# Atlassian Confluence > Atlassian Confluence: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the pages of the Confluence spaces you name, with their version and where they sit in the page tree, so a citation can name the page and its path. A page deleted or archived in Confluence leaves the knowledge base. ## At a glance | Collector | Atlassian Confluence, version `1.0.0` | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------- | | Reads | Atlassian: Confluence Cloud ([the vendor's documentation](https://developer.atlassian.com/cloud/confluence/rest/v1/intro/)) | | Family | Knowledge | | Kind | Wiki | | Ways to connect | Access token | | Scopes | - Read: `read:page:confluence`, `read:space:confluence` | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Content, Identity | | Hosts it may contact | `{tenant}.atlassian.net` | | Vendor API versions | Confluence Cloud REST API (/wiki/rest/api, content and content/search) | | Lowest engine version | `0.45.0` | ## What it reads - Pages (`type = page`) in the spaces you name, as plain text from their export view; images become `[image]`, links are kept inline. - For each page: its title, space, version number, last-modified day, ancestor path and a link to it. - The first pull lists each space whole, however deep its tree. Later pulls ask for the pages changed since the cursor, oldest first. - Archived pages too, if you list `archived` among `statuses`. - Deletions: every `reconcile_hours` (six by default) the collector lists each space’s page ids, without bodies, and removes every page it holds that is no longer there. A space taken out of the configuration has its pages removed. - Never read: blog posts, comments and attachments. ## How to connect 1. Create or choose an integration account in your Atlassian site with access to the spaces you name and nothing else. Do not use a site administrator. 2. Signed in as that account, create an API token at id.atlassian.com (Security, API tokens). 3. In LightHouse, open **Connectors**, choose **Confluence**, name the site (`https://.atlassian.net`), the space keys, the label and how often to read, and paste the account’s email address and token. 4. In code, set `CONFLUENCE_BASE_URL` (the site’s wiki address), `CONF_EMAIL` and `CONF_TOKEN` from your secret store and add a `kind: confluence` source card with `spaces`, `label` and `requires`. ## Permissions The collector signs in with the account’s email address and API token (HTTP Basic). Atlassian API tokens carry no scopes, so what the account can read is what the collector can read; LightHouse’s card lists `read:page:confluence` and `read:space:confluence` for a scoped token. Every request is a `GET`: `/rest/api/content` (a space’s pages, and page ids alone for deletions) and `/rest/api/content/search` (pages changed since the cursor). The credential never follows a link off the configured site. Its read-only test proves it on every change. ## Limits - You must name the spaces; a whole site is never the default. Space keys with characters other than letters, digits and `-` are dropped. - `limit` caps a pull that follows the cursor (oldest first, so it resumes where it stopped). The first pull is never capped, because a capped listing is in no order a cursor could resume from. - Confluence reports modification dates to the day, so a pull re-reads that day’s pages; an unchanged page is not rewritten. - A space the account cannot see (404, 403 or an unknown key) is skipped and counted as `space-unavailable`; its pages are kept until it can be read again. - Rate limits (429 and 5xx) are waited out with back-off, up to six times. - A self-hosted Data Center site is connected in code only. ## Data handling - Page text is copied into the deployment’s corpus under the source’s `label`. Pages can name people and hold personal data; the author’s display name is not kept. - The token stays in your secret store (or sealed under your own tenant’s key in LightHouse until the deployment can keep it); it is never written to logs or run notes. - Nothing leaves the deployment: only counts reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------ | | `CONFLUENCE_BASE_URL is not set: name the client's Confluence site` | The site address is missing | Set `CONFLUENCE_BASE_URL` | | `no Confluence credentials: set CONF_EMAIL and CONF_TOKEN` | The account email or token is missing | Set both | | `name the spaces to sync; a whole site is never the default` | `spaces` is empty | Name the space keys | | `statuses are current and archived` | An unknown status was listed | Use `current` and/or `archived` | | `Confluence's next link leaves the configured site; refused` | A paging link pointed at another host | Check the site address; report it if it persists | | `HTTP 401` or `HTTP 403` | The token was revoked, or the email is not the token’s owner | Make a new token for the integration account | | Read succeeded, 0 written | No page changed since the cursor | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ----------------------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.45.0` | Confluence Cloud REST API, content and content/search | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/confluence/