Bitbucket

Overview

Connect your users to Bitbucket for repository management, pull requests, and CI/CD pipelines.

Property	Value
Provider ID	bitbucket
Category	Developer Tools
PKCE	Not supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a Bitbucket OAuth Client

Go to Bitbucket workspace settings

Sign in to Bitbucket, open the workspace’s settings (Settings cog → Workspace settings), then under Apps and features select OAuth clients.

Create an OAuth client

Click Create OAuth client. Enter the application name.

Add the callback URL

Add the Redirect URI from the Developer Portal to the Callback URL field.

Select permissions

Select the required permissions for the application.

Get credentials

Copy the Client ID and Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Bitbucket provider

Go to OAuth Providers > Add Provider > Bitbucket.

Enter credentials

• Client ID: Paste the Bitbucket Client ID
• Client Secret: Paste your Bitbucket Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
account	Read the user’s account information (email addresses, name, SSH keys, groups) and, on workspace APIs, the workspace’s users, permissions and projects — gates GET /2.0/user, the identity call
account:write	Change properties on the user’s account (groups, email addresses, username, display name, avatar; delete the account)
email	See the user’s primary email address
repository	Read access to repositories: source code, HTTPS clone, file browsing, zip downloads, and view/use the issue tracker and wiki
repository:write	Write (not admin) access to repositories: push over HTTPS and fork — implicitly grants repository
repository:admin	Admin features of a repository (permissions, branch permissions, deploy keys, webhooks, default reviewers, ownership transfer) — does not grant read or write access to its contents
repository:delete	Delete a repository or repositories
project	View projects — implies repository (read access to every repository in the project)
project:admin	Create, update and delete projects — does not grant project or repository:write
pullrequest	Read access to pull requests (list, comment, create and resolve tasks) — implies repository
pullrequest:write	Create, approve, merge and decline pull requests — implicitly grants pullrequest and repository:write
issue	View, list, search, create, comment on, watch and vote for issues (no implicit repository access)
issue:write	Transition and delete issues — implicitly grants issue
wiki	Read and write access to wikis (view, create and edit pages, clone and push)
webhook	List, create, update and delete webhook subscriptions on any accessible repository, user, workspace or snippet
snippet	Read access to snippets and create snippet comments
snippet:write	Create, edit and delete snippets — implicitly grants snippet
pipeline	Read-only access to pipelines, steps, deployment environments and variables
pipeline:write	Stop, rerun, resume and manually trigger pipelines (does not create variables)
pipeline:variable	Create pipeline variables at the workspace, repository and deployment levels
runner	Read-only access to pipeline runners set up against a workspace or repository
runner:write	Create, edit, disable and delete pipeline runners set up against a workspace or repository

