{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Glean","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"glean","__idx":0},"children":["Glean"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connect your Glean instance to Capsule Security to discover and monitor the AI agents built and running in Glean."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This integration reads your Glean agent inventory through Glean's Agents API, and each agent's owner through Glean's Insights API:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agents"]}," - Every agent in your Glean instance (name, description, and capabilities), surfaced in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inventory"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agent owners"]}," - The person who created each agent, surfaced as the agent's owner in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inventory"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agent tools"]}," - The tools each agent can invoke, with the authentication and write-action type behind each one"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agent input and output schemas"]}," - The shapes each agent declares, kept on the agent's details"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The integration is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["read-only"]}," - it never creates, modifies, or runs agents in Glean. Each sync takes a full snapshot of the agent inventory, so agents deleted in Glean disappear from Capsule on the next sync."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, ensure you have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An active ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Glean"]}," instance"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin"]}," access in Glean, required to create a Client API token"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," account with admin access"]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note:"]}," The token must carry the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AGENTS"]}," scope, plus the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["INSIGHTS"]}," scope for owner attribution. A token created with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["GLOBAL"]}," permissions can only be created by a Glean ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Super Admin"]}," and requires an act-as email (the user the token acts on behalf of)."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-create-a-client-api-token","__idx":3},"children":["Step 1: Create a Client API token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a Client API token in the Glean admin console. This is the credential Capsule uses to read your agent inventory."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"steps","__idx":4},"children":["Steps"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Go to your Glean admin console and open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Platform - API Tokens"]}," (or visit ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://app.glean.com/admin/platform/tokenManagement"},"children":["app.glean.com/admin/platform/tokenManagement"]},")"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a new ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client API token"]}," with a descriptive name (e.g., \"Capsule Security Integration\")"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Grant the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AGENTS"]}," scope so Capsule can list agents and read their tools and schemas, and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["INSIGHTS"]}," scope so Capsule can attribute each agent to its owner"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Scopes cannot be changed after a token is created. A token with only ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AGENTS"]}," still syncs the agent inventory, but agents arrive without an owner - to add owners later, create a new token with both scopes and reconnect."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Choose the token's permissions:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["USER"]}," - the token acts as the user who created it; no extra configuration needed"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["GLOBAL"]}," - requires a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Super Admin"]}," to create, and Capsule needs an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["act-as email"]}," of a permitted user (entered in Step 3)"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Important:"]}," Copy and save the token immediately - it is shown only once"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"security-notes","__idx":5},"children":["Security notes"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store the token in a password manager or secret store; never share it in email, chat, or source control"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To rotate it, create a new token, reconnect the integration in Capsule, then delete the old token in Glean"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-find-your-instance-name","__idx":6},"children":["Step 2: Find your instance name"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule connects to your Glean backend domain, which is derived from your instance name."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"steps-1","__idx":7},"children":["Steps"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your instance name is the subdomain of your Glean backend domain - for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme"]}," for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme-be.glean.com"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you are unsure, your Glean admin can find it in the Glean setup pages; pasting the full backend URL into Capsule also works"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"example-instance-names","__idx":8},"children":["Example instance names"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"acme\nhttps://acme-be.glean.com\n"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-configure-the-integration-in-capsule","__idx":9},"children":["Step 3: Configure the Integration in Capsule"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once you have your API token and instance name, set up the integration in the portal."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"steps-2","__idx":10},"children":["Steps"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Log in to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," portal"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Integrations"]}," in the left sidebar"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Find the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Glean"]}," card and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up Integration"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The card displays a 3-step wizard. Step 1 links to the Glean token management page; Step 3 collects your credentials:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Instance name"]}," - the subdomain from Step 2 (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme"]},"), or the full backend URL"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API token"]}," - paste the Client API token from Step 1"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Act-as email (optional)"]}," - required only for GLOBAL tokens; the email of a user the token may act as"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule validates the credentials live as you type. When the required fields are valid you'll see ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connection successful"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"after-setup","__idx":11},"children":["After setup"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Capsule validates the credentials and creates a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Glean"]}," environment scoped to your instance"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your API token is encrypted and stored in Capsule's secret store - it is never displayed again"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Capsule syncs the agent inventory on a schedule. View agents under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inventory"]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-capsule-ingests","__idx":12},"children":["What Capsule ingests"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Glean source"},"children":["Glean source"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Appears in Capsule as"},"children":["Appears in Capsule as"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agents (name, description, capabilities)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agents"]}," in Inventory"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agent owner (the agent's creator)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Owner"]}," on the agent"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agent tools (from the agent schemas)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tools"]}," on the agent"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agent input and output schemas"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Metadata on the agent's details"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each sync is a full snapshot of the inventory - agents removed in Glean are removed from Capsule on the next sync."