User management XML-RPC API changes in Confluence Cloud

As of , a number of user management XML-RPC APIs will be either modified or removed from Confluence Cloud. We've prepared this article as a reference for customers who may have relied on these APIs for user management situations.

 

Why?

The rollout of Atlassian account for JIRA and Confluence Cloud transfers the management of individual user accounts from a customer's JIRA or Confluence instance to Atlassian account—a globally unique user account that can be used to access all Atlassian Cloud products (JIRA, Confluence, HipChat and Bitbucket). Any user account changes permitted through Confluence APIs have the potential to modify user accounts being used by another product, and pose a security risk for users of multiple Atlassian Cloud products.

 

Note that API tokens do not support the XML-RPC and SOAP APIs in Confluence Cloud.

 

Which APIs remain unchanged?

The following APIs remain will continue to operate normally and are not affected by this change. 

XML-RPC API

addGroup

addUserToGroup
removeUserFromGroup
removeUser
removeGroup
deactivateUser
reactivateUser
setUserInformation

 

Which APIs were modified?

We've modified the behavior of the following APIs, but their signatures remain the same. This is due to user accounts being managed in Atlassian account, and not within the tenant itself. Behavior that adds/removes users from groups will be maintained, but actions that perform direct user operations will be ignored (like creating/deleting users, and specifying/modifying passwords) as these are Atlassian account-related actions. 

XML-RPC APIChange

addUser

  • The user will be added to the requested site, assuming permission and license checks have been satisfied
    • If a user with the specified email address already exists in Atlassian account, that account's information is used and information sent in the API request, like the display name, is discarded
    • If no user with the specified email address exists in Atlassian account, a new Atlassian account will be created using the specified email and display name details
  • Passwords included in the request payload will always be ignored

addUser + notify user

Which APIs were removed?

The following Confluence XML-RPC APIs have been removed. These APIs create, modify or delete user attributes and passwords, which are no longer managed by the Confluence tenant following the rollout of Atlassian account and SSO. 

XML-RPC API
editUser

changeUserPassword

changeMyPassword

addProfilePicture

FAQ

What is Atlassian account?

Atlassian account is a single user account for logging in to Atlassian Cloud products, as well as our Help, Knowledge and Billing systems. It's being progressively rolled out to JIRA, Confluence and HipChat, and has been fully rolled out for Bitbucket. 

Check out Introducing Atlassian account to find out more. 

Why are you making these changes?

Bringing Atlassian account to all Atlassian Cloud products lets us to quickly deliver commonly requested user management and account features, like SAML and two-factor authentication, to all products. A single account also simplifies the end-user login experience, particularly for users who access multiple products across both desktop and mobile apps. 

What options do I have for managing Atlassian accounts themselves via API?

 You can't manage Atlassian accounts via public APIs today. We're currently evaluating how best to expose these capabilities in a secure manner that best meets our customers' use-cases.

Last modified on Nov 2, 2018

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.