Services → Confluence

Connect Confluence

Read pages and search spaces — runbooks, architecture notes, the context that explains why production looks the way it does.

Tier 2 Atlassian API token ~3 min profile confluence/docs-read

Setting this up with your own agent? Give it these instructions.

The account is the scope

Atlassian API tokens have no permission picker. A token does whatever the user who

created it can do. So the scoping work happens before the token exists: create a

dedicated Confluence user, grant it View on exactly the spaces the agent should

read, and create the token from that account.

That is coarser than a Coolify ability list or a Postgres role, and it is why this

profile is Tier 2. The allowlist is doing most of the work.

Create a dedicated Atlassian account — [email protected] or similar.
In Confluence, give it View permission on the spaces it should read. Check that it has no Add or Delete permission anywhere.
Sign in as that account, go to **id.atlassian.com → Security → API tokens → Create API token**, and copy it.
In Prodpeek: Services → Add a service → Confluence, paste the token, then Test connection.

Two reasons, and the second is the one people notice later. A personal token gives

the gateway everything you can reach, including spaces you forgot you had access to.

And every read is attributed to you in Confluence's audit log, so if you ever need to

answer "who read that page", the answer is useless.

An Atlassian account whose Confluence access is read-onlyAtlassian API tokens inherit the permissions of the user who created them. There is no scope picker — the ACCOUNT is the scope, which is why this is Tier 2 rather than Tier 1.
View permission on only the spaces the agent should readSpace permissions are the real fence here. Grant the account view on the spaces you want and nothing else.

The permissions that look harmless and quietly demote the profile from “the credential cannot” to “we asked it not to”.

Your own personal accountA token made from your account can do everything you can, in every space you can reach, and the audit trail will say you did it. Create a dedicated user.
Admin or space-admin rightsNothing this profile allows needs them.
Add/Delete permission in any spaceThe profile denies the write tools, but with a coarse credential the allowlist is the only fence — do not make it the only fence for writes too.

Signed in as the dedicated account, the spaces you did not grant are not visible.
Signed in as that account, a page shows no Edit action.
In Prodpeek, Test connection shows the write tools under 'denied by policy'.