Connect a third-party data source

This page describes how to connect third-party data sources to Vertex AI Search.

When you connect a third-party data source, Vertex AI Search creates a data connector, and associates data stores (called entity data stores) with it for the entities that you specify. Entity types are specific to the data source that you're connecting to. For example, Jira Cloud entities include issues, attachments, comments, and worklogs.

Third-party data sources are available only for generic search apps. Chat, recommendations, and agent apps can't use third-party data sources.

Third-party connectors are not CMEK-compliant.

To import data from a Google data source instead, see Create a search data store.

Before you begin

1. Contact your Google account team and ask to be added to the allowlist for third-party data source connectors.

2. Go to the section for the source you plan to use:

   • Connect Confluence Cloud
   • Connect Confluence Data Center On-premises
   • Connect Jira Cloud
   • Connect Jira Data Center On-premises
   • Connect Salesforce
   • Connect ServiceNow
   • Connect Sharepoint Online
   • Connect Slack
   • Connect Dropbox
   • Connect Box
   • Connect OneDrive

Connect Confluence Cloud

Use the following procedure to sync data from Confluence Cloud to Vertex AI Search.

After you set up your data source and import data the first time, the data store syncs data from that source at a frequency that you select during setup.

Before setting up your connection:

• Set up access control for your data source. For information about setting up access control, see Use data source access control.

• Have the following authentication information ready:

  • Instance URL. In the form https://EXAMPLE.atlassian.net—for example, https://google.atlassian.net.

  • Instance ID. This is the cloudid and can be found by going to https://EXAMPLE.atlassian.net/_edge/tenant_info and copying the value of cloudId.

• Enable OAuth 2.0 and get the client ID and client secret.

  Use https://vertexaisearch.cloud.google.com/console/oauth/confluence_oauth.html as the callback URL. For information about enabling OAuth 2.0 for Confluence Cloud and getting the client ID and client secret, see OAuth 2.0 (3LO) apps in the Atlassian Developer documentation.

• When setting OAuth 2.0 permission scopes, configure the following scopes:

  View scopes

  • read:attachment:confluence
  • read:configuration:confluence
  • read:content-details:confluence
  • read:content.metadata:confluence
  • read:group:confluence
  • read:space:confluence
  • read:user:confluence

• For user permissions to apply correctly, each Confluence Cloud user must make their email visible to all users. To do so, change the email visibility settings in Confluence Cloud and set the visibility to Anyone. For more information, see Set your email visibility in the Atlassian documentation.

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• See Preview results for apps with third-party access control.

Connect Confluence Data Center On-premises

Use this procedure to create a Confluence Data Center data store and search app in Agent Builder, syncing on-premises Confluence data with Vertex AI Search.

After you set up your data source and import data the first time, you can choose how often the data store syncs with that source.

Before you begin

Before setting up your connection, make sure that you have the following:

• Service attachment (Required for private destination type only): Configure a service attachment for secure data transfer.
• Username and password: Obtain valid credentials for authentication from your Confluence administrator.
• Domain URL (Optional for private destination type): Specify the URL of the Confluence Data Center instance.
• Base domain name (Optional): Provide the base domain name for the Confluence instance.
• Destination port (Optional): Identify the port used for communication with the Confluence Data Center.

Configuration guidelines for Private Service Connect

Use the following configuration guidelines to establish connections with Private Service Connect(PSC). Adjust or add resources as needed. Make sure the PSC service attachment is properly configured to connect to the private instance and meets the requirements for a published service.

• Network configuration:

  a. Place the PSC service attachment and load balancer in different subnets within the same Virtual Private Cloud network.

  b. The backend system must remain closed to the public network for security reasons. However, ensure it can accept traffic from the following sources:

  • For proxy-based/HTTP(s) load balancers (L4 proxy ILB, L7 ILB), configure the backend to accept requests from the proxy subnet in the Virtual Private Cloud network.
  • For more information, see the Proxy-only subnets for Envoy-based load balancers documentation.

• Firewall rules:

  a. Ingress rules:

  • Allow traffic from the PSC service attachment subnet to the Internal Load Balancer (ILB) subnet.
  • Make sure that the ILB can send traffic to the backend.
  • Permit health check probes to reach the backend.

  b. Egress rules:

  • Enable egress traffic by default, unless specific deny rules apply.

Additional considerations:

• Make sure to keep all the components, including the PSC service attachment and load balancer, in the same region.

