We're excited to announce the launch of Atlassian Enterprise Certified (AEC), our new trust program for Marketplace apps.

AEC provides an Atlassian-verified signal that an app has met common enterprise needs for compliance, security, reliability, privacy, accessibility, and responsible AI use. It is designed to help customers confidently identify and select apps that align with their enterprise procurement needs.

Read more about AEC requirements: https://developer.atlassian.com/platform/marketplace/atlassian-enterprise-certified-program/

How to apply for AEC
AEC is now open to eligible Forge cloud apps. Partners can review the AEC requirements, prepare their documentation and validation evidence, and apply to join the programme.

Read more about how to apply for AEC: https://developer.atlassian.com/platform/marketplace/apply-for-atlassian-enterprise-certified/

We're adding v2 versions of two Marketplace search reports: top search keywords and zero search results keywords.

Beginning June 12, 2026, non-essential cookies and tracking technologies were disabled by default for Marketplace users from regulated regions, and users there must now opt in to cookies before analytics data is collected. Because these reports were built from browser analytics, reported search volumes dropped for affected traffic.

The v2 reports count searches recorded by Marketplace search itself, so they include every search regardless of a user’s cookie choices.

Two new endpoints are available, each with a matching /export variant:

GET /rest/3/reporting/developer-space/{developerId}/search-keywords-v2/source/{sourceKey}
GET /rest/3/reporting/developer-space/{developerId}/zero-search-results-keywords-v2/source/{sourceKey}

Please note that the updated counts are only available post 25th Sept 2026. Earlier dates would still have data only for users who consented for tracking cookies.

• The existing endpoints are unchanged and remain available for now but will be removed soon.

• Query parameters, authentication, and the response format are identical between the two versions, so moving to v2 only requires changing search-keywords to search-keywords-v2, or zero-search-results-keywords to zero-search-results-keywords-v2, in the path.

• Source coverage is also unchanged. The search keywords report supports marketplace and embedded-marketplace, and the zero search results report supports marketplace only.

• Review your reporting. If you track search counts over time, expect a step change when you switch.

• Historical data is limited. v2 data is available from 25th Sept 2026. Earlier dates would still have data only for users who consented for tracking cookies.

🛠️ Scheduled maintenance window from September 25 @ 5PM PST to Monday, September 28 @ 10AM, AEST

Our support portal is moving to a new home. New ticket submissions and ticket access including comments via email will be unavailable during this window. Starting September 28, submit all requests at Atlassian Support and update your bookmarks. Learn what's changing.

Marketplace partner reports are currently missing invoice data for September 15–17, 2026 due to a data ingestion delay. The underlying issue has been resolved, and data is actively backfilling.

Starting September 15, 2026 at approximately 12:00 PM IST (06:30 UTC), a data ingestion service encountered a memory-related issue, resulting in recurring job restarts. This created a processing backlog of approximately two days, temporarily preventing invoice events from syncing to Marketplace partner reporting.

Invoice and transaction records in Marketplace partner reporting are incomplete for September 15-17, 2026. This impacts:

• Vendor report UI: Daily/monthly sales and revenue summaries.

• Transaction exports: Downloadable CSV/transaction detail exports.

• Reporting APIs: Responses reflecting invoice data within this date window.

• Data integrity: No data has been lost. All transactions, billing records, and refund events remain queued upstream and are processing.

• Historical data: Reports prior to September 15, 2026 are unaffected.

• Other services: All other Marketplace APIs, listing pages, and developer surfaces are operating normally.

• No immediate action is required. Backfilling occurs automatically.

• Once recovery is complete, we recommend re-exporting or re-fetching reports and API data for September 15–17, 2026 to ensure your local records reflect finalized figures.

We will post a follow-up update here once the backfill is complete and all reporting data is fully verified. We apologize for the inconvenience and appreciate your patience.

We are stopping submissions for the Cloud Fortified App (CFA) program. Starting September 1st, we will no longer accept new CFA submissions.

