A Forge app calling Jira Cloud or Confluence Cloud APIs must account for Atlassian’s points-based product API limits, which entered enforcement on March 2, 2026. The default allowance is a shared 65,000-point pool per app per hour across its tenants—not 65,000 requests per tenant. When a call gets a 429, first identify whether it came from Jira or Confluence API controls or from Forge’s separate platform limits; the right retry signal depends on the system that returned it.
Which limits apply to a Forge app?
Atlassian’s Jira and Confluence Cloud documentation says enforcement of the new points-based API limits and tiered quotas began March 2, 2026. The change applies to Forge, Connect, and OAuth 2.0 (3LO) apps. Atlassian says API-token-based traffic is not affected by this change and remains governed by existing burst limits. The Jira and Confluence rate-limit pages were last updated October 1, 2026: Jira rate limiting and Confluence rate limiting.
As an Amazon Associate I earn from qualifying purchases.
These product API controls are separate from Forge platform limits. Atlassian notes that a Forge app can be affected by app-specific limits when making Jira or Confluence REST calls, as well as by Forge’s own platform limits. A Forge invocation can therefore be constrained even if the product API points pool has capacity. See Forge platform limits and the Forge invocation limits reference.
How the points-based model counts API work
Points measure API work, not just the number of HTTP requests. Each request starts with a base cost of one point. Reads can add costs based on the type or number of objects involved or returned, while writes are charged the base cost only. The exact cost for a call depends on its endpoint and the current object-cost rules, so check Atlassian’s endpoint-specific tables before estimating usage.
#1 Best Overall
Jira’s documented examples include one point for a core-domain read such as an issue or project, two points for an identity or access read such as users or permissions, and one point for a write. These are category examples, not a substitute for checking the specific endpoint. Atlassian’s worked example charges 50 points for creating 50 issues: each issue write costs one point.
Batching can reduce the number of HTTP requests and associated overhead where an endpoint supports it, but it does not erase the points charged for the work. A batch creating 50 issues still costs 50 points under Jira’s example.
What quota does the app get?
Default: one shared Global Pool
Most apps use the Global Pool: 65,000 points per hour shared across all tenants of the app. It resets at the top of each UTC hour. Because the allowance is shared, one tenant’s API activity can consume capacity that would otherwise be available for calls serving other tenants.
Per-Tenant Pool: reviewed exception
Atlassian also documents a Per-Tenant Pool for apps assigned to it after review, intended for exceptional or concentrated usage. Its hourly allowance depends on the customer’s edition and user count:
Rank #3
| Customer edition | Per-Tenant Pool allowance per hour |
|---|---|
| Free | 65,000 points |
| Standard | 100,000 + 10 points per user |
| Premium | 130,000 + 20 points per user |
| Enterprise | 150,000 + 30 points per user |
These formulas are not the default allowance: most apps remain in the shared Global Pool, and assignment to the Per-Tenant Pool requires Atlassian review. The documentation does not describe an automatic, on-demand quota increase.
Why a points quota is not the only limit
A Forge app can encounter different controls with different scopes and response signals. Jira expressly distinguishes its hourly points quota, per-second burst limits, and per-issue write limits. Confluence likewise says its hourly quota and short-window burst protections are enforced independently, with additional protections for certain high-impact endpoint groups. Forge invocation limits are another separate layer.
| Control | Scope or window | What to keep in mind |
|---|---|---|
| Jira or Confluence hourly quota | Points per hour; ordinarily a shared app pool across tenants | Capacity is based on weighted API work, not request count alone. |
| Product API burst controls | Short window; Jira burst limits are evaluated per tenant and API/resource path | Remaining below the hourly quota does not prevent a burst response. Reaching a threshold for one endpoint does not mean every endpoint or tenant is blocked. |
| Jira per-issue write limits | Writes associated with an issue | This is independent of both the hourly points quota and burst controls. |
| Forge invocation limits | Forge platform invocation controls, including user-led invocations | A Forge 429 and its reset metadata belong to Forge, not the Jira or Confluence product API quota. |
Atlassian’s Forge platform overview puts the distinction plainly: “In addition to platform quotas and limits, Forge apps may also be affected by Atlassian app-specific rate limits, such as when making REST API calls to Jira or Confluence.” The statement is from Atlassian Developer documentation, last updated July 13, 2026: Forge platform limits.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow to handle a 429 response
- Identify the responding system. Record the status, endpoint, tenant or installation context, and response headers. A 429 may come from Jira or Confluence product API controls or Forge invocation limits; do not assume they share the same headers or reset behavior.
- Read the applicable rate-limit headers. Jira documents headers that convey policy and remaining/reset information. Structured header entries can vary in number and order, so parse them rather than relying on a fixed ordering.
- Honor that system’s retry signal. Jira directs apps to respect
Retry-Afterand use appropriate backoff. Confluence says to pause and retry after the specified delay. Forge invocation guidance describes reset metadata for relevant Forge 429 responses. Use the signal from the system that returned the response; do not treat these signals as interchangeable. - Retry only work that is safe to repeat. Bound the number of attempts or total retry time, and avoid having many workers retry in sync. Atlassian’s documentation calls for backoff but does not prescribe one universal algorithm.
- Reduce avoidable API work. Use the endpoint-specific cost rules to estimate points, avoid unnecessary reads, and batch operations when supported. These steps can reduce usage but do not guarantee that an app will remain under quota.
- Escalate sustained exceptional usage through Atlassian. Per-Tenant Pool placement is reviewed; the cited documentation does not describe an automatic quota increase.
Estimating usage before it becomes a problem
Request counts alone are a poor forecast because operations have different costs and reads can incur object-based points. For a useful estimate, count expected calls by endpoint and operation, apply the current endpoint-specific cost for each, and account for how returned objects affect read costs. Then consider the app-wide sharing of the default pool: usage across tenants contributes to the same hourly total.
Also plan for limits that an hourly estimate cannot predict. A workload may fit within its hourly point budget and still cross a short-window burst threshold, hit a Jira per-issue write restriction, or encounter a Forge invocation limit. Monitoring the response status and relevant headers or reset metadata helps distinguish these cases and choose the appropriate recovery behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