Generate a service attachment

Use the following steps to generate a service attachment:

1. Decide endpoint type: Select Public or Private endpoint.

2. For Public endpoint: If the Confluence Data Center Destination type is Public, you are not required to create the setup for service attachment. Instead, you can use your public URL in the Domain URL field of the Google Cloud console when creating your connector.

3. For Private endpoint:

   a. Use Private Service Connect (PSC) to enable connections from private instances to Google Cloud.

   b. Create a Virtual Private Cloud network and required subnets.

   c. Create a Virtual Machine (VM) instance and install the backend service.

   d. (Optional) Set up a health check probe to monitor backend health.

   e. Add a load balancer to route traffic to the VM or backend.

   f. Define firewall rules to allow traffic between the PSC endpoint and the backend.

   g. Publish the endpoint by creating a PSC service attachment.

Create a Confluence Data Center user and set up permissions

To enable Vertex AI Search to obtain data from Confluence, you need to create a new user with the minimum permissions necessary. Follow these steps to create the user and set up the required permissions.

Sign in as an administrator

1. Go to your Atlassian domain site and open the Confluence Data Center instance.
2. Enter the admin username and password.
3. Click Log In.

Create a new user

When creating a data store, you must create a user to obtain data from the third-party instance.

1. Click the settings icon.
2. Select User management.
3. Enter the administrator credentials, if prompted.
4. In the Administration page, click Create user.
5. Enter the email address, full name, username, and password.
6. Click Create user.

Assign user to a group

1. In the Confluence administration page, navigate to the Users and security tab and click Groups.
2. Click Add group. Enter a name for the group and create it.
3. In the Find group field, enter the group name to find the group.
4. Click the settings icon.
5. Select the profile account and navigate to User management.
6. In the Users page, under List users, search for the newly created user in the Find user field.
7. Click the user to open the View users page.
8. Click Edit groups to open the Edit user group page.
9. Select the checkbox for the created user group.
10. Click Save to assign the user to the newly created group.

The added user is assigned in the Group members section.

Configure user permissions

1. In the Confluence administration page, navigate to the Issues tab.
2. Locate Permissions.
3. Select View global permissions.
4. Select Edit permissions.
5. In the Edit global permissions page, search for the group assigned to the user, and enable the can use option.

Configure the documentation space

1. Click the Confluence icon to navigate to the Dashboard page.
2. Click Create space
3. Select Documentation space and click Next.
4. Enter all the necessary details and click Create to create the documentation space.
5. Under My spaces, click the newly created space.
6. Navigate to Pages, and open the menu (three dots).
7. Select Restrictions.
8. From the Restrictions drop-down menu, select the Viewing and editing restricted option.
9. Search for the group and assign the can view permission.
10. Click Apply. The user is created with minimum access and permissions are set for spaces. You can also assign permissions to the blogs.

Create a Confluence Data Center on-premises connector

Set up a Confluence Data Center on-premises connector to sync data with Google Cloud. First, create a data store in the Agent Builder and configure the connection settings, including authentication and synchronization preferences.

#### Create a Confluence Data Center On-premises connector

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• See Preview results for apps with third-party access control.

Connect Jira Cloud

Use the following procedure to sync data from Jira Cloud to Vertex AI Search.

After you set up your data source and import data the first time, you can choose how often the data store syncs with that source.

Before you begin

Before setting up your connection:

• Set up access control. Ensure that access control is properly configured for your data source. This step ensures that only authorized users can access and manage the data. For more information, see Use data source access control documentation.
• For user permissions to apply correctly, Jira Cloud users must provide sharing consent.
• Make sure that you have an Atlassian account, Jira instance, and project.
• Verify that you have administrator access to the Jira instance, and project.

Set up authentication and permissions in Jira

Using the instructions in the following sections, ensure you have the necessary authentication details and admin access to your Jira instance. Create a Client ID and Client Secret through the Atlassian Developer Console, configure the required OAuth 2.0 scopes, and set up permissions for users. Finally, retrieve your instance URL and ID, configure roles, and authenticate to sync data between Jira Cloud and Vertex AI Search.

Create client ID and client secret

1. Sign in to developer.atlassian.com.
2. Click the profile icon in the top right corner and select Developer Console.
3. Click Create and select OAuth 2.0 Integration.
4. Enter a name for the app.
   • Check the terms and conditions checkbox.
   • Click Create.

