Confluence Integration

What does the connection cover?

Cremit connects to a Confluence Cloud site and lists spaces visible to the token account. Each space is a separate scan target. Discovering a space does not enable it or prove that every page was read. Check the enabled targets and their completed scan progress. The current connection form accepts a site subdomain, email and API token; it has no Data Center selector or arbitrary base URL field.

For an enabled space, the worker reads current page text and attempts inline and footer comments and supported readable attachments. It does not run a separate template scan. Attachments can be skipped because of format, size, rules or download failure. Page retrieval or permission errors can also leave work incomplete. A page edit does not trigger an immediate scan; scheduled jobs process changes when the target runs.

Connect and select spaces

In Cremit Platform, open Configuration → Scan Sources → New and choose Confluence. Enter a label, the subdomain before .atlassian.net, the Atlassian account email and a compatible API token. Cremit checks the account and lists accessible spaces during connection. Review the token account’s Confluence access and your organization’s token policy before connecting.

Enable the spaces you intend to inspect as scan targets. Keep a space out by leaving its target disabled. There is no page-template toggle, archived-page switch, or attachments-on/off setting in this connection flow. The worker attempts supported attachments on pages it processes. If a space is missing, check the account’s access and token compatibility, then refresh the target list.

Verify coverage and respond

Put a harmless test string that matches an enabled detection rule in an accessible page in an enabled space. After a scheduled scan completes, check the target’s scan status, finding location and skip or access errors. Remove the test string afterward. A successful connection or a recent scan timestamp alone does not prove full space coverage: the worker can pause after 500 pages in a job and resume later.

For a real exposed credential, identify the workload owner and rotate or revoke it at the issuer after checking dependencies. Removing a Confluence page or comment does not invalidate the credential.

Primary documentation

Atlassian API token management

Confluence Cloud REST API v2

Cremit scanning flow