Changelog

Marketplace Partners can now provide Privacy and Security information specific to their Atlassian Government Cloud and Isolated Cloud app versions.

What’s changing
If your app is available in Atlassian Government Cloud or Isolated Cloud, you can now complete a dedicated Privacy and Security tab for each environment. This allows you to provide information that accurately reflects how your app handles data, permissions, hosting, and compliance within these specific environments.

To simplify the process, you can use the Copy from Cloud feature to pre-populate fields from your existing cloud app listing.

What you need to do

1. Log in to the Marketplace vendor console.

2. Navigate to the Privacy and Security tab for your Atlassian Government Cloud or Isolated Cloud app listing.

3. If applicable, use Copy from Cloud to jumpstart your entry

4. Review and complete all required fields, including data handling, operational controls, and support details.

5. Save and submit your changes.

For more information, see the following resources:

• https://developer.atlassian.com/platform/marketplace/publish-and-list-agc-apps/

• https://developer.atlassian.com/platform/marketplace/publish-and-list-ic-apps/

• https://developer.atlassian.com/platform/marketplace/security-privacy-tab/

Commerce Pricing APIs are currently unavailable.

Access to the Commerce Pricing APIs (both update and fetch operations) has been temporarily blocked while we carry out maintenance and validation work. Please do not use these APIs until further notice. Any requests made during this period will fail and return an API block message. We'll update this page and publish a changelog entry once the APIs are available again. Thank you for your patience.

https://developer.atlassian.com/platform/marketplace/marketplace-app-pricing-api/

We wanted to share a few updates on the trust front:

1. Atlassian Enterprise Certified — our new trust program

We've heard your feedback, and we're excited to announce that our new trust program is officially named Atlassian Enterprise Certified. This badge will recognize apps that meet rigorous enterprise standards for security, reliability, privacy, accessibility, and responsible AI — going beyond the baseline cloud standards required of all Marketplace apps. We plan to begin rolling out the program in Q3 CY2026 and phase out the Cloud Fortified Apps program by the end of the year.

1. New trust filters and verified indicators on the Marketplace

We're introducing enhancements that make it easier for customers to evaluate apps against their security, privacy, compliance, and procurement requirements.

New filters for faster shortlisting

Today, customers can filter Marketplace apps by Runs on Atlassian and Cloud Fortified. We're adding filters for:

• SOC 2

• ISO 27001

• Penetration testing

• Bug bounty

• Partner trust center

• Standard Legal Agreement

Verified indicators on the Privacy & Security tab

We're also adding a blue verified-tick icon to selected Privacy & Security tab fields, helping customers distinguish Atlassian-verified information from partner-attested responses at a glance.

At launch, verified indicators will appear on:

• App REST APIs

• Integration permissions with Atlassian apps

• Marketplace Security Bug Bounty Program participation

• Atlassian trust programs

We plan to expand verified indicators to more fields over time.

What you need to do

The new filters and verified indicators draw from information Atlassian already holds or that partners have already provided through existing Marketplace processes and Privacy & Security tab responses.

That said, to ensure your apps show well in trust-based evaluations, we recommend reviewing your Privacy & Security tab to confirm that your security, privacy, and compliance details are complete and up to date.

Quotes reporting is now available via Marketplace reporting APIs. We're introducing Quotes reporting to the Atlassian Marketplace reporting APIs. Partners can now programmatically retrieve their accepted quotes and export quotes data in bulk.

You can now access accepted-quote data for your apps through the reporting APIs:

• List accepted quotes — a paginated list of accepted quotes for your apps, with filtering by product, creation date, acceptance date, and entitlement period.

• Quote details — line-level detail for a single quote (including schedules and discounts), looked up by quoteId and/or quoteNumber.

• Async export — initiate a bulk export of accepted quotes, poll its status, and download the resulting CSV/JSON file (recommended for large datasets).

The following endpoints are available for Quotes reporting.