5. You will find five options: Overview, Distribution, Permissions, Authorization, and Settings. Start with Authorization:

   a. Click Authorization.

   b. In the Authorization type table, select Add for OAuth 2.0 (3LO).

6. In the Callback URL field, enter https://vertexaisearch.cloud.google.com/console/oauth/jira_oauth.html, and then click Save changes.

   NOTE: If you see the warning: Your app doesn't have any APIs. Add APIs to your app., this will be addressed in the next section.

7. Select Permissions:

   a. Go to Jira API, click Add, then click Configure.

   NOTE: When you click Add, the button changes to Configure.

   b. Go to the Classic scopes tab and click Edit Scopes. Select the following scopes:

   View Scopes

   • read:avatar:jira
   • read:audit-log:jira
   • read:group:jira
   • read:issue-security-level:jira
   • read:issue-security-scheme:jira
   • read:jira-user
   • read:jira-work
   • read:user:jira

   Confirm that 7 scopes are selected, then save your changes.

8. Click Distribution, select Edit, and do the following:

   • Select the Sharing radio button first to enable editing other fields.
   • Fill out the remaining fields.
   • Select Yes when asked: Does your app store personal data?

9. Select Settings to copy your Client ID and Client Secret.

Retrieve instance URL and instance ID

To get the instance URL:

1. Go to atlassian.net and sign in with your admin account.
2. Select the app you want to sync. For example, sync the first app.
3. Find the instance URL, which is the subdomain in the address bar. It will look like: Assign appropriate permissions.

To get the instance ID:

1. Open a new tab, copy the instance URL, and append /_edge/tenant_info to the instance URL. For example, https://YOUR-INSTANCE.atlassian.net/_edge/tenant_info.
2. Navigate to the link to find the cloudId value. The cloudId is your Instance ID.

Set up permissions and roles

1. Sign in to atlassian.com with your admin account.
2. Click the menu icon on the top left or go to admin.atlassian.com.

3. On the Admin page, click Manage users and go to the Groups page.

4. Click Create group. Enter a name for the group and create it.

5. In the Group product access section of your new group's page, click Add products to group.

6. For Jira, select User access admin as the product role.

7. For Jira Admin, select Product admin as the product role and save your changes.

8. On the Groups page, click Add group members and add users or accounts that the connector will authenticate as.

Create a Jira Cloud connector

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• See Preview results for apps with third-party access control.

Connect Jira Data Center On-premises

Use this procedure to create a Jira Data Center data store and search app in Agent Builder, syncing on-premises Jira data with Vertex AI Search.

After you set up your data source and import data the first time, you can choose how often the data store syncs with that source.

Before you begin

Before setting up your connection, make sure that you have the following:

• Service attachment (Required for private destination type only): Configure a service attachment for secure data transfer.
• Username and password: Obtain valid credentials for authentication from your Jira administrator.
• Domain URL (Optional for private destination type): Specify the URL of the Jira Data Center instance.
• Base domain name (Optional): Provide the base domain name for the Jira instance.
• Destination port (Optional): Identify the port used for communication with the Jira Data Center.

Configuration guidelines for Private Service Connect

Use the following configuration guidelines to establish connections with Private Service Connect(PSC). Adjust or add resources as needed. Make sure the PSC service attachment is properly configured to connect to the private instance and meets the requirements for a published service.

• Network configuration:

  a. Place the PSC service attachment and load balancer in different subnets within the same Virtual Private Cloud network.

  b. The backend system must remain closed to the public network for security reasons. However, ensure it can accept traffic from the following sources:

  • For proxy-based/HTTP(s) load balancers (L4 proxy ILB, L7 ILB), configure the backend to accept requests from the proxy subnet in the Virtual Private Cloud network.

  • For more information, see the Proxy-only subnets for Envoy-based load balancers documentation.

• Firewall rules:

  a. Ingress rules:

  • Allow traffic from the PSC service attachment subnet to the Internal Load Balancer (ILB) subnet.
  • Make sure that the ILB can send traffic to the backend.
  • Permit health check probes to reach the backend.

  b. Egress rules:

  • Enable egress traffic by default, unless specific deny rules apply.

Additional considerations:

• Make sure to keep all the components, including the PSC service attachment and load balancer, in the same region.

