Atlassian Restrictions API

openapi: 3.1.0
info:
  title: Atlassian Admin Account Restrictions API
  description: The Atlassian Admin API provides programmatic access to manage Atlassian organizations, users, domains, policies, and events. It enables administrators to automate organization management tasks, integrate with identity providers, and ensure appropriate access to Atlassian products.
  version: 1.0.0
  contact:
    name: Atlassian Developer
    url: https://developer.atlassian.com/cloud/admin/
  license:
    name: Atlassian Developer Terms
    url: https://developer.atlassian.com/platform/marketplace/atlassian-developer-terms/
  x-logo:
    url: https://wac-cdn.atlassian.com/assets/img/favicons/atlassian/favicon.png
servers:
- url: https://api.atlassian.com
  description: Atlassian Cloud API
security:
- bearerAuth: []
- oauth2: []
tags:
- name: Restrictions
paths:
  /repositories/{workspace}/{repo_slug}/branch-restrictions:
    parameters:
    - name: repo_slug
      in: path
      description: 'This can either be the repository slug or the UUID of the repository,

        surrounded by curly-braces, for example: `{repository UUID}`.

        '
      required: true
      schema:
        type: string
    - name: workspace
      in: path
      description: 'This can either be the workspace ID (slug) or the workspace UUID

        surrounded by curly-braces, for example: `{workspace UUID}`.

        '
      required: true
      schema:
        type: string
    get:
      tags:
      - Restrictions
      description: This operation retrieves all branch restrictions configured for a specific repository within a Bitbucket workspace. Branch restrictions are rules that control who can push to branches, require pull requests, enforce merge checks, or limit branch deletions. By sending a GET request to this endpoint with the workspace ID and repository slug, you receive a paginated list of all active restrictions including their types, patterns (which branches they apply to), and associated users or groups. This is useful for auditing repository security policies, understanding workflow requirements, or programmatically managing branch protection rules across multiple repositories.
      summary: Atlassian List Branch Restrictions
      responses:
        '200':
          description: A paginated list of branch restrictions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/paginated_branchrestrictions'
        '401':
          description: If the request was not authenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'
        '403':
          description: If the authenticated user does not have admin access to the repository
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'
        '404':
          description: If the repository does not exist
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'
      parameters:
      - name: kind
        in: query
        description: Branch restrictions of this type
        required: false
        schema:
          type: string
      - name: pattern
        in: query
        description: Branch restrictions applied to branches of this pattern
        required: false
        schema:
          type: string
      security:
      - oauth2:
        - repository:admin
      - basic: []
      - api_key: []
      x-atlassian-oauth2-scopes:
      - state: Current
        scheme: oauth2
        scopes:
        - admin:repository:bitbucket
      operationId: listBranchRestrictions
      x-api-evangelist-processing:
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /wiki/rest/api/content/{id}/restriction:
    get:
      tags:
      - Restrictions
      summary: Atlassian Get Restrictions
      description: This API operation retrieves the restrictions applied to a specific piece of Confluence content identified by its ID. When called, it returns information about who can view or edit the content, including any user or group-based access controls that have been configured. The restrictions help enforce content security by limiting which users or groups have permission to interact with pages, blog posts, or other content types within a Confluence space. The response typically includes details about read and update restrictions, along with the users and groups that are explicitly granted or denied access to the specified content item.
      operationId: getRestrictions
      parameters:
      - name: id
        in: path
        description: The ID of the content to be queried for its restrictions.
        required: true
        schema:
          type: string
      - name: expand
        in: query
        description: 'A multi-value parameter indicating which properties of the content

          restrictions to expand. By default, the following objects are expanded:

          `restrictions.user`, `restrictions.group`.


          - `restrictions.user` returns the piece of content that the restrictions are

          applied to.

          - `restrictions.group` returns the piece of content that the restrictions are

          applied to.

