Permissions and Scopes
Audit 360 for Confluence requests the following Confluence API scopes. All access is read-only — the app never writes to your Confluence instance.
Scopes
| Scope | Why it's needed |
|---|---|
read:space:confluence | Enumerates spaces across your site. Used by all three audit types and by the space picker in the configure modal. |
read:page:confluence | Reads page metadata (title, status, version, last-modified date) for the Spaces Audit page inventory. Page body is not included. |
read:confluence-content.all | Reads page body during the Content Audit keyword scan. Content is processed in memory and discarded — nothing is written to storage. |
read:attachment:confluence | Reads attachment metadata (filename, file size, media type) as part of the Content Audit inventory. Attachment contents are not read. |
read:confluence-user | Captures the account ID of the user who triggered each audit run for run attribution. Display names are not stored. |
read:confluence-groups | Resolves group memberships during the Permission Audit to determine effective space access. |
manage:confluence-configuration | Reads space-level permission grants (users, groups, and anonymous roles per space). This is the only Confluence API that exposes space ACLs. Permissions are read; none are modified. |
storage:app | Forge SQL stores audit results, run history, and keyword lists. Forge KVS tracks active job state and is cleared when each job completes. Both are scoped to your installation. |
For details on what is stored, what is excluded, and how long data is retained, see Data Handling and Security.