Generate a service attachment

Use the following steps to generate a service attachment:

1. Decide endpoint type: Select Public or Private endpoint.

2. For Public endpoint: If the Jira Data Center Destination type is Public, you are not required to create the setup for service attachment. Instead, you can use your public URL in the Domain URL field of the Google Cloud console.

3. For Private endpoint:

   a. Use PSC to enable connections from private instances to Google Cloud.

   b. Create a Virtual Private Cloud network and required subnets.

   c. Create a Virtual Machine (VM) instance and install the backend service.

   d. (Optional) Set up a health check probe to monitor backend health.

   e. Add a load balancer to route traffic to the VM or backend.

   f. Define firewall rules to allow traffic between the PSC endpoint and the backend.

   g. Publish the endpoint by creating a PSC service attachment.

Create a Jira Data Center user and set up permissions

To enable Vertex AI Search to obtain data from Jira, you need to create a new user with the minimum permissions necessary. Follow these steps to create the user and set up the required permissions.

Sign in as an administrator

1. Go to your Atlassian domain site and open Jira Data Center instance.
2. Enter the admin username and password.
3. Click Log In.

Create a new user

When creating a data store, you must create a user to obtain data from the third-party instance.

1. Click the settings icon.
2. Select User management.
3. Enter the administrator credentials, if prompted.
4. In the Administration page, click Create user.
5. Enter the email address, full name, username, and password.
6. Click Create user.

Assign user to a group

1. In the Administration page, under User management, click Groups.
2. Create a group by entering a name and clicking Add group.
3. Select the newly created group.
4. Click Add/Remove users.
5. Click the member icon located next to the Add members to selected groups box.
6. Select the newly created user and click Save the selection.
7. Click Add selected user to see new users in the group members section.

You can see the added user is assigned in the Group members section.

Configure user permissions

1. In the Administration page, navigate to the Issues tab.
2. Select Permission schemes.
3. Click Add permission scheme.
4. Enter a name for the scheme and click Add.
5. Select the scheme and click the Permission icon.
6. Click Grant permission.
7. Add the following permissions, assign these permissions to the group created earlier, and click Grant:
   • Browse projects.
   • Browse projects archive.

You can add this scheme to the projects where the users in that group need access to view that project and issues, comments, worklogs, and attachments in that project.

Configure application access

1. In the Administration page, navigate to the Applications tab.
2. Under the Applications tab, select Application access.
3. Search for the created group and select it.
4. Verify that the group appears in the access list.

The user is created with minimum access. This schema is added to the projects. The Jira administrator can add more members to that group or add users to that project.

Create a Jira Data Center on-premises connector

Set up a Jira Data Center on-premises connector to sync data with Google Cloud. First, create a data store in the Agent Builder and configure the connection settings, including authentication and synchronization preferences.

Create a Jira Data Center On-premises connector

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• See Preview results for apps with third-party access control.

Connect Salesforce

Use the following procedure to sync data from Salesforce to Vertex AI Search.

After you set up your data source and import data the first time, the data store syncs data from that source at a frequency that you select during setup.

Before you begin

Before setting up your connection:

• Set up access control for your data source. For information about setting up access control, see Use data source access control.

• Have the following authentication information ready. For information about setting up client ID and client secret in Salesforce, see Configure a connected app for the OAuth 2.0 client credentials flow in the Salesforce documentation.

  • Instance URL: The domain name of your Salesforce instance. Search for My domain, copy the domain ending with my.salesforce.com, and add https:// to the beginning.
  • Client ID: Copy the client ID from the connected app by clicking Manage customer details. If the refresh token is enabled, verify that the token is refreshed and provide the latest token when creating a data store.
  • Client secret: Copy the client secret from the connected app by clicking Manage customer details. If the refresh token is enabled, verify that the token is refreshed and provide the latest token when creating a data store.

• For user permissions to apply correctly, Salesforce users must provide sharing consent.

• Use either an Enterprise or Developer plan. Trial accounts are not supported.

• Make sure that you are using Sales Cloud. Service Cloud is not supported.

• Add Google Cloud to Salesforce CORS allowlist. If you have already completed this task, then go to the Create an app section.

  • Follow the instructions in the Salesforce documentation to configure the CORS allowlist.
  • Enter https://console.cloud.google.com/ as an origin URL and save your configuration.