          - `content` returns the piece of content that the restrictions are

          applied to.'
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
            enum:
            - restrictions.user
            - read.restrictions.user
            - update.restrictions.user
            - restrictions.group
            - read.restrictions.group
            - update.restrictions.group
            - content
      - name: start
        in: query
        description: The starting index of the users and groups in the returned restrictions.
        schema:
          minimum: 0
          type: integer
          format: int32
          default: 0
      - name: limit
        in: query
        description: 'The maximum number of users and the maximum number of groups, in the

          returned restrictions, to return per page. Note, this may be restricted

          by fixed system limits.'
        schema:
          minimum: 0
          type: integer
          format: int32
          default: 100
      responses:
        '200':
          description: Returned if the requested restrictions are returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContentRestrictionArray'
        '404':
          description: 'Returned if;


            - There is no content with the given ID.

            - The calling user does not have permission to view the content.'
          content: {}
      security:
      - basicAuth: []
      - oAuthDefinitions:
        - read:confluence-content.all
      x-atlassian-oauth2-scopes:
      - scheme: oAuthDefinitions
        state: Current
        scopes:
        - read:confluence-content.all
      - scheme: oAuthDefinitions
        state: Beta
        scopes:
        - read:content-details:confluence
      x-atlassian-data-security-policy:
      - app-access-rule-exempt: false
      x-atlassian-connect-scope: READ
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      tags:
      - Restrictions
      summary: Atlassian Update Restrictions
      description: Updates restrictions for a piece of Confluence content identified by the content ID. This operation allows you to modify who can view or edit the content by setting user and group permissions. The request requires the content ID in the URL path and a JSON payload containing the restriction details, including operation type (read or update), restrictions by user or group, and can completely replace existing restrictions. You must have appropriate permissions to modify restrictions on the content, and the operation will return the updated restriction set upon successful completion. This is commonly used to change content visibility, implement access controls, or adjust collaborative permissions for specific pages or blog posts within a Confluence space.
      operationId: updateRestrictions
      parameters:
      - name: id
        in: path
        description: The ID of the content to update restrictions for.
        required: true
        schema:
          type: string
      - name: expand
        in: query
        description: 'A multi-value parameter indicating which properties of the content

          restrictions (returned in response) to expand.


          - `restrictions.user` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `restrictions.group` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `content` returns the piece of content that the restrictions are

          applied to.'
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
            enum:
            - restrictions.user
            - read.restrictions.user
            - update.restrictions.user
            - restrictions.group
            - read.restrictions.group
            - update.restrictions.group
            - content
      requestBody:
        description: The updated restrictions for the content.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ContentRestrictionAddOrUpdateArray'
        required: true
      responses:
        '200':
          description: Returned if the requested restrictions are updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContentRestrictionArray'
        '404':
          description: 'Returned if;


            - There is no content with the given ID.

            - The calling user does not have permission to update restrictions

            for the content.'
          content: {}
      security:
      - basicAuth: []
      - oAuthDefinitions:
        - write:confluence-content
      x-atlassian-oauth2-scopes:
      - scheme: oAuthDefinitions
        state: Current
        scopes:
        - write:confluence-content
      - scheme: oAuthDefinitions
        state: Beta
        scopes:
        - read:content-details:confluence
        - write:content.restriction:confluence
      x-atlassian-data-security-policy:
      - app-access-rule-exempt: false
      x-codegen-request-body-name: body
      x-atlassian-connect-scope: WRITE
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      tags:
      - Restrictions
      summary: Atlassian Add Restrictions
      description: The Add Restrictions operation in the Atlassian Confluence Content API allows you to apply access controls to a specific piece of content by sending a POST request to /wiki/rest/api/content/{id}/restriction, where {id} represents the unique identifier of the content you want to restrict. This endpoint enables administrators and authorized users to define who can view or edit the content by specifying user accounts, groups, or both in the request payload. The restrictions can be applied at different operation levels such as read or update permissions, effectively controlling content visibility and editability within a Confluence space. When successfully executed, the API returns the newly created restriction details, allowing you to implement fine-grained security policies and maintain proper content governance across your Confluence instance.
      operationId: addRestrictions
      parameters:
      - name: id
        in: path
        description: The ID of the content to add restrictions to.
        required: true
        schema:
          type: string
      - name: expand
        in: query
        description: 'A multi-value parameter indicating which properties of the content

          restrictions (returned in response) to expand.


