New API: Migrate Confluence spaces from legacy permissions to role-based access control (RBAC)

We've added a new set of public REST API endpoints that let you migrate Confluence spaces from the legacy granular space permission model to role-based access control (RBAC) using space roles.

Why this matters

Confluence spaces historically used 14 granular permissions (e.g. Add page, Delete attachment, Set permissions) assigned directly to users and groups. This checkbox-based model is difficult to audit, bulk-manage, and keep consistent across hundreds of spaces.

Confluence is replacing this with role-based access control (RBAC), where each principal (user, group, or app) is assigned a single space role (e.g. Admin, Collaborator, Viewer) that bundles the relevant permissions together.

These endpoints are the programmatic migration path: they let Confluence admins convert existing granular permission grants into equivalent role assignments — in bulk, without manual remapping — and are designed to be called from scripts or admin tooling.

New endpoints

All endpoints are under /wiki/api/v2/space-permissions/transition:

• [GET /combinations](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space-permission-transition/#api-space-permissions-transition-combinations-get) — List a space's permission combinations that don't yet map to a role
• [POST /combinations](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space-permission-transition/#api-space-permissions-transition-combinations-post) — Generate the permission combinations for a space
• [POST /role-assignments](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space-permission-transition/#api-space-permissions-transition-role-assignments-post) — Bulk assign space roles to users/groups based on their existing permission combinations
• [POST /access-removals](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space-permission-transition/#api-space-permissions-transition-access-removals-post) — Bulk remove legacy permission combinations after transitioning to roles
• [GET /tasks/{taskId}](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space-permission-transition/#api-space-permissions-transition-tasks-taskid-get) — Check the status of a transition task

OAuth 2.0 scopes required

• read:configuration:confluence — for the GET endpoints
• write:configuration:confluence — for the POST endpoints

Calling these endpoints requires Confluence site admin permission.

Typical migration script flow

1. POST /combinations — compute the permission combinations currently in use across a space's grantees (returns a taskId)
2. Poll GET /tasks/{taskId} until COMPLETED
3. GET /combinations — list the combinations that aren't yet mapped to an RBAC role
4. POST /role-assignments — bulk assign roles so existing users and groups retain equivalent access under the new model
5. POST /access-removals — bulk remove the legacy permission grants that have been superseded by role assignments
6. Poll GET /tasks/{taskId} for the assignment / removal tasks until COMPLETED

Stability

These endpoints are experimental. We're validating the API contract against real-world migration workloads and plan to stabilize it once we've confirmed the shape holds across a range of tenant configurations.

Availability

Available now in all Confluence Cloud editions in roles transition mode. Please raise issues on the Atlassian Developer Community if you find anything.