Vendor (v2):

• GET rest/2/vendors/{vendorId}/reporting/quotes(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/details(link)

• POST rest/2/vendors/{vendorId}/reporting/quotes/async/export(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/async/export/{exportId}/status(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/async/export/{exportId}(link)

Developer-space (v3):

• GET rest/3/reporting/developer-space/{developerId}/quotes(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/details(link)

• POST rest/3/reporting/developer-space/{developerId}/quotes/async/export(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/async/export/{exportId}/status(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/async/export/{exportId}(link)

Key query parameters (list endpoint): productId, startDate, endDate, acceptedStartDate, acceptedEndDate, entitlementStartDate, entitlementEndDate, limit, offset.

Quote details: provide quoteId and/or quoteNumber (optionally entitlementNumber).

Async export: filter by createdStartDate/createdEndDate, acceptedStartDate/acceptedEndDate, entitlementStartDate/entitlementEndDate, and choose accept=csv or accept=json. At least one complete date range pair is required.

GET rest/3/reporting/developer-space/{developerId}/quotes?startDate=2025-01-01&endDate=2025-01-31

No action is required to keep existing integrations working.

If you want to consume quotes data:

• Use the vendor endpoints (/rest/2/vendors/{vendorId}/...) for vendor-scoped access, or the developer-space endpoints (/rest/3/reporting/developer-space/{developerId}/...) for developer-scoped access across all your apps.

• For large result sets, prefer the async export flow (initiate → poll status → download) rather than the synchronous list endpoint.

We are updating the Marketplace Security Enforcement Policy to include new requirements for app lifecycle and maintenance. To ensure the Marketplace remains secure and trustworthy, all cloud apps must be actively maintained.

What's changing

To keep the Marketplace secure and trustworthy, every cloud app must be actively maintained. Apps that have not shipped a version update in more than 18 months will be considered unmaintained. These apps will be subject to review under the Cloud App Compliance program. While an unmaintained app is not automatically considered insecure, the 18-month mark serves as a mandatory lifecycle checkpoint. At this point, Atlassian will reassess whether the app continues to meet our security and compliance standards.

What you need to do

If your app is identified as unmaintained, you will be notified and given a defined window to either publish a compliant update or confirm your intent to maintain the listing.

Apps that are not brought back into compliance within that window may be hidden from the Marketplace and possibly subjected to actions detailed in our Marketplace Security Enforcement Policy

For apps with active installs, we will provide a transition period and notify affected customers before any removal. Limited, time-bound exceptions may be granted where justified.

For more details, see the Marketplace Security Enforcement Policy.

As part of the ongoing Marketplace platform re-architecture, all Marketplace V2 APIs will be permanently switched off on June 30, 2026.

What does this mean?

• Every endpoint under /rest/2/ is affected — this is a complete sunset of the V2 API surface, not a partial deprecation.

• No V2 APIs will continue to function beyond June 30, 2026.

• June 30 is a hard removal date — after this date, any V2 API calls will return errors.

Note: Some V2 endpoints were marked deprecated on DAC earlier and have already completed their 6-month deprecation window. All remaining V2 endpoints are completing their deprecation window on June 30, 2026. Regardless of whether a specific endpoint has an individual deprecation marker on DAC today, it falls under this blanket sunset and will stop working.

What should you do now?

1. Audit all your integrations for any calls to /rest/2/ endpoints

2. Identify the V3 equivalents using the The Atlassian Marketplace REST API

3. Complete your migration to V3 before June 30, 2026

4. Test your V3 integrations in production — V3 APIs are live and available today

As recently announced in Raising the bar on Marketplace cloud app security: together we are updating the Marketplace Security Bug Fix Policy to shorten vulnerability remediation timelines for Marketplace cloud apps. These changes ensure a higher security standard across our ecosystem.

What’s changing
The remediation Service Level Objectives (SLOs) for Marketplace cloud apps are being shortened. The timelines for Data Center apps remain unchanged.

