Confluence Data Center Source

What it ingests

Page activity from self-hosted Confluence Data Center — pages and their comments — optionally scoped to specific spaces or narrowed with an extra CQL filter.

This is a sibling of the Confluence Cloud source, not a mode of it. Cloud is /wiki/rest/api/…; Data Center is /rest/api/content/search with CQL, no /wiki prefix, and a real context path. external_id is namespaced confluence-dc:… so a Cloud site and a DC site in one org cannot collide.

Confluence Server (EOL) is not supported. Verified against Confluence Data Center 10.2.13. Confluence 10.2.11+ rate-limits /rest/api/content; 429s honor Retry-After.

Credential

References an atlassian_dc_pat credential by id — the vault type is shared with Jira Data Center because both authenticate with a Data Center personal access token. In the credentials UI it is labelled Atlassian Data Center personal access token (Jira / Confluence). Cloud API tokens (jira_api_token) are a different product and will not authenticate here.

curl -sS -X POST https://your-corveil-host/api/credentials \
  -H "Authorization: Bearer <admin>" -H "Content-Type: application/json" \
  -d '{"type":"atlassian_dc_pat","name":"intranet-confluence-pat","secret":"<pat>"}'

If you already created a PAT for the Jira Data Center source against the same directory, reuse that credential id here rather than storing the same secret twice — rotating it then updates both sources at once.

Config fields

Key	Required	Notes
site_url	yes	Base URL of the instance, including any context path, e.g. https://intranet.example.com/confluence. Do not add /wiki — that prefix is Cloud-only. Query strings, fragments, and userinfo are rejected. HTTPS only except loopback (localhost, 127.0.0.1, ::1).
username	no	Leave empty to send Authorization: Bearer <pat> (typical). Set it only if the instance expects HTTP Basic (username:PAT). Rejected if it contains : or a newline.
space_keys	no	Comma-separated space keys, e.g. ENG, OPS. Blank ingests every space the token can read.
cql_filter	no	Optional CQL clauses ANDed into every poll, e.g. label = engineering. Interpolated verbatim into queries scoped to this source's own token/instance; a malformed fragment surfaces as a Confluence 400.

Provider-side setup

1. Sign in to Confluence Data Center as the account that should own the token.
2. Create a personal access token: Profile → Personal Access Tokens → Create token. Copy it once; Confluence will not show it again.
3. Make sure that account can view the spaces you want to ingest. Confluence space permissions are separate from Jira project permissions — an account that reads every Jira project may still be missing spaces.
4. Confirm Corveil can reach the instance over HTTPS. Air-gapped deployments typically trust an internal CA; plaintext HTTP is not the air-gap path.

Wire-up

POST /api/sensors

{
  "sensor_type": "confluence_datacenter",
  "name": "Intranet Confluence",
  "config": {
    "site_url": "https://intranet.example.com/confluence",
    "space_keys": "ENG, OPS"
  },
  "credentials": { "pat": "<atlassian_dc_pat credential id>" }
}

If your instance requires HTTP Basic instead of Bearer, add "username": "jdoe" to config.

Verify

Run Test connection to confirm the site URL and PAT authenticate (/rest/api/user/current). Once polling, created and updated pages in the selected spaces appear as document events, and their comments as conversation events.

Notes

Entity naming. Confluence guarantees page-title uniqueness only within a space, so page entities are named SPACE/Title (e.g. ENG/Onboarding). Without the prefix, the Onboarding page in every space would collapse onto a single entity.

First poll. A new source seeds its watermark to "now" and emits nothing on the first tick, so adding a source does not drag in the entire wiki. Use backfill to ingest history.

Auth scheme. Empty username → Bearer. Set username → Basic username:pat. Do not store the PAT in config; it lives in the vault.

Out of scope. Webhooks, OAuth 3LO, and Jira↔Confluence linking.