Issue Summary

Confluence Cloud REST APIs and Forge platform scopes do not expose invitation state for users. When a Forge app queries group members or performs user lookups, both a user who has been invited to Confluence but has not yet accepted (pending invitation) and a user who is active in the Atlassian Directory but has no Confluence product access return identical API payloads. The accountStatus field returns active for both cases.

The APIs that do expose this distinction, specifically the Atlassian Admin API (GET /admin/v1/orgs/

{orgId}

/invitations) and the User Management API (GET /users/

{accountId}

/manage), require organization admin authorization (manage:account scope) which is not available to Forge apps through the standard manifest scope model.

This makes it impossible for a Forge app to correctly display user invitation state, which is a common requirement for apps that render dashboards of group members or track user onboarding status.

Steps to Reproduce

Install a Forge app on a Confluence Cloud site with scopes read:user:confluence and read:email-address:confluence.
Invite a user to Confluence (do not let them accept the invitation). Call this User A.
Ensure a second user exists in the Atlassian Directory (e.g. via Jira) with no Confluence product access. Call this User B.
Add both users to a Confluence group.
Call GET /wiki/rest/api/group/

{groupId}

/membersByGroupId for both users.
Observe that both return "accountStatus": "active" with no field indicating invitation state.
Repeat with POST /wiki/api/v2/users-bulk and GET /wiki/rest/api/user/email/bulk. Same result — both users are indistinguishable.

Expected Results

A Forge app with appropriate product scopes should be able to determine whether a user has a pending invitation to Confluence or is simply an active directory user without product access. This could be achieved by either:

Exposing an invitationStatus or productAccessStatus field in the Confluence user API responses.
Providing a Forge-compatible manifest scope (e.g. read:invitation:confluence) that allows querying pending invitations for the site without requiring full organization admin authorization.

Actual Results

All Confluence-scoped APIs return "accountStatus": "active" for both user states. The email field is empty for both users due to GDPR privacy controls. The bulk email API silently omits both users. There is no field or endpoint accessible to a Forge app that exposes the distinction between these two states.

The only APIs that expose invitation state require manage:account organization admin authorization, which cannot be granted to a Forge app through the manifest scope model.

Workaround

Currently there is no known workaround for this behavior within the constraints of a standard Forge app. A workaround will be added here when available.