> ## Documentation Index > Fetch the complete documentation index at: https://docs.genesiscomputing.com/llms.txt > Use this file to discover all available pages before exploring further. # Confluence > Connect Confluence so Genesis Data Agents can search spaces, read pages, and work with documentation content. ## Overview Genesis supports Confluence as a customer-facing documentation and knowledge integration. After setup, customers can use Genesis Data Agents to search spaces, read page content, and work with attachments and documentation workflows. Actual Genesis Connections page showing Confluence as an available connector tile. ## Setup path 1. Open **Config -> Connections**. 2. Go to the connector category where Confluence appears (**Dev Tools**). 3. Select the **Confluence** tile. 4. Choose a connection mode and enter the required fields (for example **API Token (Cloud)** with `host`, `email`, and `api_token`, or **User OAuth (Cloud)** with `host` and OAuth client credentials). 5. Choose **Connection scope**, set **Make this my default connection** when appropriate, and save. 6. For **User OAuth**, complete **Connect OAuth** in the post-save guide, then test the connection from the saved row or guide. 7. For other modes, test the connection from the saved row or post-save guide. Genesis supports **API Token (Cloud)**, **User OAuth (Cloud)**, **Personal Access Token (Server/DC)**, and **Username and Password** saved modes. See [Connections](/docs/Setup/Connections) for scope, RBAC, and default-layer details. ## Connection modes | Mode label | Stored `auth_type` | Typical use | | - | - | - | | **API Token (Cloud)** | `api_token` | Long-lived Cloud token for shared bots or Context Graph scans | | **User OAuth (Cloud)** | `user_oauth` | Interactive chat — each user authorizes Genesis to act as them on Confluence Cloud | | **Personal Access Token (Server/DC)** | `pat` | Confluence Server or Data Center | | **Username and Password** | `password` | Basic-auth Server/DC instances | ### `api_token` (Cloud) | Field | Type | Required | Notes | | - | - | - | - | | `host` | string | Yes | Confluence Cloud URL, for example `https://yourcompany.atlassian.net` | | `email` | string | Yes | Atlassian account email tied to the API token | | `api_token` | string | Yes | API token from Atlassian account security settings | API-token Cloud connections are PAT-class for the `tools` category. Roles need `access_pat_connections_tools` to create, update, or test them. ### `user_oauth` (Cloud) Use **User OAuth (Cloud)** when agents should call Confluence as the requesting user in chat. Genesis routes these connections through Atlassian's OAuth gateway (`api.atlassian.com`) and resolves a per-site `cloudId` after authorization. In the [Atlassian Developer Console](https://developer.atlassian.com/console/myapps/), create a new OAuth 2.0 (3LO) app. Add **Confluence API** as a permission and grant the scopes listed in Genesis's **Scopes** field (see below). Under **Authorization**, add the redirect URI Genesis shows on the connection card to the app's **Callback URLs** (up to 30 URLs per app, so one Atlassian app can serve several Genesis connections). Open **Config -> Connections**, select **Confluence**, choose **User OAuth (Cloud)**, enter **Confluence URL** (`host`, required), optional **Email**, **OAuth Client ID**, and **OAuth Client Secret**, then save. Genesis pre-fills authorization and token URLs (`https://auth.atlassian.com/authorize` and `https://auth.atlassian.com/oauth/token`), suggests the connection name `confluence_oauth_main`, and accepts comma- or space-separated scopes. Register the exact redirect URI Genesis displays for the name you save — do not rename the connection afterward; the connection name is part of the redirect URI. Complete **Connect OAuth** in the post-save guide (or from chat OAuth cards). Then run **Test Connection**. If authorization succeeds but Genesis cannot match your **Confluence URL** to an accessible Atlassian site, Genesis still records the grant and shows a diagnostic warning on the OAuth card, in the Connections toast, or in the post-save guide — update `host` or re-authorize with access to the correct site before using `confluence_connector`. | Field | Type | Required | Default | Notes | | - | - | - | - | - | | `host` | string | Yes | none | Confluence Cloud site URL, for example `https://yourcompany.atlassian.net` (a `/wiki` suffix is accepted). Must match the site the user grants during OAuth — Genesis does not silently accept a different accessible site when only one site is available (unlike Jira User OAuth). | | `email` | string | No | none | Optional email hint | | `client_id` | string | Yes | none | OAuth Client ID from the Atlassian app | | `client_secret` | string | Yes | none | OAuth Client Secret | | `authorization_url` | string | No | `https://auth.atlassian.com/authorize` | Atlassian authorization endpoint | | `token_url` | string | No | `https://auth.atlassian.com/oauth/token` | Atlassian token endpoint | | `token_endpoint_auth_method` | string | No | `client_secret_post` | `client_secret_post` or `client_secret_basic` | | `scopes` | string | No | see below | Comma- or space-separated scopes | Default scopes: `read:confluence-space.summary`, `read:confluence-content.all`, `read:confluence-user`, `search:confluence`, `write:confluence-space`, `offline_access`, `read:page:confluence`, `write:page:confluence`, `delete:page:confluence`, `read:space:confluence`, `read:attachment:confluence`, `read:content.metadata:confluence`, `read:hierarchical-content:confluence` User OAuth Confluence connections are not PAT-class — roles do not need `access_pat_connections_tools` to save or test them. In Snowflake Native App / SPCS deployments, approve egress to `api.atlassian.com` and `auth.atlassian.com` (plus your configured `host`) before testing. Confluence Cloud User OAuth uses Atlassian's v2 API gateway for space, page, and attachment actions. Grants authorized before these granular scopes were required may return `401` with *scope does not match*. Add the v2 scopes above to the connection's **Scopes** field, update the Atlassian app's permissions to match, then re-authorize the connection. ### `pat` (Server/DC) | Field | Type | Required | Notes | | - | - | - | - | | `host` | string | Yes | Confluence Server/DC base URL | | `pat` | string | Yes | Personal access token | PAT Server/DC connections are PAT-class for the `tools` category. ## Test Connection and Context Graph readiness **Test Connection** verifies basic connectivity and audits whether the saved credentials have the permissions needed for Context Graph scanning. On success, the result includes a `capabilities` object with these probes: | Capability | What it checks | | - | - | | `list_spaces` | Can list Confluence spaces (up to 200 returned in the probe). | | `read_content` | Can read `body.storage` for at least one page in the first accessible space. | | `read_hierarchy` | Can read `ancestors` for that page. | | `context_graph_ready` | `true` only when `list_spaces`, `read_content`, and `read_hierarchy` all succeed. | The overall test `success` is `true` when basic connectivity works, even if Context Graph permissions are incomplete — the connection can still power `confluence_connector` agent tools. When a probe fails, `context_graph_notes` explains what to fix (for example **View Page** permission for content reads, or **View** permission on parent pages for hierarchy reads). ## Context Graph scanning Confluence connections can be registered as Context Graph lineage sources from [Digital Twin and Context Graph](/docs/User-Guide/Digital-Twin-And-Context-Graph). Saving a Confluence connection does not add it to the graph automatically — use **Add source** in the Twin configuration modal. Scheduled scans run headless (typically 2:00 AM) and require a long-lived credential. **User OAuth** Confluence connections appear in the Twin picker but **Add source** stays disabled; recreate the connection with **API Token (Cloud)** or **Personal Access Token (Server/DC)** to enable scanning. When registered, Twin crawls accessible Confluence spaces (all spaces by default), reads page content, generates grouped wiki summaries, and indexes documents for semantic search. Scanned content surfaces in the Context Graph viewer, Team Wiki pane, and `@` mention search alongside other indexed assets. ## Connection defaults for agents When `confluence_connector` omits `connection`, Genesis resolves the effective default `confluence` connection for the current user and bot (**My default**, then **Role default**). See [Default connection layers](/docs/Setup/Connections#default-connection-layers). * Pass `connection` (for example `confluence.shared` or `shared`) to target a specific saved connection. * When no scoped default applies, Genesis may fall back to explicit tool parameters (`base_url`, `username`, `password`, `pat`) or environment configuration instead of scanning other saved Confluence connections. * When a scoped default resolves but secrets cannot be loaded, Genesis returns an error instead of trying another connection or alternate credentials. When the acting user cannot use the resolved connection (for example a **personal** connection owned by someone else), `confluence_connector` returns `Success: false` with a `Suggestion` that explains the failure is a connection access/permission issue, not invalid credentials. Ask the connection owner to run the request in-thread, or have an admin with `manage_all_connections` share the connection. **User OAuth** connections act as the requesting user. The caller must be present in the active thread context, and each user must complete **Authorize** (or reconnect via `?open_oauth=confluence.`) before Genesis can use their grant. ## What it helps with * searching documentation, * reading or referencing pages, * supporting documentation-based research workflows. ## Related pages * [Connections](/docs/Setup/Connections) * [Digital Twin and Context Graph](/docs/User-Guide/Digital-Twin-And-Context-Graph) * [Document Indexes](/docs/User-Guide/Document-Indexes)