MongoDB Atlas App Services
Parent: MongoDB Atlas · researched 2026-05-28T16:54:35.419Z· 12 sources · 10 concepts · skill mongodb-atlas-app-services
> CRITICAL STATUS NOTE (as of May 2026): Atlas App Services reached a split end-of-life on September 30, 2025.
MongoDB Atlas App Services — Full Platform Reference
- > CRITICAL STATUS NOTE (as of May 2026): Atlas App Services reached a split end-of-life on September 30, 2025. [source]
- > - STILL LIVE: Database Triggers, Scheduled Triggers, Authentication Triggers, Atlas Functions (invoked by triggers only) [source]
- > - EOL (shut down September 30, 2025): Atlas Data API, GraphQL API, Custom HTTPS Endpoints, Atlas Device Sync & Device SDKs, static hosting [source]
- > - Auth providers, Rules/Permissions, and Values/Secrets are only relevant now as context for the still-live Triggers surface [source]
Key Auth Notes
Rules and Permissions Engine
- Permissions are defined per-collection. Role evaluation: first matching role wins (role order matters). If no role matches, the operation is denied entirely. System functions bypass all rules. [source]
- Variables: %%user.id, %%user.custom_data.<field>, %%root.<field>, %%environment.values.<name> [source]
Schema Validation
- App Services schemas are JSON Schema (draft 4 + BSON extensions). Validates every write after the operation is computed but before commit. Key differences from mongod $jsonSchema: App Services validates post-operation; system functions bypass App Services schema. [source]
Atlas GraphQL API (DEPRECATED — EOL March 5, 2025)
- Migration: Hasura on MongoDB or Apollo Server + driver. [source]
Atlas Data API (DEPRECATED — EOL September 30, 2025)
- Migration paths: MongoDB driver + Express/FastAPI/Spring Boot, cloud functions (Lambda, Azure, GCR), or Delbridge Data API (open source drop-in). [source]
Custom HTTPS Endpoints (DEPRECATED — EOL September 30, 2025)
- Migration: AWS Lambda, Azure Functions, Google Cloud Run, or Vercel serverless functions + MongoDB driver. [source]
Values and Secrets
App Services Deployment
Billing Model (Still relevant for Triggers)
- Free tier per project: 1M requests/month, 500 compute hours, 10 GB data transfer. Trigger invocations count as requests. [source]
Anti-Patterns
- Auto-confirm in production - allows fake email addresses [source]
- callResetPasswordFunction returning success immediately - unauthenticated callers can reset any user's password [source]
- Collection-level roles defined but relying on default roles - if any collection-level roles defined, default roles are NOT checked [source]
- Role order wrong - most specific roles should come first [source]
- Running App Services schema AND mongod $jsonSchema with validationAction: "error" - can cause confusing double-rejection errors [source]
References
Children
- App Services Authentication Providers (frontier)
- App Services Rules and Permissions (frontier)
- App Services Schema Validation (frontier)
- Atlas GraphQL API (EOL) (frontier)
- Atlas Data API (EOL) (frontier)
- Custom HTTPS Endpoints (EOL) (frontier)
- App Services Values and Secrets (frontier)
- App Services Deployment Model (frontier)
- App Services Billing Model (frontier)
- App Services Migration Paths (frontier)
Frontier under this node: App Services Authentication Providers, App Services Billing Model, App Services Deployment Model, App Services Migration Paths, App Services Rules and Permissions, App Services Schema Validation, App Services Values and Secrets, Atlas Data API (EOL), Atlas GraphQL API (EOL), Custom HTTPS Endpoints (EOL)