We are stopping submissions for the Cloud Fortified App (CFA) program. Starting September 1st, we will no longer accept new CFA submissions.

CFA annual reviews will also no longer be required from September 1st. The CFA program will be retired on 31st December, 2026.

The good news: the Atlassian Enterprise Certified (AEC) program is coming, and submissions will open around the end of September.

In the meantime, here's how to get ready:

• Review the full list of AEC requirements here: https://developer.atlassian.com/platform/marketplace/atlassian-enterprise-certified-program/#atlassian-enterprise-certified-program

• Audit your current security, privacy, accessibility, and compliance posture against the new criteria

• Get your trust center, documentation and evidence in order, so you're ready to submit as soon as the window opens

We'll share more details on the submission process and timeline ahead of the September opening. Stay tuned.

We’re reverting the change announced in CHANGE-3388 due to technical challenges with the data.

The correction that expanded refund maintenance periods to reflect the full term across all constituent invoice lines is being reverted and old behaviour is being restored prior to CHANGE-3388

• Refund amounts are unchanged. As it only updated the reported period dates; no monetary values are affected.

• The majority of refund rows, approximately 86%, were already displaying the correct period and will still be unimpacted.

• Review your reporting. If you use maintenance period dates from Marketplace reports to calculate period-based metrics, such as annualized revenue or daily run-rate, you may see changes for reverted refund rows.

• No action is required if you only use refund amounts in your reporting, because those values remain unchanged.

• We’ll provide a further update when the correction is ready to be reintroduced.

Deprecation Notice
We’ve updated Marketplace partner listing API responses so that emergency support contact details are returned only to callers who are authorised to manage partner details. Unauthorised or anonymous callers will no longer receive the emergency contact field field in listing support contact data.

This change aligns listing access with the current Marketplace roles and permissions model and is an important security measure. Integrations consuming listing support contact data should not assume that the ‘emergency contact' field is always present and should handle missing values accordingly.

We’ve corrected how the maintenance (service) period is displayed on refund (credit note) rows in Marketplace reporting. Refund amounts are not affected — only the period dates have been updated to accurately reflect the full term covered by the refund.

Previously, refund rows in Marketplace reports could show a shorter maintenance period than the refund actually covered. This happened because the reported period was derived from a single line of the original invoice, rather than the full set of lines that made up the refund.

Because invoices are often split across multiple lines — for example, a short pro-rata segment plus the main annual term — the displayed period could be significantly truncated.

Example: A full one-year refund might have appeared as covering only 13 days.

With this correction:

• The maintenance period on refund rows now reflects the full term covered by the refund, from the earliest start date to the latest end date across all constituent invoice lines.

• Period dates are now sourced from our finance system of record, which correctly handles multi-year billing terms.

• Refund amounts are unchanged. This update only corrects the reported period dates; no monetary values are affected.

• The majority of refund rows, approximately 86%, were already displaying the correct period and will not change.

• Review your reporting. If you use maintenance period dates from Marketplace reports to calculate period-based metrics, such as annualized revenue or daily run-rate, you may see changes for affected refund rows.

• No action is required if you only use refund amounts in your reporting, because those values remain unchanged.

Marketplace Partners can now provide Privacy and Security information specific to their Atlassian Government Cloud and Isolated Cloud app versions.

What’s changing
If your app is available in Atlassian Government Cloud or Isolated Cloud, you can now complete a dedicated Privacy and Security tab for each environment. This allows you to provide information that accurately reflects how your app handles data, permissions, hosting, and compliance within these specific environments.

To simplify the process, you can use the Copy from Cloud feature to pre-populate fields from your existing cloud app listing.

What you need to do

1. Log in to the Marketplace vendor console.

2. Navigate to the Privacy and Security tab for your Atlassian Government Cloud or Isolated Cloud app listing.

3. If applicable, use Copy from Cloud to jumpstart your entry

4. Review and complete all required fields, including data handling, operational controls, and support details.

5. Save and submit your changes.

For more information, see the following resources:

• https://developer.atlassian.com/platform/marketplace/publish-and-list-agc-apps/

• https://developer.atlassian.com/platform/marketplace/publish-and-list-ic-apps/

• https://developer.atlassian.com/platform/marketplace/security-privacy-tab/

Commerce Pricing APIs are currently unavailable.

