> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.moveworks.com/llms.txt.
> For full documentation content, see https://docs.moveworks.com/llms-full.txt.

# Connecting Your Gateway to Moveworks

> Configure Moveworks to connect to and ingest content from your Content Gateway

## Overview

Once your Content Gateway server is deployed and reachable over HTTPS, follow these steps to connect it to Moveworks, verify ingestion, and configure access control.

If you haven't deployed your gateway yet, start with the [Starter Code](/api-reference/content-gateway/starter-code) guide.

***

## Step 1 — Create the connector

1. In **Moveworks Setup**, navigate to **Core Platform > Connectors > Built-in Connectors**.
2. Select **Content Gateway System**.

![Select Content Gateway System under Built-in Connectors](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/23c5a20b579ee2a7967c8b34161e8c9454819462527f52dbb2e909cbc3746301/docs/assets/images/content-gateway/content_gateway_connector.png)

3. Enter your gateway's public base URL, set the authentication type to **API Key**, and paste the value of your `GATEWAY_API_KEY`. Save.

***

## Step 2 — Configure ingestion

1. Navigate to **Enterprise Search > Configure Search > Classic Ingestion > Files**.
2. Click **Create** to configure a new ingestion using the connector you just created.

![Files Settings — configure a new Content Gateway ingestion](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/b69e0035e6ff0058fa57281b66453d7353539b5076110bed9e2319fbc1a71f12/docs/assets/images/content-gateway/configure_gateway_ingestion.png)

3. Save and trigger an initial sync.

To verify, navigate to **Enterprise Search > Indexed Content > Files**. Your documents should appear with Content Status and Permission Status of **Indexed**.

![Indexed Content view showing crawled and indexed file counts](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/a202471f30cc70c5270540733a2915ff2658032242468534c8146f74f9392ed8/docs/assets/images/content-gateway/content_gateway_ingested_content.png)

Initial ingestion typically completes within 30 minutes depending on document volume.

***

## Step 3 — Configure resource permissions

Create a permission rule to tell Moveworks how to enforce access control on the ingested content.

1. Navigate to **Enterprise Search > Resource Permissions > Permission Rules**.
2. Click **Create**.

![Permission Rules list](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/9b9f27de8c46f165d9ba45c409e5dccd818c1ba86e376cc9eaea678d29c2d61d/docs/assets/images/content-gateway/content_gateway_permission_rules.png)

3. Set **Integration Id** to your Content Gateway connector and **Resource Type** to `file`.
4. Choose a **Strategy Config** based on your access requirements:

| Strategy                                      | When to use                                                                                                                                                                                         |
| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Rebac Config**                              | Your gateway returns per-document permissions and you want Moveworks to enforce them at query time. Requires your gateway to implement `/v1/users`, `/v1/groups`, and `/v1/files/{id}/permissions`. |
| **Public to all members of the organization** | All ingested content should be accessible to every user — no per-document access control needed.                                                                                                    |

![Strategy Config set to Rebac Config](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/696245a92fba482f7deb864bd8446444c7ce5b7088ca08f8b177feedb4fffebc/docs/assets/images/content-gateway/content_gateway_permissions_enforced.png)

![Strategy Config set to Public to all members](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/af539104fd0cb661195de997d85d69762f3ab1ebb44d0d021269fd9774b9c267/docs/assets/images/content-gateway/content_gateway_no_permissions.png)

5. Save.

***

## Step 4 — Add your gateway to the User Identity flow

If you chose ReBAC in Step 3, Moveworks needs to map the user identities in your gateway's permission entries to authenticated Moveworks users.

1. In **Moveworks Setup**, go to **User Identity**.
2. Add your Content Gateway as an identity source.
3. Save and trigger a sync.

Once configured, Moveworks will use the `primary_email_addr` field from your gateway's `/v1/users` endpoint to resolve identities when checking document permissions.