Skip to main content
The OpenText Documentum connector is part of the Enterprise Edition, and is currently in beta.
Bag of words reads an OpenText Documentum repository through Documentum REST Services (https://host/dctm-rest, hypermedia JSON; a D2 REST root also works). Documents become a searchable file catalog the agent can grep and read — not tables. The connector is read-only. Documents are addressed by their stable r_object_id, and display paths are shown relative to the configured root folder.

​
How scope and security work

Two independent limits apply to every call, and both are re-enforced on every read rather than only at indexing time:
  1. The connection’s scope — the root folder plus any include patterns. Anything outside it is invisible and unreadable.
  2. Documentum’s own ACLs — every call runs as the authenticated identity, so the repository does the security trimming. Nothing is pre-authorized by Bag of words.
That second point is what makes the per-user modes worth setting up: with OTDS impersonation or OTDS sign-in, each person’s session is genuinely theirs, and Documentum evaluates its ACLs against their identity.

​
Before you start

  • The REST Services base URL and the repository (docbase) name. One connection reads one repository.
  • An identity to connect as — a repository user, or a confidential OTDS OAuth client.
  • For per-user access: Allow impersonation enabled on the OTDS OAuth client and on the repository resource.
  • Decide the root folder before connecting. Narrowing scope later means re-indexing.

​
Fields

​
Authentication modes

Username / Password — userpass (the default; scopes: system and user) HTTP Basic against the repository. At user scope this is the bring-your-own-password path.
This mode does not work for Entra-only OTDS users, who have no password OTDS can validate. Use OTDS impersonation or OTDS sign-in for them.
OTDS OAuth client (service identity) — otds_client (system scope only) A client-credentials grant: the connection acts as the OAuth client’s own service user. This is system scope only — the client secret is admin-equivalent. OTDS impersonation — otds_impersonation (user scope, an overlay) The per-user path that stores no secret per user. The admin’s OTDS client stays on the connection and performs an RFC 8693 token exchange to mint a token for each user, so the Documentum session — and its ACL evaluation — is genuinely theirs. It layers over the connection’s otds_client credentials. Sign in with OTDS — oauth (user scope, no fields). Each user completes an OTDS authorization-code flow and Bag of words stores and refreshes their token. Requires the OTDS client to be configured on the connection’s system credentials.
Per-user authentication on file connections does not require an Enterprise license — but the Documentum connector itself does. See Authentication and access.

​
Troubleshooting

It is outside the connection’s scope. Check root_path first, then include_globs — when include patterns are set, anything not matching them is both invisible and unreadable.
The catalog hit max_catalog_objects (5,000 by default). Narrow the root folder or add include patterns instead of raising the cap.
Allow impersonation has to be enabled on the OTDS OAuth client and on the repository resource. Both.
They have no password OTDS can validate. Put them on OTDS impersonation or OTDS sign-in.
It exceeded max_file_size_mb (50 MB by default) and was rejected before parsing, rather than truncated.