Access to the Commerce Pricing APIs (both update and fetch operations) has been temporarily blocked while we carry out maintenance and validation work. Please do not use these APIs until further notice. Any requests made during this period will fail and return an API block message. We'll update this page and publish a changelog entry once the APIs are available again. Thank you for your patience.

https://developer.atlassian.com/platform/marketplace/marketplace-app-pricing-api/

We wanted to share a few updates on the trust front:

1. Atlassian Enterprise Certified — our new trust program

We've heard your feedback, and we're excited to announce that our new trust program is officially named Atlassian Enterprise Certified. This badge will recognize apps that meet rigorous enterprise standards for security, reliability, privacy, accessibility, and responsible AI — going beyond the baseline cloud standards required of all Marketplace apps. We plan to begin rolling out the program in Q3 CY2026 and phase out the Cloud Fortified Apps program by the end of the year.

1. New trust filters and verified indicators on the Marketplace

We're introducing enhancements that make it easier for customers to evaluate apps against their security, privacy, compliance, and procurement requirements.

New filters for faster shortlisting

Today, customers can filter Marketplace apps by Runs on Atlassian and Cloud Fortified. We're adding filters for:

• SOC 2

• ISO 27001

• Penetration testing

• Bug bounty

• Partner trust center

• Standard Legal Agreement

Verified indicators on the Privacy & Security tab

We're also adding a blue verified-tick icon to selected Privacy & Security tab fields, helping customers distinguish Atlassian-verified information from partner-attested responses at a glance.

At launch, verified indicators will appear on:

• App REST APIs

• Integration permissions with Atlassian apps

• Marketplace Security Bug Bounty Program participation

• Atlassian trust programs

We plan to expand verified indicators to more fields over time.

What you need to do

The new filters and verified indicators draw from information Atlassian already holds or that partners have already provided through existing Marketplace processes and Privacy & Security tab responses.

That said, to ensure your apps show well in trust-based evaluations, we recommend reviewing your Privacy & Security tab to confirm that your security, privacy, and compliance details are complete and up to date.

Quotes reporting is now available via Marketplace reporting APIs. We're introducing Quotes reporting to the Atlassian Marketplace reporting APIs. Partners can now programmatically retrieve their accepted quotes and export quotes data in bulk.

You can now access accepted-quote data for your apps through the reporting APIs:

• List accepted quotes — a paginated list of accepted quotes for your apps, with filtering by product, creation date, acceptance date, and entitlement period.

• Quote details — line-level detail for a single quote (including schedules and discounts), looked up by quoteId and/or quoteNumber.

• Async export — initiate a bulk export of accepted quotes, poll its status, and download the resulting CSV/JSON file (recommended for large datasets).

The following endpoints are available for Quotes reporting.

Vendor (v2):

• GET rest/2/vendors/{vendorId}/reporting/quotes(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/details(link)

• POST rest/2/vendors/{vendorId}/reporting/quotes/async/export(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/async/export/{exportId}/status(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/async/export/{exportId}(link)

Developer-space (v3):

• GET rest/3/reporting/developer-space/{developerId}/quotes(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/details(link)

• POST rest/3/reporting/developer-space/{developerId}/quotes/async/export(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/async/export/{exportId}/status(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/async/export/{exportId}(link)

Key query parameters (list endpoint): productId, startDate, endDate, acceptedStartDate, acceptedEndDate, entitlementStartDate, entitlementEndDate, limit, offset.

Quote details: provide quoteId and/or quoteNumber (optionally entitlementNumber).

Async export: filter by createdStartDate/createdEndDate, acceptedStartDate/acceptedEndDate, entitlementStartDate/entitlementEndDate, and choose accept=csv or accept=json. At least one complete date range pair is required.

GET rest/3/reporting/developer-space/{developerId}/quotes?startDate=2025-01-01&endDate=2025-01-31

No action is required to keep existing integrations working.

If you want to consume quotes data:

• Use the vendor endpoints (/rest/2/vendors/{vendorId}/...) for vendor-scoped access, or the developer-space endpoints (/rest/3/reporting/developer-space/{developerId}/...) for developer-scoped access across all your apps.