CFA annual reviews will also no longer be required from September 1st. The CFA program will be retired on 31st December, 2026.

The good news: the Atlassian Enterprise Certified (AEC) program is coming, and submissions will open around the end of September.

In the meantime, here's how to get ready:

• Review the full list of AEC requirements here: https://developer.atlassian.com/platform/marketplace/atlassian-enterprise-certified-program/#atlassian-enterprise-certified-program

• Audit your current security, privacy, accessibility, and compliance posture against the new criteria

• Get your trust center, documentation and evidence in order, so you're ready to submit as soon as the window opens

We'll share more details on the submission process and timeline ahead of the September opening. Stay tuned.

We’re reverting the change announced in CHANGE-3388 due to technical challenges with the data.

The correction that expanded refund maintenance periods to reflect the full term across all constituent invoice lines is being reverted and old behaviour is being restored prior to CHANGE-3388

• Refund amounts are unchanged. As it only updated the reported period dates; no monetary values are affected.

• The majority of refund rows, approximately 86%, were already displaying the correct period and will still be unimpacted.

• Review your reporting. If you use maintenance period dates from Marketplace reports to calculate period-based metrics, such as annualized revenue or daily run-rate, you may see changes for reverted refund rows.

• No action is required if you only use refund amounts in your reporting, because those values remain unchanged.

• We’ll provide a further update when the correction is ready to be reintroduced.

Deprecation Notice
We’ve updated Marketplace partner listing API responses so that emergency support contact details are returned only to callers who are authorised to manage partner details. Unauthorised or anonymous callers will no longer receive the emergency contact field field in listing support contact data.

This change aligns listing access with the current Marketplace roles and permissions model and is an important security measure. Integrations consuming listing support contact data should not assume that the ‘emergency contact' field is always present and should handle missing values accordingly.

We’ve corrected how the maintenance (service) period is displayed on refund (credit note) rows in Marketplace reporting. Refund amounts are not affected — only the period dates have been updated to accurately reflect the full term covered by the refund.

Previously, refund rows in Marketplace reports could show a shorter maintenance period than the refund actually covered. This happened because the reported period was derived from a single line of the original invoice, rather than the full set of lines that made up the refund.

Because invoices are often split across multiple lines — for example, a short pro-rata segment plus the main annual term — the displayed period could be significantly truncated.

Example: A full one-year refund might have appeared as covering only 13 days.

With this correction:

• The maintenance period on refund rows now reflects the full term covered by the refund, from the earliest start date to the latest end date across all constituent invoice lines.

• Period dates are now sourced from our finance system of record, which correctly handles multi-year billing terms.

• Refund amounts are unchanged. This update only corrects the reported period dates; no monetary values are affected.

• The majority of refund rows, approximately 86%, were already displaying the correct period and will not change.

• Review your reporting. If you use maintenance period dates from Marketplace reports to calculate period-based metrics, such as annualized revenue or daily run-rate, you may see changes for affected refund rows.

• No action is required if you only use refund amounts in your reporting, because those values remain unchanged.

Marketplace Partners can now provide Privacy and Security information specific to their Atlassian Government Cloud and Isolated Cloud app versions.

What’s changing
If your app is available in Atlassian Government Cloud or Isolated Cloud, you can now complete a dedicated Privacy and Security tab for each environment. This allows you to provide information that accurately reflects how your app handles data, permissions, hosting, and compliance within these specific environments.

To simplify the process, you can use the Copy from Cloud feature to pre-populate fields from your existing cloud app listing.

What you need to do

1. Log in to the Marketplace vendor console.

2. Navigate to the Privacy and Security tab for your Atlassian Government Cloud or Isolated Cloud app listing.

3. If applicable, use Copy from Cloud to jumpstart your entry

4. Review and complete all required fields, including data handling, operational controls, and support details.

5. Save and submit your changes.

For more information, see the following resources:

• https://developer.atlassian.com/platform/marketplace/publish-and-list-agc-apps/

• https://developer.atlassian.com/platform/marketplace/publish-and-list-ic-apps/

• https://developer.atlassian.com/platform/marketplace/security-privacy-tab/

Commerce Pricing APIs are currently unavailable.