          - `restrictions.user` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `restrictions.group` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `content` returns the piece of content that the restrictions are

          applied to.'
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
            enum:
            - restrictions.user
            - read.restrictions.user
            - update.restrictions.user
            - restrictions.group
            - read.restrictions.group
            - update.restrictions.group
            - content
      requestBody:
        description: The restrictions to be added to the content.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ContentRestrictionAddOrUpdateArray'
        required: true
      responses:
        '200':
          description: Returned if the requested restrictions are added.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContentRestrictionArray'
        '404':
          description: 'Returned if;


            - There is no content with the given ID.

            - The calling user does not have permission to add restrictions to

            the content.'
          content: {}
      security:
      - basicAuth: []
      - oAuthDefinitions:
        - write:confluence-content
      x-atlassian-oauth2-scopes:
      - scheme: oAuthDefinitions
        state: Current
        scopes:
        - write:confluence-content
      - scheme: oAuthDefinitions
        state: Beta
        scopes:
        - read:content-details:confluence
        - write:content.restriction:confluence
      x-atlassian-data-security-policy:
      - app-access-rule-exempt: false
      x-codegen-request-body-name: body
      x-atlassian-connect-scope: WRITE
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      tags:
      - Restrictions
      summary: Atlassian Delete Restrictions
      description: Removes content restrictions from a specific piece of Confluence content identified by its ID. This operation deletes all restriction settings that control who can view or edit the content, effectively making it accessible according to the space's default permissions. When executed successfully, any user or group-based restrictions previously applied to the content are removed, and the content inherits the broader permission scheme of its parent space. This is useful when you need to open up previously restricted content to a wider audience or reset access controls to their default state.
      operationId: deleteRestrictions
      parameters:
      - name: id
        in: path
        description: The ID of the content to remove restrictions from.
        required: true
        schema:
          type: string
      - name: expand
        in: query
        description: 'A multi-value parameter indicating which properties of the content

          restrictions (returned in response) to expand.


          - `restrictions.user` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `restrictions.group` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `content` returns the piece of content that the restrictions are

          applied to.'
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
            enum:
            - restrictions.user
            - read.restrictions.user
            - update.restrictions.user
            - restrictions.group
            - read.restrictions.group
            - update.restrictions.group
            - content
      responses:
        '200':
          description: Returned if the restrictions are removed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContentRestrictionArray'
        '400':
          description: Returned if any of the above validation rules are violated
          content: {}
        '403':
          description: 'Returned if the calling user does not have permission to alter the

            restrictions on the content.'
          content: {}
        '404':
          description: 'Returned if;


            - There is no content with the given ID.

            - The calling user does not have permission to view the content.'
          content: {}
      security:
      - basicAuth: []
      - oAuthDefinitions:
        - write:confluence-content
      x-atlassian-oauth2-scopes:
      - scheme: oAuthDefinitions
        state: Current
        scopes:
        - write:confluence-content
      - scheme: oAuthDefinitions
        state: Beta
        scopes:
        - read:content-details:confluence
        - write:content.restriction:confluence
      x-atlassian-data-security-policy:
      - app-access-rule-exempt: false
      x-atlassian-connect-scope: DELETE
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /wiki/rest/api/content/{id}/restriction/byOperation:
    get:
      tags:
      - Restrictions
      summary: Atlassian Get Restrictions by Operation
      description: This API operation retrieves content restrictions for a specific Confluence page or blog post, organized by operation type (such as read or update). By providing the content ID in the path parameter, you can fetch all restriction details that determine which users or groups have permission to perform specific operations on that content. The response returns restrictions grouped by operation, making it easy to understand the access control rules applied to the content and identify who can view, edit, or otherwise interact with the specified page or blog post.
      operationId: getRestrictionsByOperation
      parameters:
      - name: id
        in: path
        description: The ID of the content to be queried for its restrictions.
        required: true
        schema:
          type: string
      - name: expand
        in: query
        description: 'A multi-value parameter indicating which properties of the content

          restrictions to expand.