• For large result sets, prefer the async export flow (initiate → poll status → download) rather than the synchronous list endpoint.

We are updating the Marketplace Security Enforcement Policy to include new requirements for app lifecycle and maintenance. To ensure the Marketplace remains secure and trustworthy, all cloud apps must be actively maintained.

What's changing

To keep the Marketplace secure and trustworthy, every cloud app must be actively maintained. Apps that have not shipped a version update in more than 18 months will be considered unmaintained. These apps will be subject to review under the Cloud App Compliance program. While an unmaintained app is not automatically considered insecure, the 18-month mark serves as a mandatory lifecycle checkpoint. At this point, Atlassian will reassess whether the app continues to meet our security and compliance standards.

What you need to do

If your app is identified as unmaintained, you will be notified and given a defined window to either publish a compliant update or confirm your intent to maintain the listing.

Apps that are not brought back into compliance within that window may be hidden from the Marketplace and possibly subjected to actions detailed in our Marketplace Security Enforcement Policy

For apps with active installs, we will provide a transition period and notify affected customers before any removal. Limited, time-bound exceptions may be granted where justified.

For more details, see the Marketplace Security Enforcement Policy.

As part of the ongoing Marketplace platform re-architecture, all Marketplace V2 APIs will be permanently switched off on June 30, 2026.

What does this mean?

• Every endpoint under /rest/2/ is affected — this is a complete sunset of the V2 API surface, not a partial deprecation.

• No V2 APIs will continue to function beyond June 30, 2026.

• June 30 is a hard removal date — after this date, any V2 API calls will return errors.

Note: Some V2 endpoints were marked deprecated on DAC earlier and have already completed their 6-month deprecation window. All remaining V2 endpoints are completing their deprecation window on June 30, 2026. Regardless of whether a specific endpoint has an individual deprecation marker on DAC today, it falls under this blanket sunset and will stop working.

What should you do now?

1. Audit all your integrations for any calls to /rest/2/ endpoints

2. Identify the V3 equivalents using the The Atlassian Marketplace REST API

3. Complete your migration to V3 before June 30, 2026

4. Test your V3 integrations in production — V3 APIs are live and available today

As recently announced in Raising the bar on Marketplace cloud app security: together we are updating the Marketplace Security Bug Fix Policy to shorten vulnerability remediation timelines for Marketplace cloud apps. These changes ensure a higher security standard across our ecosystem.

What’s changing
The remediation Service Level Objectives (SLOs) for Marketplace cloud apps are being shortened. The timelines for Data Center apps remain unchanged.

Updated Cloud App SLOs (Enforceable September 1, 2026):

• Critical: 10 days

• High: 4 weeks

• Medium: 12 weeks

• Low: 25 weeks

Data Center App SLOs (Unchanged):

• Critical: 12 weeks

• High: 12 weeks

• Medium: 12 weeks

• Low: 25 weeks

Additionally, we have published the Marketplace Security Enforcement Policy, a consolidated source of truth for marketplace security compliance expectations, including vulnerability management, OAuth compliance, partner verification, bug bounty participation, and incident response.

What you need to do

• Review the new timelines: Ensure your internal processes are updated to meet the new cloud app SLOs by September 1, 2026.

• Check your tickets: We have corrected an issue where some AMS Data Center tickets incorrectly showed cloud remediation dates. If you believe a ticket still has an incorrect date, please raise an ECOHELP ticket.

• Watch the policy page: The Marketplace Security Enforcement Policy is a living document, we recommend "watching" the page for future updates.

In reference to https://developer.atlassian.com/platform/forge/changelog/#CHANGE-2876, we introduced a new state—Legacy free licensing—for:

Apps past their subscription or trial end have moved to a legacy “free” licensing state. These inactive installations remain unaffected by the new uninstall flow until an admin initiates uninstall.

For a time, these licenses appeared as FREE ACTIVE licenses on the Marketplace Reporting portal and API responses. (See https://jira.atlassian.com/browse/MP-556 )

We are adding a new license type, Legacy Free to signify those licenses, to API endpoints and the Reporting UI. It will be available from May 20, 2026.

