Does the restricted pages report show child pages of a restricted page?

No. In our test a child page under a view-restricted page was hidden by its parent's restriction but did not appear in the report, because the restriction is not set on the child itself.

How to find all restricted pages in Confluence Cloud

Q: How do I see all restricted pages in a Confluence Cloud space?

There is a per-space report called Restricted in space settings. Its direct address is /wiki/pages/listpermissionpages.action?key=SPACEKEY. It lists pages that carry a view or edit restriction, with the allowed users or groups.

Q: Can CQL find restricted pages?

No. CQL has no field for restrictions; every variant we tried was rejected with an error that no such field exists. Use the space report or the REST API.

A security review, a departing manager, a page someone cannot open: sooner or later you need the list of pages that are locked down. Confluence Cloud has a report for one space at a time, and it misses a whole class of pages. We set up view and edit restrictions on a live Confluence Cloud site in October 2026 and checked what each route shows.

Short answer. For one space, open the space's Restricted report, which sits in space settings; the direct address is /wiki/pages/listpermissionpages.action?key=SPACEKEY. It lists every page with a view or edit restriction and who is allowed in. It does not list child pages that are hidden only because their parent is restricted. For the whole site, including those inherited cases, use the REST API; a short script is below. CQL cannot do it: it has no field for restrictions.

The space report

The report describes itself as showing all pages and live docs whose access is restricted at the content level and allowed only to specific users or groups. On our test space it listed, for each restricted page, the title, the type of restriction (view or edit), the allowed user or group, the author and the creation date. A page restricted for viewing appeared with both its view and its edit restriction; a page restricted only for editing appeared once, as edit.

Three limits:

One space at a time. There is no site-wide version; for fifty spaces you open it fifty times.
Inherited restrictions are missing. View restrictions cascade: a child page under a view-restricted page is hidden from the same people. In our test that child page did not appear in the report at all, because nothing is set on the child itself. These are exactly the pages that confuse people, since the page looks unrestricted when you open its own settings.
It lives in space settings, so in practice it is a tool for space admins.

Why CQL cannot help

CQL, the query language behind Confluence search, has no condition for restrictions. We tried restriction, restricted, content.restriction and hasRestrictions; each was rejected with an error saying the field does not exist. Any answer that offers a CQL query for this is guessing. More on what CQL can do in our CQL cheat sheet.

The whole site, including inherited restrictions

The REST API returns the restrictions of any page: GET /wiki/rest/api/content/{id}/restriction?expand=restrictions.user,restrictions.group gives a list of operations (read for view, update for edit) with the users and groups on each. For the child page in our test it returned nothing, which matches the report: the restriction lives on the parent. So a complete list needs one more step, checking each page's ancestors.

This Python script does both. It needs only Python 3 and an Atlassian API token; we ran it against our test site and it found all three test pages, the child one included:

# List every page in Confluence Cloud that is restricted directly or through a parent.
# Usage: python restricted_pages.py https://your-site.atlassian.net you@example.com API_TOKEN
import base64, json, sys, urllib.request

site, email, token = sys.argv[1:4]
auth = 'Basic ' + base64.b64encode(f'{email}:{token}'.encode()).decode()

def get(path):
    req = urllib.request.Request(site + path, headers={'Authorization': auth, 'Accept': 'application/json'})
    return json.loads(urllib.request.urlopen(req).read())

def restrictions(page_id):
    data = get(f'/wiki/rest/api/content/{page_id}/restriction'
               '?expand=restrictions.user,restrictions.group')
    found = {}
    for item in data.get('results', []):
        r = item.get('restrictions', {})
        who = [u.get('displayName', u.get('accountId')) for u in r.get('user', {}).get('results', [])]
        who += [g.get('name') for g in r.get('group', {}).get('results', [])]
        if who:
            found[item['operation']] = who
    return found

pages, url = [], '/wiki/api/v2/pages?limit=250'
while url:
    data = get(url)
    pages += data['results']
    nxt = data['_links'].get('next')
    url = ('/wiki' + nxt if nxt and not nxt.startswith('/wiki') else nxt)

direct = {p['id']: restrictions(p['id']) for p in pages}
for p in pages:
    own = direct[p['id']]
    if own:
        print(f"{p['title']} | restricted here | {own}")
        continue
    ancestors = get(f"/wiki/api/v2/pages/{p['id']}/ancestors")['results']
    locked = [a['id'] for a in ancestors if 'read' in direct.get(a['id'], {})]
    if locked:
        print(f"{p['title']} | view restricted through parent page {locked[-1]}")

On our test site the output was:

Restriction probe: view restricted | restricted here | {'read': [...], 'update': [...]}
Restriction probe: child of restricted | view restricted through parent page 26378267
Restriction probe: edit restricted | restricted here | {'update': [...]}

Two things to know before you run it on a large site. It makes one or two requests per page, so a site with ten thousand pages takes a while; run it overnight rather than during a review meeting. And it can only see what the account behind the token can see: a page restricted to people other than you will not appear. Run it with an account that is part of the restrictions you need to audit, or ask each space admin to run the space report.

What we could not test

Our test site has a single user, so we could not check what someone outside a restriction sees in the report, or whether the report shows pages that are restricted from the admin running it. Higher Confluence plans also list a permission inspection tool among their admin features; we have not tested it.

If the question is why one person cannot open one page, start with how space permissions and page restrictions interact.

Frequently asked

How do I see all restricted pages in a space?

Open the Restricted report in space settings, directly at /wiki/pages/listpermissionpages.action?key=SPACEKEY.

Does the report show child pages of a restricted page?

No. Pages hidden only through a restricted parent are not listed. Use the REST API with an ancestor check.

Can CQL find restricted pages?

No. CQL has no field for restrictions.