Confluence

Index a Confluence Cloud site or a Confluence Data Center instance: every space the account can read, or exactly the spaces you name, rendered from Confluence’s storage format to Markdown.

Adding one

Add source → Confluence

Press Test connection: it checks the site, the credential and the scope without indexing anything — use it before saving. The account’s own permissions are the outer boundary either way: Contextator never sees a page the account cannot.

Cloud or Data Center

• Cloud is the REST API under https://<site>.atlassian.net/wiki, authenticated with an Atlassian account e-mail and an API token.
• Data Center 7.9 and later is the REST API under <base URL>/rest/api, authenticated with a personal access token sent as a bearer — there is no e-mail. Before any credential is sent, the server’s version is read from its anonymous application manifest; an older release, a version that cannot be read, or a server that is not Confluence is refused with the version named, on Test connection and on sync.
• Confluence Server, the product line before Data Center, is not supported. If that is what you run, export the space and add it as an Upload source instead.

A Data Center on the internal network

The base URL is typed by an editor and the server connects to it carrying the source’s token, so where a Confluence source may connect is bounded (ADR-0088):

• Always refused: loopback and link-local addresses — the cloud metadata address 169.254.169.254 included — plus unspecified and multicast addresses, and the IPv4-mapped IPv6 forms of them.
• Refused unless allowed: private addresses — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7, and the deprecated site-local range fec0::/10.

If your Data Center resolves to a private address, list its host in CONFLUENCE_ALLOWED_HOSTS and restart:

CONFLUENCE_ALLOWED_HOSTS=wiki.corp.example

The check runs on the address the connection actually uses — after DNS, and again on every redirect — so neither a public-looking name that resolves inward, nor a redirect to an internal address, gets past it. A refusal names the rule on the source’s row and in the Test message, for example:

refused: `wiki.corp.example` resolves to a private address; list `wiki.corp.example` in CONFLUENCE_ALLOWED_HOSTS to allow it

No request — and so no token — is sent in that case. The list lifts only the private-address rule, and only for the names on it; there is no switch that turns the check off entirely. CONFLUENCE_ALLOWED_HOSTS is set in .env, alongside the rest of the shipped .env.example.

What a page becomes

Confluence’s storage format is XHTML plus Confluence’s own ac: and ri: namespaces. It goes through the same HTML→Markdown transform .html files do — see Content Types — so tables, code blocks, task lists and admonitions survive as structure.

• Macros are unwrapped. The prose inside an expand or a panel is indexed; the macro’s own configuration is not.
• Admonitions keep the word that made them admonitions, so a note still reads as a note.
• Code blocks survive. They live inside <![CDATA[…]]>, which an ordinary HTML parser drops on the floor — that is handled before the transform runs, not after.

How it stays fresh

A scheduled check of a Confluence source is one HTTPS request: one CQL search over exactly the spaces the run indexes, reporting how many pages there are and when the newest was touched. If neither number moved, nothing is fetched.

On Data Center, a signed webhook can start a sync as soon as a page changes — see Push Webhooks. It complements the sync interval; it does not replace it. Confluence Cloud cannot send one without a Forge or Connect app, so there the sync interval is how a source stays fresh — see Indexing.

Limits worth knowing

• One source indexes at most 5 000 pages. A larger wiki is indexed up to the ceiling and the run says so, in those words, on the source’s row. Split it across several sources by naming fewer spaces on each.
• If one of several named spaces stops answering, nothing is deleted. A renamed space key, or a permission withdrawn from the account, reads to the API as a space with no pages rather than as an error — so a configured space that held documents a moment ago and offers none now fails the sync, naming the space, instead of quietly deleting its documents. With Spaces left empty there is no list of what should be there and that check cannot be made.
• A page that cannot be rendered is a complaint, not a failed sync. A request that failed is a failed sync. The two are kept apart so a rate-limited first pull cannot report success over a third of a missing wiki.

Common problems