Issue Summary

Forge does not provide a dedicated event to detect when a Confluence attachment is downloaded. The existing avi:confluence:viewed:attachment event does not distinguish between a file being previewed/rendered inline versus explicitly downloaded, and its payload contains no action subtype to differentiate these interactions. A new event avi:confluence:downloaded:attachment is required to support security investigations, compliance reporting, data-governance reviews, and controlled-document processes.

Steps to Reproduce

1. Install a Forge app that subscribes to avi:confluence:viewed:attachment on a Confluence Cloud site.

1. Upload an attachment to a Confluence page.

1. Click the native Download button on the attachment — or access the attachment via a direct /download/attachments/... URL, the REST API, or the Confluence mobile client.

1. Observe the events received by the Forge app.

1.  

Expected Results

A dedicated avi:confluence:downloaded:attachment event is emitted whenever Confluence authorizes and begins delivering an attachment as a download. The event payload should include:

• eventType, eventId, eventCreatedDate

• atlassianId (actor who initiated the download)

• Account / authentication type (licensed user, guest, anonymous, app, API token)

• Attachment ID and version

• File name, media type, and file size

• Parent page / content ID

• Space ID and key

• Download source (ui, preview, attachments-screen, direct-url, rest-api, mobile, download-all, public-link)

• Whether the actor was anonymous

• Whether the request was made by an app or API token

Actual Results

No dedicated download event exists. The avi:confluence:viewed:attachment event:

• Does not fire reliably for downloads (historically reported as not firing for previews or downloads — see Attachment_viewed webhook never fires in Confluence Cloud. Bug?)

• Contains no action subtype to distinguish a download from an inline preview or render

• Cannot be used to determine download source, actor type, or attachment version accessed

Forge apps cannot obtain this information today without replacing Confluence's native attachment workflow with a custom download service — which cannot cover native download buttons, direct URLs, REST API calls, or mobile clients.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available