          - `restrictions.user` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `restrictions.group` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `content` returns the piece of content that the restrictions are

          applied to.'
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
            enum:
            - restrictions.user
            - restrictions.group
            - content
      responses:
        '200':
          description: Returned if the requested restrictions are returned.
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  properties:
                    operationType:
                      $ref: '#/components/schemas/ContentRestriction'
                    _links:
                      $ref: '#/components/schemas/GenericLinks'
      security:
      - basicAuth: []
      - oAuthDefinitions:
        - read:confluence-content.all
      x-atlassian-oauth2-scopes:
      - scheme: oAuthDefinitions
        state: Current
        scopes:
        - read:confluence-content.all
      - scheme: oAuthDefinitions
        state: Beta
        scopes:
        - read:content-details:confluence
      x-atlassian-data-security-policy:
      - app-access-rule-exempt: false
      x-atlassian-connect-scope: READ
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /wiki/rest/api/content/{id}/restriction/byOperation/{operationKey}:
    get:
      tags:
      - Restrictions
      summary: Atlassian Get Restrictions for Operation
      description: This API endpoint retrieves content restrictions that have been applied to a specific Confluence page or blog post for a particular operation type. By providing the content ID and an operation key (such as 'read' or 'update'), you can fetch details about which users or groups have restricted access to perform that operation on the content. The response includes information about the restrictions in place, helping administrators and developers understand and manage access controls for Confluence content programmatically. This is particularly useful for auditing permissions, enforcing security policies, or building custom integrations that need to respect existing content restrictions within a Confluence space.
      operationId: getRestrictionsForOperation
      parameters:
      - name: id
        in: path
        description: The ID of the content to be queried for its restrictions.
        required: true
        schema:
          type: string
      - name: operationKey
        in: path
        description: The operation type of the restrictions to be returned.
        required: true
        schema:
          type: string
          enum:
          - read
          - update
      - name: expand
        in: query
        description: 'A multi-value parameter indicating which properties of the content

          restrictions to expand.


          - `restrictions.user` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `restrictions.group` returns the piece of content that the restrictions are

          applied to. Expanded by default.

          - `content` returns the piece of content that the restrictions are

          applied to.'
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
            enum:
            - restrictions.user
            - restrictions.group
            - content
      - name: start
        in: query
        description: The starting index of the users and groups in the returned restrictions.
        schema:
          minimum: 0
          type: integer
          format: int32
          default: 0
      - name: limit
        in: query
        description: 'The maximum number of users and the maximum number of groups, in the

          returned restrictions, to return per page. Note, this may be restricted

          by fixed system limits.'
        schema:
          minimum: 0
          type: integer
          format: int32
          default: 100
      responses:
        '200':
          description: Returned if the requested restrictions are returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContentRestriction'
      security:
      - basicAuth: []
      - oAuthDefinitions:
        - read:confluence-content.all
      x-atlassian-oauth2-scopes:
      - scheme: oAuthDefinitions
        state: Current
        scopes:
        - read:confluence-content.all
      - scheme: oAuthDefinitions
        state: Beta
        scopes:
        - read:content-details:confluence
      x-atlassian-data-security-policy:
      - app-access-rule-exempt: false
      x-atlassian-connect-scope: READ
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /wiki/rest/api/content/{id}/restriction/byOperation/{operationKey}/group/{groupName}:
    get:
      tags:
      - Restrictions
      summary: Atlassian Get Content Restriction Status for Group
      deprecated: true
      description: 'The Atlassian Confluence Content API endpoint `/wiki/rest/api/content/{id}/restriction/byOperation/{operationKey}/group/{groupName}` using the GET method retrieves the restriction status for a specific group on a particular piece of content. This operation allows administrators and authorized users to check whether a designated group has restrictions applied for a specific operation (such as read or update) on content identified by its unique ID. The endpoint requires three path parameters: the content ID, the operation key that defines the type of action being restricted, and the group name for which to check restrictions. The response returns details about whether the specified group is restricted from performing the given operation on the content, helping manage fine-grained access control within Confluence spaces and pages.'
      operationId: getContentRestrictionStatusForGroup
      parameters:
      - name: id
        in: path
        description: The ID of the content that the restriction applies to.
        required: true
        schema:
          type: string
      - name: operationKey
        in: path
        description: The operation that the restriction applies to.
        required: true
        schema:
          type: string
          enum:
          - read
          - update
      - name: groupName
        in: path
        description: 'The name of the group to be queried for whether the content restriction

          applies to it.'
        required: true
        schema:
          type: string
      responses:
        '200':
          description: 'Returns true if the content restriction applies to the group. The response

            will not return a response body.'
          content: {}
        '400':
          description: 'Returned if;


            - Group name is missing'
          content: {}
        '404':
          description: 'Returned if;


            - There is no content with the given ID.