Create an app

Salesforce supports the following apps:

1. Connected app.
2. External client app.

Create a connected app

To set up a connected app in Salesforce for integration with Google Cloud, do the following:

1. Sign in to Salesforce.
2. Click the gear icon and navigate to Setup.
3. Under the Setup menu, navigate to App manager.
4. Click New connected app.

5. To configure the connected app:

   a. In the connected app creation page, do the following:

   • Check Enable OAuth settings.
   • Set the callback URL to: https://vertexaisearch.cloud.google.com/console/oauth/salesforce_oauth.html.
   • Select the following OAuth scopes:
     • Full Access (full).
     • Perform requests at any time (refresh_token, offline_access).

   b. Enable the flows:

   • Client credentials flow.
   • Authorization code and credentials flow.
   • User credentials in POST body for authorization code and credentials flow.
   • For Client credentials flow, assign your username in the Run as field. You must have read permissions to all the entities that your connector can extract.

After creating the connected app, do the following:

1. Edit app policies:

   • Go to App Manager and edit the newly created app.
   • Set IP Relaxation to Relax IP restrictions.
   • Configure Refresh Token Policy to Valid until revoked or more restrictive settings as required.
   • Ensure Permitted Users is set to All users may self-authorize.

2. Configure IP restrictions:

   • If Org-level IP range enforcement is enabled, set Trusted IP Ranges under Security > Network Access. For more information, see the Connected app IP relaxation and continuous IP enforcement documentation.
   • Disable Enforce login IP ranges on every request if no IP restrictions are required.

3. Configure an OAuth connected app:

   • Use the following guides to configure an OAuth connected app:
     • Connected app basics.
     • API integration.
     • Client credentials setup.

4. Save the connected app:

   • Save and exit the connected app.
   • In the search bar, search for OAuth and OpenId connect settings.
   • Enable Allow authorization code and credentials flows and OAuth username-password flows.

Create an external client app

To create and configure an external client app in Salesforce to enable OAuth-based authentication for integrations, do the following:

1. Obtain the client ID and client secret:

   • Sign in to Salesforce.
   • Click the gear icon and go to Setup.
   • Navigate to Setup > Apps > External client apps.
   • Click New external client app.

2. Provide the required information:

   • Enter the app name and your email address. The API name gets auto-populated by default.
   • Leave the Distribution state as Local.

3. Enable OAuth settings:

   • Expand API (Enable OAuth Settings) and select Enable OAuth.
   • Configure:
     • Callback URL: https://login.salesforce.com/services/oauth2/callback
     • OAuth scopes: Manage user data through APIs (api).
     • In Flow enablement, select Enable client credentials flow.
     • Click Create to create the External client app. Go to the External client app manager to view the app that you added to the list.

4. Edit app policies:

   • Open the created app.
   • Go to Policies and click Edit.
   • In the OAuth flows and external client app enhancements, check Enable client credentials flow.
   • Enter your Salesforce username in the Run as field.

5. Access OAuth credentials:

   • Click Settings.
   • Click OAuth settings.
   • Click Consumer key and secret to access the credentials. The verification code is sent to your email address.
   • Enter the verification code and click Verify.
   • Copy the Consumer key and use it as the client ID.
   • Copy the Consumer secret and use it as the client secret.

Create a Salesforce connector

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• See Preview results for apps with third-party access control.

Connect ServiceNow

Use the following procedure to sync data from ServiceNow to Vertex AI Search.

After you set up your data source and import data the first time, the data store syncs data from that source at a frequency that you select during setup.

Before setting up your connection:

• Set up access control for your data source. For information about setting up access control, see Use data source access control.

• Have the following authentication information ready:

  • Instance URL in the form of https://<domain-name>.service-now.com/.
  • Client ID and client secret. For information about endpoint setup and getting the client ID and client secret, see Create an endpoint for clients to access the instance in the ServiceNow documentation.

  • Username and password for one of the following ServiceNow role types:

    • Administrator role. See Base system roles in the ServiceNow documentation.

    • A custom ServiceNow role. This is an alternative to using an administrator role. To use a custom ServiceNow role, create access control rules with the following fields:

      View fields

      • Type: record
      • Operation: read
      • Name (a separate access control rule is required for each):
      • incident
      • sc_cat_item
      • kb_knowledge
      • kb_knowledge_base
      • kb_uc_can_read_mtom
      • kb_uc_can_contribute_mtom
      • sys_user_role
      • sys_user_has_role
      • sys_user_group
      • sys_user_grmember
      • Requires role: Name of the custom role

      For more information, see Create a role and Create an ACL rule in the ServiceNow documentation.

