{"record":{"id":"446cc7db1b562691","repo":"infiniflow/ragflow","slug":"insufficient-permissions-to-access-confluence-reso","errorCode":null,"errorMessage":"Insufficient permissions to access Confluence resources (HTTP 403).","messagePattern":"Insufficient permissions to access Confluence resources \\(HTTP 403\\)\\.","errorType":"validation","errorClass":"InsufficientPermissionsError","httpStatus":403,"severity":"error","filePath":"common/data_source/confluence_connector.py","lineNumber":1844,"sourceCode":"                yield doc_metadata_list[:_SLIM_DOC_BATCH_SIZE]\n                doc_metadata_list = doc_metadata_list[_SLIM_DOC_BATCH_SIZE:]\n\n                if callback and callback.should_stop():\n                    raise RuntimeError(\"retrieve_all_slim_docs_perm_sync: Stop signal detected\")\n                if callback:\n                    callback.progress(\"retrieve_all_slim_docs_perm_sync\", 1)\n\n        yield doc_metadata_list\n\n    def validate_connector_settings(self) -> None:\n        try:\n            spaces = self.low_timeout_confluence_client.get_all_spaces(limit=1)\n        except HTTPError as e:\n            status_code = e.response.status_code if e.response else None\n            if status_code == 401:\n                raise CredentialExpiredError(\"Invalid or expired Confluence credentials (HTTP 401).\")\n            elif status_code == 403:\n                raise InsufficientPermissionsError(\"Insufficient permissions to access Confluence resources (HTTP 403).\")\n            raise UnexpectedValidationError(f\"Unexpected Confluence error (status={status_code}): {e}\")\n        except Exception as e:\n            raise UnexpectedValidationError(f\"Unexpected error while validating Confluence settings: {e}\")\n\n        if self.space:\n            try:\n                self.low_timeout_confluence_client.get_space(self.space)\n            except ApiError as e:\n                raise ConnectorValidationError(\"Invalid Confluence space key provided\") from e\n\n        if not spaces or not spaces.get(\"results\"):\n            raise ConnectorValidationError(\"No Confluence spaces found. Either your credentials lack permissions, or there truly are no spaces in this Confluence instance.\")\n\n\nif __name__ == \"__main__\":\n    import os\n\n    # base url","sourceCodeStart":1826,"sourceCodeEnd":1862,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/common/data_source/confluence_connector.py#L1826-L1862","documentation":"Raised by validate_connector_settings() when the get_all_spaces probe returns HTTP 403. The credentials authenticate correctly but the account/integration lacks permission to list spaces (missing 'View space' / read scope, OAuth client scopes not granted, or GAC restrictions). Mapped to InsufficientPermissionsError so the UI can distinguish authorization failure from authentication failure.","triggerScenarios":"Valid API token whose account has no space-level read permission; an OAuth 2.0 (3LO) app missing read:confluence-space scope; Confluence Cloud where every space restricts access from the integration.","commonSituations":"New service account added without group membership; admin granted token but forgot space permissions; scoped tokens (scoped_token param) missing the space list scope.","solutions":["Grant the account/integration read access to the target spaces (space settings > permissions, or Confluence admin > global permissions)","For scoped tokens, add the read:confluence-space / search scopes when creating the token","For 3LO apps, add the required OAuth scopes and re-consent","Test with the same account in the Confluence UI: can it see the space browser?"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    connector.validate_connector_settings()\nexcept InsufficientPermissionsError:\n    notify_user('Grant the Confluence integration read access to spaces, then revalidate')","preventionTips":["When creating scoped tokens, select all read scopes the connector documents","Smoke-test new service accounts by listing spaces with the same credentials before wiring them in"],"tags":["confluence","permissions","http-403","validation"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}