Do Atlassian Confluence Cloud API rate limits apply to custom macros hosted on our own cloud server?

[Prolaborate]

Hi Atlassian team,

I recently came across the announcement about API rate limiting(Rate Limiting-Documnet) for the Confluence Cloud REST API, and I wanted some clarification regarding our use case.

We’ve developed a custom Confluence macro that is hosted on our cloud server and published on the Atlassian Marketplace using an atlassian-connect.json descriptor.

The macro interacts with the Confluence Cloud REST API via the usual authenticated API calls.

My question is:

Do the new rate limits apply to these API calls made from our custom macro backend?

And if so:

Are the total rate limits per app per tenant or per tenant?
How should we handle or monitor these limits effectively for marketplace-hosted apps?
Just trying to ensure we’re building with these limits in mind going forward.

I appreciate any help you can provide.

[Olivier Stiévenart]

Hi @Prolaborate,

Yes it does apply to your app.

The quota is calculated from various metrics, including global API usage (cross tenants) and per-tenant basis.

There are new HTTP headers implemented in the API responses that will tell you where you are in your current usage.

Hope this helps,

Olivier

[marc -Collabello--Phase Locked-]

The rate limits apply to your custom macro.  For further information, I would check the Atlassian developers site: https://developer.atlassian.com/cloud/confluence/rate-limiting/#introduction

[Prolaborate]

Hi @Olivier Stiévenart @marc -Collabello--Phase Locked- ,

We are currently using a custom macro integrated with Confluence Cloud, and I’ve received the recent communication regarding Confluence REST API rate limiting (Reference).

I would like to understand how these rate limits may affect our architecture and get guidance on how to ensure compatibility and compliance going forward.

Our Use Case – Prolaborate Cloud Macro

We have a self-hosted macro that allows Confluence Cloud users to embed and view EA diagrams from a tenant-specific backend system. Here's how our setup works:

Workflow:

1. Environment Overview

- Confluence Cloud Instance  

  Domain: https://yuvi27.atlassian.net

- Prolaborate Macro Server (Self-hosted)  

  Domain: https://prolmacro4.prolaborate.com  

  Hosts the macro backend logic, REST endpoints, and tenant-aware routing.

- Tenant EA Server(s)  

  Example: https://test.prolaborate.com  

  Contains tenant-specific EA data and APIs.

2. Macro Installation & Setup

1. The macro is installed in Confluence using a confluence-connect.json manifest.

2. The manifest specifies:

   - Macro entry point (iframe URL)

   - Authentication settings

   - Permissions and API scopes

3. The macro is hosted on https://prolmacro4.prolaborate.com, where tenant configuration is managed.

4. During initial configuration, the Confluence instance and tenant details are registered.

3. Confluence Page Load Flow

When a user opens a Confluence page that includes the Prolaborate macro:

Step-by-Step Flow:

1. User opens Confluence Page → Page render is triggered

2. Confluence Cloud → https://prolmacro4.prolaborate.com → Secure iframe/macro call is made

3. Macro Server → Tenant Server (e.g., test.prolaborate.com) → REST API call to fetch EA diagram

4. Tenant Server → Macro Server → Returns EA diagram data (JSON or HTML snippet)

5. Macro Server → Confluence Page → Renders diagram content

4. Client-Side JS for Dynamic Data

After the initial macro render, a JavaScript module (embedded in the macro) may trigger additional API calls to load enriched details.

6. JS in Macro iframe (Confluence Page) → https://prolmacro4.prolaborate.com → Calls dynamic REST endpoint

7. Macro Server → Appropriate Tenant Server → Fetches enriched element details

8. Tenant Server → Macro Server → Returns additional data

9. Macro Server → JS in Page → Data injected into macro UI in Confluence

My Questions:

Which API calls in this flow could be subject to rate limiting?

The macro does not currently make direct calls to Confluence REST APIs from our backend, but user interactions may involve future enhancements that do.

Does loading macro iframes or any background request trigger rate limits?

What is the recommended approach to throttle or queue requests if the macro serves multiple tenants/users concurrently?

If we move to using the Confluence REST API from our macro (e.g., to read page metadata), how should we manage token scope and rate limit budgets per tenant?

Is there a per-app or per-user limit distinction when using Connect apps in this iframe-based architecture?

Additional Context

Each tenant has its own EA backend.

Our macro is used in shared pages by multiple users across Confluence projects.

We want to proactively implement best practices to avoid any disruption once stricter rate limits are enforced.

[marc -Collabello--Phase Locked-]

I think you might be able to contact Atlassian developer support for more help.