Notes

• Atlassian’s documentation still calls an OAuth client an OAuth consumer; the workspace UI lists them under Apps and features → OAuth clients and shows the client id as Client ID.
• Bitbucket defines scopes on the OAuth client itself: the scopes selected in Alter Vault must also be enabled on the client’s permissions, or the authorization request fails (requesting fewer scopes than the client has is fine). Access tokens expire after two hours and are refreshed automatically.
• project:write is not offered: Atlassian documents it as deprecated and obsoleted by project:admin.
• See the Bitbucket OAuth documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path	Notes
post:/repositories/{workspace}/{repo_slug}/commit/{commit}/comments	admin, send	POST	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/comments	—
post:/repositories/{workspace}/{repo_slug}/issues/{issue_id}/comments	admin, send	POST	/2.0/repositories/{workspace}/{repo_slug}/issues/{issue_id}/comments	served by the provider but absent from its published spec
post:/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments	admin, send	POST	/2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments	—
post:/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments/{comment_id}/resolve	admin, send	POST	/2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments/{comment_id}/resolve	—
post:/snippets/{workspace}/{encoded_id}/comments	admin, send	POST	/2.0/snippets/{workspace}/{encoded_id}/comments	—
put:/repositories/{workspace}/{repo_slug}/commit/{commit}/comments/{comment_id}	admin, send	PUT	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/comments/{comment_id}	—
put:/repositories/{workspace}/{repo_slug}/issues/{issue_id}/comments/{comment_id}	admin, send	PUT	/2.0/repositories/{workspace}/{repo_slug}/issues/{issue_id}/comments/{comment_id}	served by the provider but absent from its published spec
put:/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments/{comment_id}	admin, send	PUT	/2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments/{comment_id}	—
put:/snippets/{workspace}/{encoded_id}/comments/{comment_id}	admin, send	PUT	/2.0/snippets/{workspace}/{encoded_id}/comments/{comment_id}	—
delete:/repositories/{workspace}/{repo_slug}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}	—
delete:/repositories/{workspace}/{repo_slug}/branch-restrictions/{id}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/branch-restrictions/{id}	—
delete:/repositories/{workspace}/{repo_slug}/commit/{commit}/approve	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/approve	—
delete:/repositories/{workspace}/{repo_slug}/commit/{commit}/comments/{comment_id}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/comments/{comment_id}	—
delete:/repositories/{workspace}/{repo_slug}/default-reviewers/{target_username}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/default-reviewers/{target_username}	—
delete:/repositories/{workspace}/{repo_slug}/deploy-keys/{key_id}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/deploy-keys/{key_id}	—
delete:/repositories/{workspace}/{repo_slug}/downloads/{filename}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/downloads/{filename}	—
delete_repository_hook	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/hooks/{uid}	also accepts delete:/repositories/{workspace}/{repo_slug}/hooks/{uid}
delete:/repositories/{workspace}/{repo_slug}/issues/{issue_id}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/issues/{issue_id}	served by the provider but absent from its published spec
delete:/repositories/{workspace}/{repo_slug}/issues/{issue_id}/attachments/{path}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/issues/{issue_id}/attachments/{path}	served by the provider but absent from its published spec
delete:/repositories/{workspace}/{repo_slug}/issues/{issue_id}/comments/{comment_id}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/issues/{issue_id}/comments/{comment_id}	served by the provider but absent from its published spec
delete:/repositories/{workspace}/{repo_slug}/issues/{issue_id}/vote	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/issues/{issue_id}/vote	served by the provider but absent from its published spec
delete:/repositories/{workspace}/{repo_slug}/issues/{issue_id}/watch	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/issues/{issue_id}/watch	served by the provider but absent from its published spec
delete:/repositories/{workspace}/{repo_slug}/permissions-config/groups/{group_slug}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/permissions-config/groups/{group_slug}	—
delete:/repositories/{workspace}/{repo_slug}/permissions-config/users/{selected_user_id}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/permissions-config/users/{selected_user_id}	—
delete:/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/approve	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/approve	—
delete:/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments/{comment_id}	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments/{comment_id}	—
delete:/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments/{comment_id}/resolve	admin, delete	DELETE	/2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments/{comment_id}/resolve	—
bulkCreateOrUpdateAnnotations	admin, write	POST	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/reports/{reportId}/annotations	—
createDeploymentVariable	admin, write	POST	/2.0/repositories/{workspace}/{repo_slug}/deployments_config/environments/{environment_uuid}/variables	—
createEnvironment	admin, write	POST	/2.0/repositories/{workspace}/{repo_slug}/environments	—
createOrUpdateAnnotation	admin, write	PUT	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/reports/{reportId}/annotations/{annotationId}	—
createOrUpdateReport	admin, write	PUT	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/reports/{reportId}	—
post:/snippets	write	POST	/2.0/snippets	—
put:/addon	write	PUT	/2.0/addon	—
get:/repositories/{workspace}/{repo_slug}/commit/{commit}/comments	read	GET	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/comments	—
get:/repositories/{workspace}/{repo_slug}/commit/{commit}/comments/{comment_id}	read	GET	/2.0/repositories/{workspace}/{repo_slug}/commit/{commit}/comments/{comment_id}	—
get:/repositories/{workspace}/{repo_slug}/components/{component_id}	read	GET	/2.0/repositories/{workspace}/{repo_slug}/components/{component_id}	served by the provider but absent from its published spec
get:/repositories/{workspace}/{repo_slug}/deploy-keys	read	GET	/2.0/repositories/{workspace}/{repo_slug}/deploy-keys	—
get:/repositories/{workspace}/{repo_slug}/deploy-keys/{key_id}	read	GET	/2.0/repositories/{workspace}/{repo_slug}/deploy-keys/{key_id}	—
get:/repositories/{workspace}/{repo_slug}/downloads/{filename}	read	GET	/2.0/repositories/{workspace}/{repo_slug}/downloads/{filename}	—