Prepare your tool for data classification in Atlassian products

Overview

Data Loss Prevention (DLP) is an important strategy for many organizations as the need to protect sensitive information evolves. A comprehensive DLP strategy protects organizations against intentional or accidental data loss or misuse which could otherwise pose serious risk to their business. Atlassian’s DLP solutions for customers include data classification, data security policies, and data redaction. We care about providing ways for security tool providers to integrate with these solutions through our DLP APIs.

Data classification

Data classification APIs allow customers to apply their models of data governance and sensitivity to the data they store in Atlassian cloud.

Data classification is best utilized with our other DLP capabilities and threat detection capabilities - the interconnected set of information security tools.

With data classification, our objectives are:

• Connecting security/detection tools with data classification APIs
• Providing admins with the ability to put data classifications into practice in their Atlassian products
• Enable end-users to classify data

Background

With this capability, customers can organize and categorize their content by classifying it - that is, attaching labels to workspace, pages, issue, etc. to clearly denote the sensitivity of data stored in our products.

With Atlassian Guard, data classifications will form the basis of targeted application for Data Security Policies, such as public sharing controls and page export controls.

Before you begin

We assume that you understand the following:

• Security overview for Confluence
• Security overview for Jira

What’s happening?

In our first release we’re focused on:

• Protecting data based on classification levels: Create data security policies that can control public sharing or page exports in Confluence based on classification levels.

• Classifying spaces and pages: Set a default classification level for a Confluence space to classify all new and existing pages in that space or classify pages individually as needed.

• Tracking data classification activity in the organization audit log: Activities include changes to classification levels on a Confluence page. Classification level is also included in audit log activities for page actions.

Confluence

The first public release of data classification in Confluence will include the following APIs.

Classification level

GET /wiki/api/v2/classification-levels

Return list of classification levels available for an org.

• Permissions required: 'Permission to access the Confluence site ('Can use' global permission)
• Connect app scope required: READ
• OAuth 2.0 scopes required: read:configuration:confluence

Example

1
2
GET /wiki/api/v2/classification-levels

200 OK
{
  "classificationLevels": [
    {
      "id": "ari:..."
      "name": "Internal"
      "description": ""
      "guideline": "For internal use only."
      "order": 1
      "color": "RED"
      "status": "PUBLISHED"
    },
    {
      "id": "ari:..."
      "name": "Public"
      "description": ""
      "guideline": "Open to all."
      "order": 2
      "color": "GREEN"
      "status": "PUBLISHED"
    },
    ...
  ]
}

Space default classification APIs

GET /wiki/api/v2/spaces/{id}/classification-level/default

Return the default classification level for a single space.

• Permissions required: 'Permission to access the Confluence site ('Can use' global permission) and 'Admin' permission for the space.
• Connect app scope required: READ
• OAuth 2.0 scopes required: read:space:confluence

Example

1
2
GET /wiki/api/v2/spaces/{id}/classification-level/default

200 OK
{
    "id": "ari:..."
    "name": "Internal"
    "description": "Data we hold that would be very damaging and would cause loss of trust with customers and present legal risk to Atlassian and/or customers mishandled"
    "guideline": "For internal use only."
    "order": 1
    "color": "RED"
    "status": "PUBLISHED"
}

PUT /wiki/api/v2/spaces/{id}/classification-level/default

Update the default classification level for a single space.

• Permissions required: Permission to access the Confluence site ('Can use' global permission) and 'Admin' permission for the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: read:space:confluence , write:space:confluence

Example

1
2
PUT /wiki/api/v2/spaces/{id}/classification-level/default
{
  "id": "ari..."
}

204 OK

DELETE /wiki/api/v2/spaces/{id}/classification-level/default

Delete the default classification level for a single space.

• Permissions required: Permission to access the Confluence site ('Can use' global permission) and 'Admin' permission for the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:space:confluence

Example

1
2
DELETE /wiki/api/v2/spaces/{id}/classification-level/default

204 OK

Page data classification APIs

GET /wiki/api/v2/pages/{id}/classification-level

Return the classification level for a single page.

• Permissions required: Permission to view the page and its corresponding space.
• Connect app scope required: READ
• OAuth 2.0 scopes required: read:page:confluence, write:page:confluence

Example

1
2
GET /wiki/api/v2/pages/{id}/classification-level?status=[draft | current | archived]

200 OK
{
    "id": "ari:..."
    "name": "Internal"
    "description": "Data we hold that would be very damaging and would cause loss of trust with customers and present legal risk to Atlassian and/or customers mishandled"
    "guideline": "For internal use only."
    "order": 1
    "color": "RED"
    "status": "PUBLISHED"
}

PUT /wiki/api/v2/pages/{id}/classification-level

Update the classification level for a single page.

