutions/AtlassianConfluenceAudit/Package/mainTemplate.json`, line ~803) and the legacy Azure Functions-based connector (v1.0.0), whose equivalent "Domain Name" field has the same unrestricted-text behavior and works when a scoped-token gateway path is entered manually.
Contributor guide
Assessment
This issue has not been assessed yet.