            - The calling user does not have permission to view the content.

            - An invalid operation or group is specified.'
          content: {}
      security:
      - basicAuth: []
      - oAuthDefinitions:
        - read:confluence-content.all
      x-atlassian-oauth2-scopes:
      - scheme: oAuthDefinitions
        state: Current
        scopes:
        - read:confluence-content.all
      - scheme: oAuthDefinitions
        state: Beta
        scopes:
        - read:content.restriction:confluence
      x-atlassian-data-security-policy:
      - app-access-rule-exempt: false
      x-atlassian-connect-scope: READ
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      tags:
      - Restrictions
      summary: Atlassian Add Group to Content Restriction
      deprecated: true
      description: 'The PUT operation on the Atlassian Confluence Content API endpoint `/wiki/rest/api/content/{id}/restriction/byOperation/{operationKey}/group/{groupName}` adds a specified group to an existing content restriction for a particular operation type. This allows administrators to grant a group access to perform specific operations (such as read, update, or delete) on restricted Confluence content by including the group in the restriction''s allowed list. The endpoint requires three path parameters: the content ID identifying the specific page or blog post, the operation key specifying the type of operation being restricted (like ''read'' or ''update''), and the group name identifying which user group should be granted access. This operation is essential for managing collaborative permissions and implementing fine-grained access control within Confluence spaces, enabling teams to secure sensitive content while selectively allowing specific groups to interact with it based on their operational needs.'
      operationId: addGroupToContentRestriction
      parameters:
      - name: id
        in: path
        description: The ID of the content that the restriction applies to.
        required: true
        schema:
          type: string
      - name: operationKey
        in: path
        description: The operation that the restriction applies to.
        required: true
        schema:
          type: string
          enum:
          - read
          - update
      - name: groupName
        in: path
        description: The name of the group to add to the content restriction.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: 'Returned if the group is added to the content restriction. The response

            body will be empty.'
          content: {}
        '404':
          description: 'Returned if;


            - There is no content with the given ID.

            - The calling user does not have permission to view the content.

            - An invalid operation or group is specified.'
          content: {}
      security:
      - basicAuth: []
      - oAuthDefinitions:
        - write:confluence-content
      x-atlassian-oauth2-scopes:
      - scheme: oAuthDefinitions
        state: Current
        scopes:
        - write:confluence-content
      - scheme: oAuthDefinitions
        state: Beta
        scopes:
        - write:content.restriction:confluence
      x-atlassian-data-security-policy:
      - app-access-rule-exempt: false
      x-atlassian-connect-scope: WRITE
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      tags:
      - Restrictions
      summary: Atlassian Remove Group From Content Restriction
      deprecated: true
      description: This API operation removes a specific group from content restrictions for a given operation on a Confluence page or blog post. By sending a DELETE request to this endpoint with the content ID, operation key (such as 'read' or 'update'), and group name, administrators can revoke the specified group's access permissions for that particular operation on the content. This is useful for managing granular access control when you need to remove a group's ability to perform specific actions on restricted content without affecting other groups or individual user restrictions that may be in place.
      operationId: removeGroupFromContentRestriction
      parameters:
      - name: id
        in: path
        description: The ID of the content that the restriction applies to.
        required: true
        schema:
          type: string
      - name: operationKey
        in: path
        description: The operation that the restriction applies to.
        required: true
        schema:
          type: string
          enum:
          - read
          - update
      - name: groupName
        in: path
        description: The name of the group to remove from the content restriction.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: 'Returned if the group is removed from the content restriction. The response

            body will be empty.'
          content: {}
        '404':
          description: 'Returned if;


            - There is no content with the given ID.

            - The calling user does not have permission to view the content.

            - The restriction to be deleted does not exist.'
          content: {}
      security:
      - basicAuth: []
      - oAuthDef

# --- truncated at 32 KB (109 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/atlassian/refs/heads/main/openapi/atlassian-restrictions-api-openapi.yml