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• See Preview results for apps with third-party access control.

Connect Sharepoint Online

Use the following procedure to sync data from Sharepoint Online to Vertex AI Search.

After you set up your data source and import data the first time, the data store syncs data from that source at a frequency that you select during setup.

Before setting up your connection:

• Set up access control for your data source. For information about setting up access control, see Use data source access control.

• Grant administrator consent. For information about how to grant consent, see Grant tenant-wide admin consent to an application in the Microsoft documentation.

• Prepare the following Sharepoint Online authentication information to use during setup:

  • Instance URL. In the form http://DOMAIN_OR_SERVER/[sites/]WEBSITE. For more information about URLs, see URLs and tokens in SharePoint in the Sharepoint documentation.

  • Tenant ID, client ID, and client secret. To register the application, select Accounts in this organizational directory only for the sign-in audience, and then locate this authentication information. For more information, see Quickstart: Register an application with the Microsoft identity platform in the Microsoft documentation.

  • When registering the application, use https://vertexaisearch.cloud.google.com/console/oauth/confluence_oauth.html as the web callback URL.

  • When configuring application permissions, add the following application permissions for Graph API:

    View scopes

    • GroupMember.Read.All
    • Sites.FullControl.All
    • User.Read.All

  • When configuring application permissions, add the following delegated permissions for Sharepoint REST API:

    View scopes

    • AllSites.FullControl

• The following table describes the roles that are recommended for configuration and their limitations.

  View roles

  Roles	Client application registration	Can fetch content of all entities	Can fetch ACL	Can fetch identity	Notes
  Site Admins	No	Yes	Yes	Yes
  Site Collection Administrator	No	Yes	Yes	Yes
  Global Administrator	Yes	No	Yes	No	Limitation: Can't fetch identity or the comment and attachment entities
  Site Owner	No	Yes	Yes	No	Limitation: Can't fetch identity
  Application Administrator	Yes	N/A	N/A	N/A	The application administrator role is related to Microsoft 365 admin center / Entra admin center. It is not specific to Sharepoint.

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• See Preview results for apps with third-party access control.

Connect Slack

Use the following procedure to sync data from Slack to Vertex AI Search.

After you set up your data source and import data the first time, the data store syncs data from that source at a frequency that you select during setup.

Before you begin

Before setting up your connection:

• Set up access control for your data source. For information about setting up access control, see Use data source access control.

• Contact the Workspace owner to provide the permissions to install new apps in your workspace.

• Prepare the following Slack authentication information:

  • Workspace ID: Get the Workspace ID by following the instructions in Specify the Slack source for your data store in the Slack documentation.
  • Access token: Create a client app and define the required scopes. For more information, see Quickstart and How to quickly get and use a Slack API token in the Slack documentation.
  • When setting OAuth 2.0 permission scopes, configure the following scopes:

    View scopes

    • users:read.email
    • channels:history
    • channels:read
    • groups:history
    • groups:read
    • im:history
    • im:read
    • mpim:history
    • mpim:read
    • team:read
    • users:read
    • files:read

• By default, Slack restricts crawling and syncing content from private channels, group messages, and direct messages.

Configure Slack app

Obtain an access token to allow Vertex AI Search to ingest documents from your Slack workspace.

Generate a bot token

Generate a bot token to securely access private channels, instant messages (IMs), and multi-party instant messages (MPIMs). The bot token cannot crawl into the public channels it is not part of, and joining public channels generates a join message.

1. Sign in to Slack API Apps.
2. Click Create new app.
3. Select From scratch.
4. Enter a name for your app and select the workspace for integration.
5. Click Create app.
6. Click OAuth & Permissions.

7. Under Bot token scopes, add the following required scopes:

   View scopes

   • users:read.email
   • channels:history
   • channels:read
   • groups:history
   • groups:read
   • im:history
   • im:read
   • mpim:history
   • mpim:read
   • team:read
   • users:read
   • files:read

   By default, the bot reads from the #general and #random channels. To enable crawling, do the following:

   • For public channels, grant the channels:join scope to allow the bot to join automatically.
   • For private channels, invite the bot manually.

8. Click Install to your username workspace.

9. Follow the on-screen instructions to install the app and retrieve the bot token.

Generate a user token

Generate a user token to access all public channels without joining them first. The user token cannot crawl private channels, IMs, or MPIMs unless the user has access.

