Supported way for a Forge app to list installed Marketplace apps on a Jira Cloud site?

Forge
1

I am scoping a Forge app for Jira Cloud site admins and I have hit a wall I cannot resolve from the documentation. Posting publicly because I suspect I am not the only one, and because a public answer is something the rest of us can cite.

The question. Is there a supported way for a Forge app to read the list of Marketplace apps installed on the site it is installed in? And separately, is there any supported way to get usage or last-used information for apps my app does not own?

What I found, in case it saves anyone else the afternoon.

Atlassian’s own admin console can clearly do this. The Connected apps page in admin.atlassian.com posts to /gateway/api/graphql, and its shipped bundle contains the field names appInstallations, appInstallationsByContext, appInstallationAri, appInstallationTasks, marketplaceApps and marketplaceAppByKey.

Those fields are not documented, and calling appInstallationsByContext from Forge is reported here to return:

Auth category: THIRD_PARTY_OAUTH is not allowed in service cs_apps

UPM looks promising and is not the answer. On my Cloud site, /rest/plugins/1.0/ returns 200 with application/vnd.atl.plugins.installed+json, but it enumerates the instance’s 204 internal plugins with userInstalled: 1. None of the four Marketplace apps I installed on that site appear in it. The KB article for that endpoint is labelled Data Center only, which now makes sense.

Everything else I checked comes back empty. REST v3’s app-related groups are scoped to the calling app. There is no scope for apps or app installations in either scope table. The Organizations REST API covers directories, users, groups, domains, events, policies and workspaces. The Marketplace License API is vendor-scoped and returns 403 for another vendor’s app.

The Jira audit record API is not it either. /rest/api/3/auditing/record on my site returns all 209 records across twelve categories, none of them apps, and the four Marketplace apps I installed that day do not appear anywhere in it.

The one place that clearly does hold app-level history is the organisation audit log at admin.atlassian.com, which has an explicit App filter and says it covers “managing your site and apps within the past 180 days”. As far as I can tell that is only reachable through the Organizations Events API with an organisation API token the customer creates, which is a very different product.

So my actual question is narrow. Are those GraphQL fields first-party only by design? If so, saying that plainly would be genuinely useful, because right now the absence of an answer looks like a gap rather than a decision.

And if it is a decision, is a supported app-inventory API on the roadmap? MP-113 has been Gathering Interest since November 2021.

Has anyone found a supported route?

2

In my experience, Atlassian has always turned this around: if an API is not publicly documented, it means it is private.

I would also argue that this is a pretty definitive answer:

The main gateway to this information is telling you that you are not supposed to have access to it. You have been trying to find workarounds and getting indirect access to that same information (which is definitely something all app developers have done in the past) and perhaps you may eventually find a way to achieve what you want. But either way, Atlassian has made it perfectly clear that this information should not be available to 3rd parties.

3

Yes. Well, kind of. The following is supported and part of the official REST API. But data quality is not what you would hope for.

It works via the users endpoint: Apps do get their own user on a site which does get listed via this endpoint. You can simply iterate over all of the users present and look for those where accountType == 'app'.

There are, of course, some downsides. The first problem is that app users do not always have the same name as the actual app, so it is hard to match them correctly. Even more important: The list of users is not everyone on that product, it returns everyone within the organization - even those users that aren’t part of the site. It could include users that are only on Confluence, and even users that are only in the directory, but not on any site.

And yes, this is apparently the intended behaviour. At least that’s what Atlassian told me when I asked. So if the ‘match-per-name’-part works for you, go for it.

4

Hi @WesleyVos, to my knowledge there’s no supported APIs allowing a Forge app to determine the other installed apps in a site. This has come up before:

You may like to visit these resources in case they provide any help.