Problem Definition

Currently AP.request() calls made from Connnect macros when displayed via the Jira Service Desk customer portal do not allow for unlicensed users (which JSD customers usually are) to make POST requests to Confluence APIs.

Suggested Solution

AP.request() calls made from Connect macros shown in the JSD customer portal to be allowed using the same unlicensed Confluence behaviour that applied for GET requests.

Workaround

Vendors can make the POST requests from their application server, rather than using AP.request() to make an impersonated request from the client-side.

Notes

The current solution for unlicensed users viewing Confluence content, including macros, from the Jira Service Desk customer portal strictly allows only read access to Confluence. For this reason, supporting GET requests from Confluence macros is mostly sufficient. The exception is any POST request that only requires read permission like https://developer.atlassian.com/cloud/confluence/rest/#api-api-contentbody-convert-to-post