Updated Cloud App SLOs (Enforceable September 1, 2026):

• Critical: 10 days

• High: 4 weeks

• Medium: 12 weeks

• Low: 25 weeks

Data Center App SLOs (Unchanged):

• Critical: 12 weeks

• High: 12 weeks

• Medium: 12 weeks

• Low: 25 weeks

Additionally, we have published the Marketplace Security Enforcement Policy, a consolidated source of truth for marketplace security compliance expectations, including vulnerability management, OAuth compliance, partner verification, bug bounty participation, and incident response.

What you need to do

• Review the new timelines: Ensure your internal processes are updated to meet the new cloud app SLOs by September 1, 2026.

• Check your tickets: We have corrected an issue where some AMS Data Center tickets incorrectly showed cloud remediation dates. If you believe a ticket still has an incorrect date, please raise an ECOHELP ticket.

• Watch the policy page: The Marketplace Security Enforcement Policy is a living document, we recommend "watching" the page for future updates.

In reference to https://developer.atlassian.com/platform/forge/changelog/#CHANGE-2876, we introduced a new state—Legacy free licensing—for:

Apps past their subscription or trial end have moved to a legacy “free” licensing state. These inactive installations remain unaffected by the new uninstall flow until an admin initiates uninstall.

For a time, these licenses appeared as FREE ACTIVE licenses on the Marketplace Reporting portal and API responses. (See https://jira.atlassian.com/browse/MP-556 )

We are adding a new license type, Legacy Free to signify those licenses, to API endpoints and the Reporting UI. It will be available from May 20, 2026.

For example, when viewing a specific app’s license:

• Licenses API

  • Field - licenseType

  • Query Parameter - licenseType: legacy_free

  • GET /vendors/{vendorId}/reporting/licenses https://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-licenses-get

  • GET /vendors/{vendorId}/reporting/licenses/export https://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-licenses-export-get

  • POST /vendors/{vendorId}/reporting/licenses/async/exporthttps://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-licenses-async-export-post

• Transactions API

  • Field - purchaseDetails.licenseType

  • GET /vendors/{vendorId}/reporting/sales/transactions https://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-sales-transactions-get

  • GET /vendors/{vendorId}/reporting/sales/transactions/exporthttps://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-sales-transactions-export-get

  • POST /vendors/{vendorId}/reporting/sales/transactions/async/exporthttps://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-reporting-sales-transactions-async-export-post

• Licenses in Marketplace Reporting Portal

  • Filter - License Type: Legacy Free

  • License Type will be shown as Legacy Free

  •  

     

We are transitioning the Atlassian Marketplace rating scale from 1–4 stars to 1–5 stars. This change applies to all listed Marketplace apps — free and paid — across the Marketplace website and embedded experiences in Jira and Confluence.

Moving to a 5-star scale aligns the Atlassian Marketplace with industry-standard rating systems, giving customers a more intuitive, granular way to evaluate and compare apps.

What’s changing

• Your app’s overall aggregate rating will now be displayed on a 5-star scale.

• A linear conversion maps existing ratings to the new scale:

• Historical reviews will keep their original star ratings on the reviews tab. For example, a review originally submitted as 3/4 stars remains displayed as 3/4. Only the aggregate app rating is shown on the new 5-star scale.

• New reviews submitted after today’s date May 20, 2026 will use the 5-star scale by default.

• Customers can edit previous reviews. Users who previously rated an app will see a tooltip when editing their review explaining the scale conversion and allowing them to update their rating if they choose. This tooltip only appears when a customer actively edits a review — it won’t surface unprompted.

• Data Center apps: Marketplace web surfaces will display ratings on the 5-star scale for Data Center apps. The Universal Plugin Manager (UPM) within Data Center products will continue to show ratings on the 1–4 scale.

