Confluence
The Confluence source ingests pages from a Confluence instance. Each page becomes a record in the pipeline — its contents are uploaded to a new agent session for processing. Each page inherits its own and its ancestors' read restrictions, or the space audience, as document-level ACL. The source works against both Confluence Cloud and Data Center.
Confluence is configured through the API, not the Console source picker. Create or edit the pipeline with the source JSON below.
Authentication
Before you create the pipeline, set up your Confluence credential. Omit auth
only if the instance allows anonymous read access. auth is a
RemoteAuth credential. The credential depends on your
deployment:
| Deployment | auth |
|---|---|
| Cloud | { "type": "header", "header": "Authorization", "value": "Basic <base64(email:api_token)>" } |
| Data Center | { "type": "bearer", "token": "<personal_access_token>" } |
For Cloud, create an API token at
id.atlassian.com/manage-profile/security/api-tokens,
then base64-encode email:api_token and send it as the value.
For Data Center, create a personal access token in your Confluence profile
settings and supply it as token.
The account behind the credential needs read access to the spaces and pages you want to ingest.
For Cloud, the value is sent verbatim as the Authorization header, so the
literal Basic prefix must be included before the base64 string. A raw
email:api_token value will not authenticate.
Configuration
SOURCE FIELD (CONFLUENCE CLOUD)
Code example with json syntax.1
Fields
| Field | Required | Description |
|---|---|---|
type | Yes | confluence. |
base_url | Yes | Base URL of your Confluence instance, e.g. https://your-domain.atlassian.net for Cloud or https://confluence.example.com for Data Center. The Cloud /wiki context path is added automatically, so it does not need to be included. |
deployment | No | cloud for Atlassian-hosted Confluence Cloud, data_center for a self-hosted Data Center or legacy Server instance. Defaults to cloud. |
space_keys | No | Space keys to ingest. When omitted, every global space the authenticated account can read is ingested. |
auth | No | Authentication for the instance. Omit only if the instance allows anonymous read access. See Authentication. |
How records are fetched
Each run fans out one task per space, then streams that space's pages using CQL
ordered by last-modified time. Each page becomes one record; its
body.export_view HTML is the record content. A page with no parseable
last-modified version is skipped, since it cannot take part in incremental sync.
Source metadata
Each record carries source metadata that the connector resolves at fetch time.
system_metadata:
| Key | Description |
|---|---|
title | The page title. |
space_key | The key of the space the page belongs to. |
url | The page's web URL. |
updated_time | The page's last-modified timestamp. |
user_metadata is empty for Confluence.
acl_metadata holds each page's effective read access in the source-independent
ACL metadata shape. Resolution
is conservative — it never grants more access than Confluence does:
- A page restricted by its own or an ancestor's read restriction emits the
intersection of the named readers (
readers) and named groups (group_readers) across every restricted level, and is never public or org-wide. - An unrestricted page inherits the space audience: named users and groups map
to
readersandgroup_readers, and anonymous read maps topublic_access.
Confluence has no notion of comment or edit access in this shape, so owners,
editors, commenters, and the group edit/comment buckets are left null.
Unreadable permission data degrades to fewer grants, never more.
Incremental sync
When sync_mode is incremental (the default), the pipeline tracks a watermark
based on each page's last-modified time. See
Sync mode. On the next run, only
pages modified since the stored watermark are reprocessed.
Deletes are not propagated. A page the connector can no longer retrieve stops appearing in new runs. The pipeline emits no delete signal, so anything a previous run already produced downstream — for example, a document indexed into a corpus — is left in place.