1. Sign in to Slack API Apps.
2. Click Create new app.
3. Select From scratch.
4. Enter a name for your app and select the workspace for integration.
5. Click Create app.
6. Click OAuth & Permissions.

7. Under User token scopes, add the following required scopes:

   View scopes

   • users:read.email
   • channels:history
   • channels:read
   • groups:history
   • groups:read
   • im:history
   • im:read
   • mpim:history
   • mpim:read
   • users:read
   • files:read

8. Click Install to your username workspace.

9. Follow the on-screen instructions to install the app and retrieve the user token.

Create a Slack Cloud connector

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• See Preview results for apps with third-party access control.

Connect Dropbox

Use the following procedure to sync data from Dropbox to Vertex AI Search.

After you set up your data source and import data the first time, the data store syncs data from that source at a frequency that you select during setup.

Before you begin

Before setting up your connection:

• Set up access control for your data source. For more information, see Use data source access control.

• Have the following Dropbox authentication information ready. For information about setting up these parameters, see the OAuth Guide in the Dropbox documentation.

  • Client ID
  • Client secret

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• To preview how your search results appear after your app and data store are set up, see Get search results. If you used third-party access control, see Preview results for apps with third-party access control.

Connect Box

Use the following procedure to sync data from Box to Vertex AI Search.

After you set up your data source and import data the first time, the data store syncs data from that source at a frequency that you select during setup.

Before you begin

Before setting up your connection:

• Set up access control for your data source. For information about setting up access control, see Use data source access control.

• Have the following Box authentication information ready. For information about setting up these parameters, see JWT Auth in the Box developer documentation.

  • Enterprise ID
  • Client ID
  • Client secret
  • Public key ID
  • Private key
  • Passphrase

• When creating the JWT endpoint, configure the following scopes:

  View scopes

  • root_readonly
  • root_readwrite
  • manage_managed_users
  • manage_app_users
  • manage_groups
  • manage_enterprise_properties
  • as_user
  • generate_access_token

Incremental changes for comments can take longer to sync than the configured frequency interval. If a folder containing an entity is copied or moved, then incremental changes can take longer to sync than the configured frequency interval.

Create Box app

1. Sign in to the Box Developer Console with your administrator account.
2. Click Create new app.
3. Select Custom app type.
4. Enter the App name.
5. Set the Purpose of the app: Integration, AI, or Google Cloud Agent Builder.
6. Choose Server authentication with JWT.

Configure Box app

Configure the settings for your Box app.

Create public/private key

1. Go to the Box Developer Console.

2. In the Configuration tab, click Generate a Public/Private Keypair.

   • The public key is automatically uploaded to the console with an ID. This ID is used when creating a connection.
   • A configuration file with the private key and passphrase can be downloaded locally. Make sure to keep this configuration file for later use.
   • Optionally, to generate your own key see the Box keypair setup guide.

Configure required permissions

1. In the Application scopes section, select the following permission:
   • Read all files and folders stored in Box.

Authorize the app

1. In the Authorization tab, click Review and submit and wait for approval from your administrator.
2. Administrators can approve the app in the Admin Console.

After authorization, Box fully sets up the app.

Create a Box connector

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• To preview how your search results appear after your app and data store are set up, see Get search results. If you used third-party access control, see Preview results for apps with third-party access control.

Connect OneDrive

Use the following procedure to sync data from OneDrive to Vertex AI Search.

After you set up your data source and import data the first time, the data store syncs data from that source at a frequency that you select during setup.

Before you begin

Before setting up your connection:

• Set up access control for your data source. For information about setting up access control, see Use data source access control.

• Have the following OneDrive authentication information ready:

  • Client ID, client secret, and tenant ID. For information about setting up these parameters, see Quickstart: Register an application with the Microsoft identity platform in the Microsoft documentation.

  • Specify scopes for access. An administrator role is required. For more information, see Quickstart: Configure a client application to access a web API in the Microsoft documentation.

    Configure the following scopes:

    View scopes

    • Files.Read.All Application
    • Group.Read.All Application
    • Sites.FullControl.All Application
    • User.Read Delegated
    • User.Read.All Application

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create a search app.

• To preview how your search results appear after your app and data store are set up, see Get search results. If you used third-party access control, see Preview results for apps with third-party access control.