MongoDB Atlas App Services
Parent: MongoDB Atlas · Published reference · snapshot 2026-09-08 · skill mongodb-atlas-expert/references/mongodb-atlas-app-services.md
↓ Facts as markdownall context files
> CRITICAL STATUS NOTE (as of May 2026): Atlas App Services reached a split end-of-life on September 30, 2025.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
MongoDB Atlas App Services — Full Platform Reference
- > CRITICAL STATUS NOTE (as of May 2026): Atlas App Services reached a split end-of-life on September 30, 2025. > - STILL LIVE: Database Triggers, Scheduled Triggers, Authentication Triggers, Atlas Functions (invoked by triggers only) > - EOL (shut down September 30, 2025): Atlas Data API, GraphQL API, Custom HTTPS Endpoints, Atlas Device Sync & Device SDKs, static hosting > - Auth providers, Rules/Permissions, and Values/Secrets are only relevant now as context for the still-live Triggers surface [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#mongodb-atlas-app-services-full-platform-reference]
Key Auth Notes
- Email confirmation links expire in 30 minutes [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#key-auth-notes]
- callResetPasswordFunction() is unauthenticated - always return pending for out-of-band verification [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#key-auth-notes]
- Custom JWT: App Services always enforces 30-minute access token expiry regardless of JWT exp claim [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#key-auth-notes]
Rules and Permissions Engine
- Permissions are defined per-collection. Role evaluation: first matching role wins (role order matters). If no role matches, the operation is denied entirely. System functions bypass all rules. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#rules-and-permissions-engine]
- Variables: %%user.id, %%user.custom_data.<field>, %%root.<field>, %%environment.values.<name> [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#rules-and-permissions-engine]
Schema Validation
- App Services schemas are JSON Schema (draft 4 + BSON extensions). Validates every write after the operation is computed but before commit. Key differences from mongod $jsonSchema: App Services validates post-operation; system functions bypass App Services schema. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#schema-validation]
Atlas GraphQL API (DEPRECATED — EOL March 5, 2025)
- Migration: Hasura on MongoDB or Apollo Server + driver. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#atlas-graphql-api-deprecated-eol-march-5-2025]
Atlas Data API (DEPRECATED — EOL September 30, 2025)
- Migration paths: MongoDB driver + Express/FastAPI/Spring Boot, cloud functions (Lambda, Azure, GCR), or Delbridge Data API (open source drop-in). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#atlas-data-api-deprecated-eol-september-30-2025]
Custom HTTPS Endpoints (DEPRECATED — EOL September 30, 2025)
- Migration: AWS Lambda, Azure Functions, Google Cloud Run, or Vercel serverless functions + MongoDB driver. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#custom-https-endpoints-deprecated-eol-september-30-2025]
Values and Secrets
- Values: Named JSON constants accessed via context.values.get("name") [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#values-and-secrets]
- Secrets: Private strings (max 500 chars) stored encrypted; access indirectly by linking to a Value [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#values-and-secrets]
- Environment Values: context.environment.values.<name> for env-specific config [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#values-and-secrets]
App Services Deployment
- Methods: UI (immediate), CLI (appservices push/pull), GitHub auto-deploy (any push triggers deployment), Admin API. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#app-services-deployment]
- Last 25 deployments stored for rollback [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#app-services-deployment]
- Secrets are NOT included in exported config or git repos - must re-enter manually [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#app-services-deployment]
Billing Model (Still relevant for Triggers)
- Free tier per project: 1M requests/month, 500 compute hours, 10 GB data transfer. Trigger invocations count as requests. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#billing-model-still-relevant-for-triggers]
Anti-Patterns
- Auto-confirm in production - allows fake email addresses [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
- callResetPasswordFunction returning success immediately - unauthenticated callers can reset any user's password [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
- Collection-level roles defined but relying on default roles - if any collection-level roles defined, default roles are NOT checked [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
- Role order wrong - most specific roles should come first [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
- Running App Services schema AND mongod $jsonSchema with validationAction: "error" - can cause confusing double-rejection errors [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
References
- Atlas App Services Documentation [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#references]
- Data API and HTTPS Endpoints Deprecation [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#references]
- Atlas Device Sync EOL Forum Post [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#references]
Where this helps
- Supporting an existing production app that still relies on Atlas Database Triggers, Scheduled Triggers, or Authentication Triggers, which remain live post-EOL. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Planning the mandatory migration off Atlas Data API, GraphQL API, or Custom HTTPS Endpoints before their respective EOL dates. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Debugging a permissions bug where a write is unexpectedly denied or allowed, which usually traces back to role evaluation order in the Rules and Permissions engine. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Reasoning about JSON Schema validation differences between App Services and a mongod-level $jsonSchema validator on the same collection. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Project ideas
- Migrate an app off the deprecated Atlas Data API to a small Express/FastAPI service (or a cloud function) that talks to Atlas through a real MongoDB driver. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Build a custom JWT authentication flow for App Services and verify the 30-minute access-token expiry behavior holds regardless of the JWT's own exp claim. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Write a role-ordering test harness for a collection's permissions rules that checks first-matching-role-wins behavior against several user/document combinations. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Set up GitHub auto-deploy for an App Services app and exercise rollback using the last-25-deployments history. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Common mistakes
- Leaving auto-confirm enabled in production, which allows account creation with fake, unverified email addresses. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Returning success immediately from callResetPasswordFunction, which lets an unauthenticated caller learn whether an account exists or effectively trigger resets for any user. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Defining some collection-level roles and assuming default roles still apply elsewhere — once any collection-level role exists, default roles stop being checked entirely. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Running App Services schema validation and mongod's $jsonSchema together with validationAction: "error", which produces confusing double-rejection errors on the same write. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Known issues
- Atlas Data API, GraphQL API, and Custom HTTPS Endpoints are already past their EOL dates (March 5, 2025 and September 30, 2025) and are shut down, not just deprecated — new work should not plan around them. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Secrets are deliberately excluded from exported config and git repos, so restoring an App Services config from source control requires manually re-entering every secret. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- The custom JWT access-token expiry is fixed at 30 minutes and is enforced regardless of what the token's own exp claim says, which can surprise integrations that assumed the JWT was authoritative. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- System functions bypass all Rules and Permissions and all schema validation, so any logic that must not be bypassable can't rely on being a "system function" for enforcement. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Children
- App Services Authentication Providers
- App Services Rules and Permissions (frontier)
- App Services Schema Validation (frontier)
- Atlas GraphQL API (EOL) (frontier)
- Atlas Data API (EOL) (frontier)
- Custom HTTPS Endpoints (EOL) (frontier)
- App Services Values and Secrets (frontier)
- App Services Deployment Model (frontier)
- App Services Billing Model
- App Services Migration Paths (frontier)
Frontier under this node: App Services Deployment Model, App Services Migration Paths, App Services Rules and Permissions, App Services Schema Validation, App Services Values and Secrets, Atlas Data API (EOL), Atlas GraphQL API (EOL), Custom HTTPS Endpoints (EOL)