Read-only permission audit for Confluence Cloud. Every finding is traceable to a space, a principal and an operation.
It reads the permission assignments of every space in your Confluence site and reports the ones that normally deserve a second look: external guests, guests and external collaborators, unlicensed users, "all licensed users" access, service accounts holding admin or write rights, individually granted space admin rights, spaces with no group-based admin, and principals whose account or group no longer exists.
Anonymous and public-link access cannot be audited through the API. Verified in September 2026 against the live Confluence Cloud API: the v2 space permissions endpoint does not return anonymous or public-link assignments, the v1 space endpoint that used to expose them has been retired by Atlassian (HTTP 410), and Atlassian's published scope list contains no anonymous or public-link related scope at all. Any app claiming to read this through the API is guessing.
Please verify this item manually in Confluence administration: Space permissions and Public links. The app states this limitation on its own screen rather than silently reporting zero findings.
Other things it does not do: it does not scan page-level or blog-post-level restrictions, it does not change permissions, and it does not send your data anywhere outside your Atlassian site.
| Scope | Why it is needed |
|---|---|
read:space:confluence | List the spaces in the site (GET /wiki/api/v2/spaces). |
read:space.permission:confluence | Read each space's permission assignments and the principals they are granted to. |
read:group:confluence | Resolve group principals to group names. |
read:confluence-user | Resolve user principals to display names and determine guest/unlicensed state. |
write:confluence-file | The only write scope. Upload the CSV report the app generated as an attachment to a page you specify. Narrowest scope that covers the attachment endpoint, chosen from Atlassian's published per-endpoint scope list. |
storage:app | Remember your chosen export page and the permission fingerprint used by the daily scan. |
The app has no public web endpoint, no webhook and no external server. It holds no credentials of its own and makes no outbound calls to any third party.
| Level | Meaning |
|---|---|
| High | Access that reaches outside your organisation. |
| Medium | Authorisation broader than needed, or a governance defect: unlicensed or guest users, "all licensed users" access on a non-personal space, service accounts with admin or write rights, no group-based admin, principals that no longer exist. |
| Low | Informational items, listed so the report answers "who can see this space" completely: individually granted admin rights, group-based admin, personal-space site-wide read access, admin-class subjects. |
| Rule | Level | Fires when |
|---|---|---|
PUBLIC_SPACE | High | Principal is anonymous. Kept as a fallback: the API currently does not return this data (see the limitation above). |
GUEST_ACCESS | High | Account is a guest or external collaborator (authoritative flag), otherwise a guest/external keyword in the principal id. |
UNLICENSED_ACCESS | Medium | Principal has site access but no Confluence licence. |
EVERYONE_READ | Medium | "All licensed users" access on a space that is not a personal space. |
NO_GROUP_ADMIN | Medium | Space admin is granted to individuals only, with no group holding admin. |
ORPHAN_PRINCIPAL | Medium | A principal is confirmed to no longer exist by an individual lookup returning 404. If any lookup is inconclusive the whole rule is switched off, and the app says so on screen. |
APP_ACCOUNT_ACCESS | Low | A third-party service account holds administer. |
APP_ACCOUNT_WRITE | Low | A third-party service account holds create/update/delete. |
INDIVIDUAL_ADMIN | Low | An individual holds space admin. Space owners are excluded — that is expected. |
GROUP_ADMIN | Low | A group holds space admin. Listed for completeness; this is the recommended way. |
PERSONAL_SPACE_EVERYONE | Low | Site-wide read access on a personal space, which on most sites is Confluence's default space permission. Downgraded to informational so that thousands of personal spaces cannot bury the real problems. |
ADMIN_CLASS_ACCESS | Low | The principal is an "all product admins" / "all site admins" access class. Admins have cross-space access by design. |
A rule hitting one space and a rule hitting five thousand spaces are completely different problems. The per-rule table shows, for each rule, how many spaces it hits, how many findings it produced and how many permission records it covers, so scale is visible before you dive into the list.
The app stores a fingerprint of the permission configuration and re-checks it once a day. Nothing is written when nothing changed, and the scan does not touch permissions.
| Symptom | What to do |
|---|---|
| Some spaces show as failed | The app lists the failing spaces and the API's reason on screen. It is usually a permission the app does not have for a specific space; other spaces are still reported. |
| "Orphan check switched off" | A principal lookup did not return a definitive answer, so the app refuses to guess. The screen names the principal and the status it received. |
| Anonymous or public access shows nothing | Expected — not available through the API. Check it manually (see above). |
| Attachment upload fails | Check that the page URL is correct and that you can edit that page. The app reports the exact HTTP status it received. |