Why am I getting "Access to the resources was denied due to missing scope"?
Asked by Saravana Kumar:

When I used the REST API from the documentation to get the list of users in a Confluence group using group id,I get the following error. What am I missing here?  
![Image](https://pbs.twimg.com/media/Fi1i_lZagAAMGJ8?format=png&name=large)  

[Twitter conversation on the same issue](https://twitter.com/s2sarav/status/1593479459126247424?s=20&t=KpwC7MqvUBz922LWHoinGw)


Answers:
author: Matte
body: Hello Saravana,

Matt from Cloud Support, primary ***Confluence***! I was chatting with some of our social teams and they asked me to take a look at this. I recently went through the process of figuring some of this out myself, so I am happy to share the knowledge where I can!

Based on your description, and the screenshot provided, it looks like you're trying to:

* pull group information from your Confluence site.
* See which users are part of specific groups.

#### ++Considerations:++ {#toc-hId-201688308}

You won't be able to work with ***Product*** groups at the organization level with the [***Cloud Admin API***](https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/). The Atlassian management system is arranged similarly to how permissions/restrictions work. Within an Organization, you may have multiple sites, composed of different Atlassian product instances. All of these sites share the organization's user-base, however *groups* currently are managed at the ***site*** level.

Getting Started {#toc-hId-1988136563}
-------------------------------------

#### Pulling a list of all groups from the Confluence Cloud REST API {#toc-hId-881746678}

- *Documentation: <https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-group/#api-wiki-rest-api-group-get>*

1. First things first, we need a *product* level API key! You can find instructions on generating one of these in the reference panel below: **\[1\] - Generating an API Key at the product level.**
2. Now that we have an API key for the products, lets hit just the *group* endpoint with a GET request! I'll be using Postman to demonstrate this.
   1. Open PostMan
      1. Select, **GET** and Enter the API endpoint url: **https://\[*yoursite*\].atlassian.net/wiki/rest/api/group**
         1. Make note to replace ***"\[yoursite\]"**with the name of your site.*
      2. In Postman, under *authorization*
         1. Select *Basic Auth - see **\[2\] - Product REST API Authentication***
            1. *Enter your **email address** in the username field*
            2. *Enter your **API Key** generated in step 1 in the password field*
         2. *This should be all we need for now. Go ahead and hit **SEND** in postman. You should get back a response body with all the groups you have access to on your site.*
            1. *Nested within the response body should be the ID(s) of all the related groups.*
      3. Below, you'll find a *de-identified* screenshot demonstrating my Postman setup from the instructions above. ![GetgroupsViaRESTAPI .png](https://community.atlassian.com/t5/image/serverpage/image-id/229487i18F40DF698E84582/image-size/large?v=v2&px=999 "GetgroupsViaRESTAPI .png")

#### *Pull Users via a group name* {#toc-hId--925707785}

*- **Documentation:** <https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-group/#api-wiki-rest-api-group-groupname-member-get>*

After following the steps above, we should have gotten a list of groups with *self-identifying links* we can use in the response body to get a list of the users in the group:

1. Grab a group name from the response body, or one you already have.
2. Change your request URL:
   1. from: **https://\[*yoursite*\].atlassian.net/wiki/rest/api/group**
   2. to: **https://\[*yoursite*\].atlassian.net/wiki/rest/api/group/\[groupname\]/member**
      1. *EX: <https://matt.atlassian.net/wiki/rest/api/group/administrators-matt/member>*
      2. *This should give you a response back containing the users that are in the Confluence groups.*

I hope this helps! Please let me know if you have any questions on the information above, or if you're getting stuck somewhere along in the process.

- Matt

----

References {#toc-hId-860740470}
-------------------------------

#### \[1\] - [Generating an API Key at the product level](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/). {#toc-hId--245649415}

1. Create an API token from your Atlassian account:
2. Log in to <https://id.atlassian.com/manage-profile/security/api-tokens>.
3. Click Create API token.
4. From the dialog that appears, enter a memorable and concise Label for your token and click Create.
5. Click Copy to clipboard, then paste the token to your script, or elsewhere to save for later

* **NOTE**: once you have exited the dialog you won't be able to view the API Key again, so make sure you store it in a safe place
* **NOTE:** Never share this API key with anyone!

#### \[2\] - Product REST API authentication {#toc-hId--2053103878}

Officially, basic authentication via the REST API, *user@example.com:password* has been deprecated. Instead what you will need to do to authenticate is by replacing your account password in the basic auth header with the API Key generated in Reference block**\[1\]** above.

comments: author: Saravana Kumar
body: Thank you Matt. This was useful \& was able to get the list of users using group API's.   

If possible could you raise it to the documentation team to update the API documentations .


author: Matte
body: I am glad to hear that, and happy to help! I'll bubble this up to the documentation team and see what we can do.

- Matt


Tags: cloud

confluence-cloud