Access to the Commerce Pricing APIs (both update and fetch operations) has been temporarily blocked while we carry out maintenance and validation work. Please do not use these APIs until further notice. Any requests made during this period will fail and return an API block message. We'll update this page and publish a changelog entry once the APIs are available again. Thank you for your patience.

https://developer.atlassian.com/platform/marketplace/marketplace-app-pricing-api/

We wanted to share a few updates on the trust front:

1. Atlassian Enterprise Certified — our new trust program

We've heard your feedback, and we're excited to announce that our new trust program is officially named Atlassian Enterprise Certified. This badge will recognize apps that meet rigorous enterprise standards for security, reliability, privacy, accessibility, and responsible AI — going beyond the baseline cloud standards required of all Marketplace apps. We plan to begin rolling out the program in Q3 CY2026 and phase out the Cloud Fortified Apps program by the end of the year.

1. New trust filters and verified indicators on the Marketplace

We're introducing enhancements that make it easier for customers to evaluate apps against their security, privacy, compliance, and procurement requirements.

New filters for faster shortlisting

Today, customers can filter Marketplace apps by Runs on Atlassian and Cloud Fortified. We're adding filters for:

• SOC 2

• ISO 27001

• Penetration testing

• Bug bounty

• Partner trust center

• Standard Legal Agreement

Verified indicators on the Privacy & Security tab

We're also adding a blue verified-tick icon to selected Privacy & Security tab fields, helping customers distinguish Atlassian-verified information from partner-attested responses at a glance.

At launch, verified indicators will appear on:

• App REST APIs

• Integration permissions with Atlassian apps

• Marketplace Security Bug Bounty Program participation

• Atlassian trust programs

We plan to expand verified indicators to more fields over time.

What you need to do

The new filters and verified indicators draw from information Atlassian already holds or that partners have already provided through existing Marketplace processes and Privacy & Security tab responses.

That said, to ensure your apps show well in trust-based evaluations, we recommend reviewing your Privacy & Security tab to confirm that your security, privacy, and compliance details are complete and up to date.

Quotes reporting is now available via Marketplace reporting APIs. We're introducing Quotes reporting to the Atlassian Marketplace reporting APIs. Partners can now programmatically retrieve their accepted quotes and export quotes data in bulk.

You can now access accepted-quote data for your apps through the reporting APIs:

• List accepted quotes — a paginated list of accepted quotes for your apps, with filtering by product, creation date, acceptance date, and entitlement period.

• Quote details — line-level detail for a single quote (including schedules and discounts), looked up by quoteId and/or quoteNumber.

• Async export — initiate a bulk export of accepted quotes, poll its status, and download the resulting CSV/JSON file (recommended for large datasets).

The following endpoints are available for Quotes reporting.

Vendor (v2):

• GET rest/2/vendors/{vendorId}/reporting/quotes(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/details(link)

• POST rest/2/vendors/{vendorId}/reporting/quotes/async/export(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/async/export/{exportId}/status(link)

• GET rest/2/vendors/{vendorId}/reporting/quotes/async/export/{exportId}(link)

Developer-space (v3):

• GET rest/3/reporting/developer-space/{developerId}/quotes(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/details(link)

• POST rest/3/reporting/developer-space/{developerId}/quotes/async/export(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/async/export/{exportId}/status(link)

• GET rest/3/reporting/developer-space/{developerId}/quotes/async/export/{exportId}(link)

Key query parameters (list endpoint): productId, startDate, endDate, acceptedStartDate, acceptedEndDate, entitlementStartDate, entitlementEndDate, limit, offset.

Quote details: provide quoteId and/or quoteNumber (optionally entitlementNumber).

Async export: filter by createdStartDate/createdEndDate, acceptedStartDate/acceptedEndDate, entitlementStartDate/entitlementEndDate, and choose accept=csv or accept=json. At least one complete date range pair is required.