API changes

The averageStars and stars fields in Marketplace public APIs now reflect the 5-star scale. A new boolean field, transitionedToFiveStarRating, has been added to individual review objects to indicate which scale was used.

Affected endpoints:

• rest/2/addons

  rest/2/addons/vendor/{vendorId}

  rest/2/addons/{addonKey}

  • reviews.averageStars → 1–5 scale

• rest/2/addons/{addonKey}/reviews

  rest/2/addons/{addonKey}/reviews/id/{reviewId}

  rest/2/addons/{addonKey}/reviews/mine

  • stars → 1–5 scale

  • transitionedToFiveStarRating → true if the review was submitted on the 5-star scale; false if it originated on the 4-star scale

• rest/3/products/{productId}/reviews

  rest/3/products/{productId}/reviews/{reviewId}

  • Same behavior as above for stars and transitionedToFiveStarRating

Sample API response:

Action required

For most partners, no action is required — Atlassian handles the migration automatically.

However, if you consume rating data via Marketplace APIs, you should:

1. Update integrations to expect stars and averageStars on a 1–5 scale.

2. Incorporate the transitionedToFiveStarRating flag if your systems distinguish between legacy and new reviews.

Action needed by June 30, 2026: If you have an Atlassian Bug Bounty program, it must be made public to maintain your program status and Marketplace badges.

The good news: you don't need to be fully public by then — you just need to submit an ECOHELP ticket to start the process. Submitting by June 30th protects your program.

Here's what to do:

1. Review the full requirements here

2. Raise an ECOHELP ticket here

Please note:

• Tickets not submitted by June 30th will be automatically closed.

• Submitted tickets that are inactive for 14 days will also be closed.

• Either may result in your program being paused and the removal of associated Marketplace badges.

We're excited to announce that the downloadable product catalog CSV, available via the Marketplace V3 Product Catalog Snapshot APIs, has been enhanced with Total Install Counts.

This new field provides the aggregate number of installations for each app. For more details see: V3-Product Catalog Snapshot API

We are enhancing the partner experience in completing the Marketplace App onboarding security requirements by consolidating all security questionnaires, including both partner and app-specific questions, into a single Forge app. This app is accessible via your Marketplace App Approval requests. You can view your up-to-date questionnaire responses within your existing and future app approval requests. We are also making it easy for you to review the security scanner findings (vulnerabilities) and designate a point of contact for app-specific questions.

Please refer to the QRG for more details: https://atlassianpartners.atlassian.net/wiki/spaces/resources/pages/1723105354/Completing+Marketplace+App+Onboarding+Security+Requirements+-+Quick+Reference+Guide

Important Reminder: As part of the ongoing Marketplace platform re-architecture, Marketplace V2 APIs are scheduled for deprecation on June 30, 2026.

You can find the full context, including deprecation timelines, replacement V3 endpoints, and partner enablement details in the Quick Reference Guide here.

A new RFC is ready for review at: https://community.developer.atlassian.com/t/rfc-133-evolving-the-marketplace-trust-program-follow-up-to-rfc-124-trust-program-requirement-updates-and-validation-steps/100401

When a Marketplace app supports Forge Multiple-App Compatibility, its installation can generate multiple installation links — one for each required and additional compatibility. Beginning Apr 23, 2026, we will consolidate these into a single, unified active installation count: one required link and its associated compatible links will be counted as one installation.

This ensures partners see accurate active install metrics that reflect true unique installations, rather than a count per individual link.

Here's how the installation count will change when viewing a specific app installed on a site:

Note: Existing apps that already support multiple‑app compatibility may experience a slight decrease in their install counts as a result.

• Fetch Metric time series API
  POST /vendors/{vendorId}/partner-metrics with DISTRIBUTIONS as the metricSets
  https://developer.atlassian.com/platform/marketplace/rest/v2/api-group-reporting/#api-vendors-vendorid-partner-metrics-post

• Active Installations tab in Manage App page

• Install Counts in App Listing and App Tile