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Glean reports an agent's owner only for agents that have been run in the past year, so an agent that has never been used arrives without one."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":13},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the connection test fails, the portal shows a specific message:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Message"},"children":["Message"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Fix"},"children":["Fix"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Instance name is required"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The instance name field is empty"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enter the instance name from Step 2"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API token is required"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The token field is empty"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Paste the Client API token from Step 1"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enter the instance name (e.g. acme) or the full https URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The value isn't a valid instance name or URL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use the plain subdomain (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme"]},") or the full ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://acme-be.glean.com"]}," URL"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API token invalid or revoked"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The token is wrong, deleted, or revoked (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401"]},")"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create a fresh Client API token and reconnect"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token lacks the AGENTS scope, or the act-as email is not permitted for this token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The token is missing the AGENTS scope, or a GLOBAL token's act-as email is missing or not allowed (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403"]},")"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Recreate the token with the AGENTS scope; for GLOBAL tokens, enter a permitted act-as email"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Glean instance not found. Check the instance name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The instance name doesn't resolve to a Glean backend (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["404"]}," or DNS failure)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Confirm the subdomain of your Glean backend domain (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme"]}," for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme-be.glean.com"]},")"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["retry"]}," button next to the act-as email field to re-run the connection test after correcting a value."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-it-works","__idx":14},"children":["How It Works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule calls three endpoints on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://<instance>-be.glean.com"]},", authenticating with a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Bearer"]}," token. For GLOBAL tokens, Capsule sends the configured act-as email in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Glean-ActAs"]}," header."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Endpoint"},"children":["Endpoint"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Scope"},"children":["Scope"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/api/agents/search"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The agent inventory snapshot"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["AGENTS"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/api/agents/{agent_id}/schemas"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Each agent's tools and input/output schemas"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["AGENTS"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/rest/api/v1/insights"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agent owner attribution"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["INSIGHTS"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The schemas endpoint is per-agent, so Capsule requests it once per discovered agent, in small waves. An agent deleted between the inventory snapshot and its schemas request is skipped rather than failing the sync."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Owners are not part of the Agents API. To attribute them, Capsule calls the Insights API at ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://<instance>-be.glean.com/rest/api/v1/insights"]}," for the agents it just discovered. If the token lacks the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["INSIGHTS"]}," scope, Capsule logs the rejection, skips owner attribution, and still records the agent inventory."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule honors ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Retry-After"]}," on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["429"]},", retries transient ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["5xx"]}," and network errors with exponential backoff, and never retries ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401"]},"/",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403"]},". Your API token is held in an encrypted secret store, scoped to your tenant and instance, and is used only to read the endpoints above."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":15},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Email"]},": support@capsule.security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Include"]},": Your tenant ID, your Glean instance name, and any error message shown in the connection test"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"references","__idx":16},"children":["References"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developers.glean.com/agents/overview"},"children":["Glean Agents API"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developers.glean.com/api/platform-api/platform-agents-get-schemas"},"children":["Get agent schemas"]}," - the tools and input/output schemas Capsule reads"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developers.glean.com/api/client-api/insights/overview"},"children":["Glean Insights API"]}," - the source of agent owner attribution"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developers.glean.com/api-info/client/authentication/overview"},"children":["Client API authentication"]}," - token types, scopes, and act-as"]}]}]},"headings":[{"value":"Glean","id":"glean","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Create a Client API token","id":"step-1-create-a-client-api-token","depth":2},{"value":"Steps","id":"steps","depth":3},{"value":"Security notes","id":"security-notes","depth":3},{"value":"Step 2: Find your instance name","id":"step-2-find-your-instance-name","depth":2},{"value":"Steps","id":"steps-1","depth":3},{"value":"Example instance names","id":"example-instance-names","depth":3},{"value":"Step 3: Configure the Integration in Capsule","id":"step-3-configure-the-integration-in-capsule","depth":2},{"value":"Steps","id":"steps-2","depth":3},{"value":"After setup","id":"after-setup","depth":3},{"value":"What Capsule ingests","id":"what-capsule-ingests","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"How It Works","id":"how-it-works","depth":2},{"value":"Support","id":"support","depth":2},{"value":"References","id":"references","depth":2}],"frontmatter":{"seo":{"title":"Glean"}},"lastModified":"2026-09-01T17:05:14.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/glean","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}