GET rest/3/reporting/developer-space/{developerId}/quotes?startDate=2025-01-01&endDate=2025-01-31

No action is required to keep existing integrations working.

If you want to consume quotes data:

• Use the vendor endpoints (/rest/2/vendors/{vendorId}/...) for vendor-scoped access, or the developer-space endpoints (/rest/3/reporting/developer-space/{developerId}/...) for developer-scoped access across all your apps.

• For large result sets, prefer the async export flow (initiate → poll status → download) rather than the synchronous list endpoint.

We are updating the Marketplace Security Enforcement Policy to include new requirements for app lifecycle and maintenance. To ensure the Marketplace remains secure and trustworthy, all cloud apps must be actively maintained.

What's changing

To keep the Marketplace secure and trustworthy, every cloud app must be actively maintained. Apps that have not shipped a version update in more than 18 months will be considered unmaintained. These apps will be subject to review under the Cloud App Compliance program. While an unmaintained app is not automatically considered insecure, the 18-month mark serves as a mandatory lifecycle checkpoint. At this point, Atlassian will reassess whether the app continues to meet our security and compliance standards.

What you need to do

If your app is identified as unmaintained, you will be notified and given a defined window to either publish a compliant update or confirm your intent to maintain the listing.

Apps that are not brought back into compliance within that window may be hidden from the Marketplace and possibly subjected to actions detailed in our Marketplace Security Enforcement Policy

For apps with active installs, we will provide a transition period and notify affected customers before any removal. Limited, time-bound exceptions may be granted where justified.

For more details, see the Marketplace Security Enforcement Policy.

As part of the ongoing Marketplace platform re-architecture, all Marketplace V2 APIs will be permanently switched off on June 30, 2026.

What does this mean?

• Every endpoint under /rest/2/ is affected — this is a complete sunset of the V2 API surface, not a partial deprecation.

• No V2 APIs will continue to function beyond June 30, 2026.

• June 30 is a hard removal date — after this date, any V2 API calls will return errors.

Note: Some V2 endpoints were marked deprecated on DAC earlier and have already completed their 6-month deprecation window. All remaining V2 endpoints are completing their deprecation window on June 30, 2026. Regardless of whether a specific endpoint has an individual deprecation marker on DAC today, it falls under this blanket sunset and will stop working.

What should you do now?

1. Audit all your integrations for any calls to /rest/2/ endpoints

2. Identify the V3 equivalents using the The Atlassian Marketplace REST API

3. Complete your migration to V3 before June 30, 2026

4. Test your V3 integrations in production — V3 APIs are live and available today

As recently announced in Raising the bar on Marketplace cloud app security: together we are updating the Marketplace Security Bug Fix Policy to shorten vulnerability remediation timelines for Marketplace cloud apps. These changes ensure a higher security standard across our ecosystem.

What’s changing
The remediation Service Level Objectives (SLOs) for Marketplace cloud apps are being shortened. The timelines for Data Center apps remain unchanged.

Updated Cloud App SLOs (Enforceable September 1, 2026):

• Critical: 10 days

• High: 4 weeks

• Medium: 12 weeks

• Low: 25 weeks

Data Center App SLOs (Unchanged):

• Critical: 12 weeks

• High: 12 weeks

• Medium: 12 weeks

• Low: 25 weeks

Additionally, we have published the Marketplace Security Enforcement Policy, a consolidated source of truth for marketplace security compliance expectations, including vulnerability management, OAuth compliance, partner verification, bug bounty participation, and incident response.

What you need to do

• Review the new timelines: Ensure your internal processes are updated to meet the new cloud app SLOs by September 1, 2026.

• Check your tickets: We have corrected an issue where some AMS Data Center tickets incorrectly showed cloud remediation dates. If you believe a ticket still has an incorrect date, please raise an ECOHELP ticket.

• Watch the policy page: The Marketplace Security Enforcement Policy is a living document, we recommend "watching" the page for future updates.