How to get a URL to download an attachment in Confluence

Summary

There may be instances when you need to get a URL to download an attachment. This article outlines a method to achieve this.

Environment

Confluence Cloud

Solution

1. Access the page where the desired file is attached.

2. Extract the id of the page from the URL bar.

   • For instance, the id is 943423490 in the following image.

     • 

3. Paste a URL like the following into the URL bar to list the page's attachments:

   1. https://{your-site}.atlassian.net/wiki/api/v2/pages/{page-id}/attachments

4. Locate a section similar to the one below that contains the download link.

   1. ..._links":{"download":"/download/attachments/XXXXXX/○○○○○",

5. You can now download the file using the following URL

   1. https://{Your site name}.atlassian.net/wiki/download/attachments/XXXXXX/○○○○○

⚠️ Authentication required

The download URL respects the page and space permissions of the attachment:

• A user must be signed in with view access to the page for the link to work. Without authentication, the URL redirects to a login page.

• An automation or script must authenticate using Basic Auth (your email address + an API token) or OAuth 2.0.

• The URL is not publicly accessible unless the space has anonymous access enabled and your site allows spaces to enable anonymous access (see Control whether spaces can turn on anonymous access).

Verify your download URL

Confirm the constructed URL works before using it in production:

• Browser test: Open a private/incognito window, sign in to Confluence with an account that has view access to the page, then paste the download URL. The file should download directly — if you see a login page or "no access" error, double-check the page ID and your permissions.

• API/automation test: Run a quick curl command with your credentials to confirm a 200 response:

  curl -u your-email@example.com:YOUR_API_TOKEN \ "<redacted URL>" \ -o filename.ext -w "%{http_code}"

  A 200 status confirms the URL and authentication are correct. A 401 means invalid credentials; a 403 means the account lacks permission to the page.