Glean Upgrade & Migration

Overview

Glean is an enterprise search platform that indexes documents across SaaS tools via connectors and exposes Search and Indexing APIs. Migrations involve connector schema changes, search API response format updates, and document permission model upgrades. Tracking API versions is critical because Glean's Indexing API enforces document schema validation — adding required fields or changing permission structures in a new version will cause bulk indexing failures and stale search results if connectors are not updated in lockstep.

Version Detection

const GLEAN_BASE = "https://your-domain-be.glean.com/api";

async function detectGleanApiVersion(apiToken: string): Promise<void> {
  // Check indexing API health and version
  const indexRes = await fetch(`${GLEAN_BASE}/index/v1/status`, {
    headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" },
  });
  const indexStatus = await indexRes.json();
  console.log(`Indexing API version: ${indexRes.headers.get("x-glean-api-version") ?? "v1"}`);
  console.log(`Connector status: ${JSON.stringify(indexStatus.connectors)}`);

  // Check search API for deprecated query parameters
  const searchRes = await fetch(`${GLEAN_BASE}/client/v1/search`, {
    method: "POST",
    headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" },
    body: JSON.stringify({ query: "test", pageSize: 1 }),
  });
  const deprecationHeader = searchRes.headers.get("x-glean-deprecated-params");
  if (deprecationHeader) console.warn(`Deprecated parameters: ${deprecationHeader}`);
}

Migration Checklist

Schema Migration

// Glean document schema evolved: flat permissions → structured ACL model
interface OldGleanDocument {
  id: string;
  datasource: string;
  title: string;
  body: { mimeType: string; textContent: string };
  permissions: { allowedUsers: string[] };
  updatedAt: string;
}

interface NewGleanDocument {
  id: string;
  datasource: string;
  title: string;
  body: { mimeType: string; textContent: string };
  permissions: {
    allowedUsers: Array<{ email: string; datasourceUserId?: string }>;
    allowedGroups: Array<{ name: string; datasourceGroupId?: string }>;
    allowAnonymousAccess: boolean;
  };
  viewURL: string;
  updatedAt: string;
}

function migrateDocument(old: OldGleanDocument): NewGleanDocument {
  return {
    ...old,
    permissions: {
      allowedUsers: old.permissions.allowedUsers.map((email) => ({ email })),
      allowedGroups: [],
      allowAnonymousAccess: false,
    },
    viewURL: `https://app.example.com/doc/${old.id}`,
  };
}

Rollback Strategy

class GleanIndexClient {
  constructor(
    private token: string,
    private baseUrl: string,
    private apiVersion: "v1" | "v2" = "v2"
  ) {}

  async indexDocuments(docs: any[]): Promise<any> {
    try {
      const res = await fetch(`${this.baseUrl}/index/${this.apiVersion}/indexdocuments`, {
        method: "POST",
        headers: { Authorization: `Bearer ${this.token}`, "Content-Type": "application/json" },
        body: JSON.stringify({ documents: docs }),
      });
      if (!res.ok) throw new Error(`Glean indexing ${res.status}: ${await res.text()}`);
      return await res.json();
    } catch (err) {
      if (this.apiVersion === "v2") {
        console.warn("Falling back to Glean Indexing API v1");
        this.apiVersion = "v1";
        return this.indexDocuments(docs);
      }
      throw err;
    }
  }
}

Error Handling

Migration Issue	Symptom	Fix
Document schema validation failure	`400` with `missing required field: viewURL`	Add `viewURL` to all documents before re-indexing
Permission model mismatch	Documents indexed but not searchable by expected users	Migrate flat `allowedUsers` strings to structured user objects
Connector auth expired	`401 Unauthorized` on bulk index	Rotate API token in Glean admin and update connector config
Search response format changed	Client crashes parsing `snippets` as string instead of array	Handle both `string` and `Snippet[]` return types
Datasource quota exceeded	`429` during bulk re-index	Implement rate limiting with exponential backoff per Glean docs

Prerequisites

A pinned current and target version, compatibility assessment, sandbox fixtures, and a named owner for every breaking behavior.
Configuration and schema backups identified by revision, plus an approved downgrade and connector-disable procedure.
Synthetic data and allow/deny identities to prove the upgrade does not change access scope or freshness.

Instructions

Read the version delta and inventory affected client, connector, schema, and authorization contracts.
Upgrade in sandbox first, run bounded regression tests, and compare response shape, indexing counts, freshness, and authorization probes with baseline.
Promote through staging and a single canary datasource after approval; do not mix unrelated configuration changes into the upgrade.
Monitor the stated rollback triggers, then either promote in stages or restore the pinned prior revision and preserve redacted evidence.
Update the compatibility record only after the canary and rollback exercise are both complete.

Output

Produce an upgrade receipt with from/to versions, affected contracts, test/canary outcomes, allow/deny results, owner approval, compatibility decision, and rollback revision. Do not include production data or secrets.

Examples

from=client-r12; to=client-r13; sandbox=pass; staging=pass; allow=pass; deny=pass; canary=held; rollback=r12 is a defensible upgrade record.

Resources

Next Steps

For CI pipeline integration, see glean-ci-integration.

glean-upgrade-migration