Installation callback success rate

An installation callback is an HTTP POST request sent from the Atlassian infrastructure to an app-defined endpoint under the base URL. The installation callback - the installed lifecycle event - is crucial to security for Connect apps.

Event definitions

Good event: an installation callback that returns an HTTP response with a 200 OK or 204 No Content status code.

Bad event: an installation callback that returns an HTTP response with any other status code, or that does not produce an HTTP response due to a DNS resolution error, SSL error, HTTP request timeout or other reason within the app's control.

Events excluded from measurements:

• Installation callback failures due to an Atlassian issue.
• Installation callback failures on Cloud instances that should be excluded from SLI measurements as you provided in your app's program application.
• Installation callbacks sent by Ecoscanner.

Target SLO

Cloud Fortified apps must maintain an installation callback success rate of at least 99% over 28 days.

To provide early warning of potential future SLO breaches, we'll notify you if the installation callback success rate has been less than 99.9% for the past 24 hours. App installations are infrequent, so we use a wide time window for this alert condition to avoid noise.

Best practices

Verify that the comprehensive contract of the installation callback has been properly implemented in your app, and covers all the following scenarios:

• Customer action: initial installation, manual upgrade.
• Partner action: automatic upgrade to a new patch version.
• Site admin action: site rename, site import.
• Atlassian action: shared secret rotation.

We recommend that your app asynchronously performs any required initialization of an installation, to avoid failures or timeouts.

Pay specific attention to installation callback failures, since a failure to automatically upgrade the app to a new version will be retried periodically, and may have significant impact on this metric.

Known issues

• Metrics are collected from apps not installed from Marketplace (CONFCLOUD-74737, JRACLOUD-79975). As a workaround, we recommend that you don’t use the same app key for development and testing that is used in your app’s Marketplace listing.
• Good events for Installation callback success rate are collected for apps that don’t subscribe to the callback.