For example, when viewing a specific app’s license:

• Licenses API

  • Field - licenseType

  • Query Parameter - licenseType: legacy_free

  • GET /vendors/{vendorId}/reporting/licenses https://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-licenses-get

  • GET /vendors/{vendorId}/reporting/licenses/export https://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-licenses-export-get

  • POST /vendors/{vendorId}/reporting/licenses/async/exporthttps://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-licenses-async-export-post

• Transactions API

  • Field - purchaseDetails.licenseType

  • GET /vendors/{vendorId}/reporting/sales/transactions https://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-sales-transactions-get

  • GET /vendors/{vendorId}/reporting/sales/transactions/exporthttps://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-sales-transactions-export-get

  • POST /vendors/{vendorId}/reporting/sales/transactions/async/exporthttps://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-sales-transactions-async-export-post

• Licenses in Marketplace Reporting Portal

  • Filter - License Type: Legacy Free

  • License Type will be shown as Legacy Free

  •  

     

We are transitioning the Atlassian Marketplace rating scale from 1–4 stars to 1–5 stars. This change applies to all listed Marketplace apps — free and paid — across the Marketplace website and embedded experiences in Jira and Confluence.

Moving to a 5-star scale aligns the Atlassian Marketplace with industry-standard rating systems, giving customers a more intuitive, granular way to evaluate and compare apps.

What’s changing

• Your app’s overall aggregate rating will now be displayed on a 5-star scale.

• A linear conversion maps existing ratings to the new scale:

• Historical reviews will keep their original star ratings on the reviews tab. For example, a review originally submitted as 3/4 stars remains displayed as 3/4. Only the aggregate app rating is shown on the new 5-star scale.

• New reviews submitted after today’s date May 20, 2026 will use the 5-star scale by default.

• Customers can edit previous reviews. Users who previously rated an app will see a tooltip when editing their review explaining the scale conversion and allowing them to update their rating if they choose. This tooltip only appears when a customer actively edits a review — it won’t surface unprompted.

• Data Center apps: Marketplace web surfaces will display ratings on the 5-star scale for Data Center apps. The Universal Plugin Manager (UPM) within Data Center products will continue to show ratings on the 1–4 scale.

API changes

The averageStars and stars fields in Marketplace public APIs now reflect the 5-star scale. A new boolean field, transitionedToFiveStarRating, has been added to individual review objects to indicate which scale was used.

Affected endpoints:

• rest/2/addons

  rest/2/addons/vendor/{vendorId}

  rest/2/addons/{addonKey}

  • reviews.averageStars → 1–5 scale

• rest/2/addons/{addonKey}/reviews

  rest/2/addons/{addonKey}/reviews/id/{reviewId}

  rest/2/addons/{addonKey}/reviews/mine

  • stars → 1–5 scale

  • transitionedToFiveStarRating → true if the review was submitted on the 5-star scale; false if it originated on the 4-star scale

• rest/3/products/{productId}/reviews

  rest/3/products/{productId}/reviews/{reviewId}

  • Same behavior as above for stars and transitionedToFiveStarRating

Sample API response:

Action required

For most partners, no action is required — Atlassian handles the migration automatically.

However, if you consume rating data via Marketplace APIs, you should:

1. Update integrations to expect stars and averageStars on a 1–5 scale.

2. Incorporate the transitionedToFiveStarRating flag if your systems distinguish between legacy and new reviews.

Action needed by June 30, 2026: If you have an Atlassian Bug Bounty program, it must be made public to maintain your program status and Marketplace badges.

The good news: you don't need to be fully public by then — you just need to submit an ECOHELP ticket to start the process. Submitting by June 30th protects your program.

Here's what to do:

1. Review the full requirements here

2. Raise an ECOHELP ticket here

Please note:

• Tickets not submitted by June 30th will be automatically closed.

• Submitted tickets that are inactive for 14 days will also be closed.

• Either may result in your program being paused and the removal of associated Marketplace badges.

We're excited to announce that the downloadable product catalog CSV, available via the Marketplace V3 Product Catalog Snapshot APIs, has been enhanced with Total Install Counts.

This new field provides the aggregate number of installations for each app. For more details see: V3-Product Catalog Snapshot API