Atlassian Confluence

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the pages of the Confluence spaces you name, with their version and where they sit in the page tree, so a citation can name the page and its path. A page deleted or archived in Confluence leaves the knowledge base.

At a glance

Collector	Atlassian Confluence, version 1.0.0
Reads	Atlassian: Confluence Cloud (the vendor's documentation)
Family	Knowledge
Kind	Wiki
Ways to connect	Access token
Scopes	Read: read:page:confluence, read:space:confluence
Read only	Yes
Vendor's API can move money	No
Personal data	Content, Identity
Hosts it may contact	{tenant}.atlassian.net
Vendor API versions	Confluence Cloud REST API (/wiki/rest/api, content and content/search)
Lowest engine version	0.45.0

What it reads

• Pages (type = page) in the spaces you name, as plain text from their export view; images become [image], links are kept inline.
• For each page: its title, space, version number, last-modified day, ancestor path and a link to it.
• The first pull lists each space whole, however deep its tree. Later pulls ask for the pages changed since the cursor, oldest first.
• Archived pages too, if you list archived among statuses.
• Deletions: every reconcile_hours (six by default) the collector lists each space’s page ids, without bodies, and removes every page it holds that is no longer there. A space taken out of the configuration has its pages removed.
• Never read: blog posts, comments and attachments.

How to connect

1. Create or choose an integration account in your Atlassian site with access to the spaces you name and nothing else. Do not use a site administrator.
2. Signed in as that account, create an API token at id.atlassian.com (Security, API tokens).
3. In LightHouse, open Connectors, choose Confluence, name the site (https://<site>.atlassian.net), the space keys, the label and how often to read, and paste the account’s email address and token.
4. In code, set CONFLUENCE_BASE_URL (the site’s wiki address), CONF_EMAIL and CONF_TOKEN from your secret store and add a kind: confluence source card with spaces, label and requires.

Permissions

The collector signs in with the account’s email address and API token (HTTP Basic). Atlassian API tokens carry no scopes, so what the account can read is what the collector can read; LightHouse’s card lists read:page:confluence and read:space:confluence for a scoped token. Every request is a GET: /rest/api/content (a space’s pages, and page ids alone for deletions) and /rest/api/content/search (pages changed since the cursor). The credential never follows a link off the configured site. Its read-only test proves it on every change.

Limits

• You must name the spaces; a whole site is never the default. Space keys with characters other than letters, digits and - are dropped.
• limit caps a pull that follows the cursor (oldest first, so it resumes where it stopped). The first pull is never capped, because a capped listing is in no order a cursor could resume from.
• Confluence reports modification dates to the day, so a pull re-reads that day’s pages; an unchanged page is not rewritten.
• A space the account cannot see (404, 403 or an unknown key) is skipped and counted as space-unavailable; its pages are kept until it can be read again.
• Rate limits (429 and 5xx) are waited out with back-off, up to six times.
• A self-hosted Data Center site is connected in code only.

Data handling

• Page text is copied into the deployment’s corpus under the source’s label. Pages can name people and hold personal data; the author’s display name is not kept.
• The token stays in your secret store (or sealed under your own tenant’s key in LightHouse until the deployment can keep it); it is never written to logs or run notes.
• Nothing leaves the deployment: only counts reach LightHouse.

Troubleshooting

What you see	What it means	What to do
CONFLUENCE_BASE_URL is not set: name the client's Confluence site	The site address is missing	Set CONFLUENCE_BASE_URL
no Confluence credentials: set CONF_EMAIL and CONF_TOKEN	The account email or token is missing	Set both
name the spaces to sync; a whole site is never the default	spaces is empty	Name the space keys
statuses are current and archived	An unknown status was listed	Use current and/or archived
Confluence's next link leaves the configured site; refused	A paging link pointed at another host	Check the site address; report it if it persists
HTTP 401 or HTTP 403	The token was revoked, or the email is not the token’s owner	Make a new token for the integration account
Read succeeded, 0 written	No page changed since the cursor	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.45.0	Confluence Cloud REST API, content and content/search	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only