• Permissions required: Permission to view the page and its corresponding space. Permission to update pages in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
PUT /wiki/api/v2/pages/{id}/classification-level
{
  "status": "current | draft"
  "id": "ari:..."
}

204 OK

POST /wiki/api/v2/pages/{id}/classification-level/reset

Reset the classification level for a single page.

• Permissions required: Permission to view the page and its corresponding space. Permission to update pages in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
POST /wiki/api/v2/pages/{id}/classification-level/reset
{
  "status": "current | draft"
}

204 OK

DELETE /wiki/api/v2/pages/{id}/classification-level

Delete the classification level for a given page ID

• Permissions required: Permission to view the page and its corresponding space. Permission to update pages in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
DELETE /wiki/api/v2/pages/{id}/classification-level
{
  "status": "current | draft"
}

204 OK

Blog Post data classification APIs

GET /wiki/api/v2/blogposts/{id}/classification-level

Return the classification levels for a single blog post.

• Permissions required: Permission to view the blog post and its corresponding space.
• Connect app scope required: READ
• OAuth 2.0 scopes required:read:page:confluence, write:page:confluence

Example

1
2
GET /wiki/api/v2/blogposts/{id}/classification-level?status=[draft | current | archived]

200 OK
{
    "id": "ari:..."
    "name": "Internal"
    "description": "Data we hold that would be very damaging and would cause loss of trust with customers and present legal risk to Atlassian and/or customers mishandled"
    "guideline": "For internal use only."
    "order": 1
    "color": "RED"
    "status": "PUBLISHED"
}

PUT /wiki/api/v2/blogposts/{id}/classification-level

Update the classification levels for a single blog post.

• Permissions required: Permission to view the blog post and its corresponding space. Permission to update blog posts in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
PUT /wiki/api/v2/pages/{id}/classification-level
{
  "status": "current | draft"
  "id": "ari:..."
}

204 OK

POST /wiki/api/v2/pages/{id}/classification-level/reset

Reset the classification level for a single page.

• Permissions required: Permission to view the page and its corresponding space. Permission to update pages in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
POST /wiki/api/v2/pages/{id}/classification-level/reset
{
  "status": "current | draft"
}

204 OK

DELETE /wiki/api/v2/pages/{id}/classification-level

Delete the classification level for a given page ID

• Permissions required: Permission to view the page and its corresponding space. Permission to update pages in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
DELETE /wiki/api/v2/pages/{id}/classification-level
{
  "status": "current | draft"
}

204 OK

Blog Post data classification APIs

GET /wiki/api/v2/blogposts/{id}/classification-level

Return the classification level for a single blog post.

• Permissions required: Permission to view the blog post and its corresponding space.
• Connect app scope required: READ
• OAuth 2.0 scopes required:read:page:confluence, write:page:confluence

Example

1
2
GET /wiki/api/v2/blogposts/{id}/classification-level?status=[draft | current | archived]

200 OK
{
    "id": "ari:..."
    "name": "Internal"
    "description": "Data we hold that would be very damaging and would cause loss of trust with customers and present legal risk to Atlassian and/or customers mishandled"
    "guideline": "For internal use only."
    "order": 1
    "color": "RED"
    "status": "PUBLISHED"
}

PUT /wiki/api/v2/blogposts/{id}/classification-level

Update the classification level for a single blog post.

• Permissions required: Permission to view the blog post and its corresponding space. Permission to update blog posts in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
PUT /wiki/api/v2/blogposts/{id}/classification-level
{
  "status": "current| draft"
  "id": "ari:..."
}

204 OK

POST /wiki/api/v2/blogposts/{id}/classification-level/reset

Reset the classification level for a single blog post.

• Permissions required: Permission to view the blogpost and its corresponding space. Permission to update blog posts in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
POST /wiki/api/v2/blogposts/{id}/classification-level/reset
{
  "status": "current | draft"
}

204 OK

DELETE /wiki/api/v2/blogposts/{id}/classification-level

Delete the classification level for a single blog post.

• Permissions required: Permission to view the blog post and its corresponding space. Permission to update blog posts in the space.
• Connect app scope required: WRITE
• OAuth 2.0 scopes required: write:page:confluence

Example

1
2
DELETE /wiki/api/v2/blogposts/{id}/classification-level
{
  "status": "current | draft"
}

204 OK

Jira

Jira's data classification APIs are now publicly available, and here is the list:

• GET /rest/api/3/classification-levels
• GET /rest/api/3/project/{projectIdOrKey}/classification-level/default
• PUT /rest/api/3/project/{projectIdOrKey}/classification-level/default
• DEL /rest/api/3/project/{projectIdOrKey}/classification-level/default

We are in the process of preparing comprehensive guides for our newly introduced APIs. These resources aim to facilitate a deeper understanding of all our APIs and provide guidance on how to leverage them effectively.