Confluence Audit CCP connector: "Atlassian Confluence organization URL" field/placeholder is misleading for scoped API tokens (401 Unauthorized)

[SysAdminforCoffee]

Confluence Audit CCP connector: "Atlassian Confluence organization URL" field/placeholder is misleading for scoped API tokens (401 Unauthorized)

Labels (if available): bug, documentation, Connector, Confluence

Summary

The "Atlassian Confluence organization URL" field in the Confluence Audit CCP connector's Connect UI only shows the placeholder <your-domain>.atlassian.net, and its tooltip/label give no indication that Atlassian scoped API tokens require a different URL format. Following the UI as designed produces a 401 Unauthorized when using a scoped token, even when the token has correct scopes and permissions.

Environment

• Solution: Atlassian Confluence Audit
• Connector: Atlassian Confluence Audit (via Codeless Connector Platform)
• Package version tested: 3.0.7 (also present in earlier CCP versions back to 3.0.3)

Steps to Reproduce

1. Create an Atlassian scoped API token (read:audit-log:confluence, etc.) per https://support.atlassian.com/confluence/kb/scoped-api-tokens-in-confluence-cloud/
2. Deploy the Confluence Audit CCP connector, click "Add organization"
3. Enter your Confluence organization URL exactly as the placeholder suggests: <your-domain>.atlassian.net
4. Enter service account username and the scoped API token
5. Deploy / test connectivity

Screenshot of the Connect dialog:

Expected

Connector authenticates successfully, or the UI clearly indicates the URL format required for scoped tokens.

Actual

Connectivity check failed. ConnectorId: ConfluenceAuditLogsPoller<guid>,
Status code: Unauthorized,
Message: Call failed with status code 401 (Unauthorized):
GET https://<your-domain>.atlassian.net/wiki/rest/api/audit?startDate=...&endDate=...&limit=1000

Root Cause

In Solutions/AtlassianConfluenceAudit/Package/mainTemplate.json, the request endpoint is built as:

"apiEndpoint": "[concat('https://', parameters('confluenceorganizationurl'), '/wiki/rest/api/audit')]"

Per Atlassian's own documentation on scoped API tokens (https://support.atlassian.com/atlassian-cloud/kb/401-unauthorized-error-when-service-account-accesses-jira-or-confluence-api/), scoped tokens must call the gateway endpoint https://api.atlassian.com/ex/confluence/{cloudId}/... rather than <domain>.atlassian.net. A classic (unscoped) token against <domain>.atlassian.net works fine; the exact same call with a scoped token returns 401 — not because of missing scopes/permissions, but because it's the wrong host entirely.

The confluenceorganizationurl parameter itself has no format validation ("validations": {"required": true} only), so it can accept api.atlassian.com/ex/confluence/{cloudId} and produce a working URL — but nothing in the label, tooltip, or placeholder communicates this. Users following the UI's own example are led directly into the 401.

For comparison, the companion Jira Audit CCP connector's polling logic constructs the equivalent gateway URL (api.atlassian.com/ex/jira/{cloudId}/rest/api/3/auditing/record) — so Jira's connector behavior with scoped tokens is more discoverable/consistent than Confluence's, even though the underlying template pattern (free-text org URL field) is similar.

Suggested Fix

• Update the field label/placeholder/tooltip for confluenceorganizationurl to note that scoped API tokens require the value api.atlassian.com/ex/confluence/{cloudId} instead of <domain>.atlassian.net, and link to where users can find their cloud ID (https://<your-domain>.atlassian.net/_edge/tenant_info).
• Ideally, add a dedicated "Cloud ID" input and construct the gateway URL automatically when a scoped token is used, matching what appears to already work for Jira — rather than relying on users to know they can override the "domain" field with a full path.
• Cross-reference: Jira and Confluence Audit Scope API Updates #13260 (related confusion around scoped token support in Jira/Confluence CCF connectors).

Additional Context

Verified against mainTemplate.json in the 3.0.7 package (Solutions/AtlassianConfluenceAudit/Package/mainTemplate.json, line ~803) and the legacy Azure Functions-based connector (v1.0.0), whose equivalent "Domain Name" field has the same unrestricted-text behavior and works when a scoped-token gateway path is entered manually.