Required permissions

Permissions required to integrate Bitbucket with Xopero ONE to protect its resources.

To protect a Bitbucket environment with Xopero ONE, the account or token used to authorize the connection must have sufficient permissions to access the workspaces, repositories, and related resources designated for backup. The specific permission scopes vary depending on the chosen authorization method.

---

OAuth permissions

When integrating Bitbucket using the OAuth authentication method, Xopero ONE requires the following permissions to securely access and protect your repository data:

• Account

  • Read and modify account information.

• Issues

  • Read and modify repositories' issues.

• Pipelines

  • Access repositories' build pipelines and configure their variables.

• Project settings

  • Read and modify workspace's project settings.

  • Read and transfer repositories within workspace's projects.

• Repositories & pull requests

  • Administer repositories.

  • Delete repositories.

  • Read and modify repositories and their pull requests.

• Manage runners

  • Access and edit workspaces and repositories' runners.

• Snippets

  • Read and modify code snippets.

• Team membership

  • Read and modify team membership details.

• Workspaces

  • Access your workspaces for authentication.

  • Access and edit your workspaces and repositories' test.

• Webhooks

  • Read and modify repositories' webhooks.

• Wikis

  • Read and modify repositories' wikis.

---

Bitbucket API token scopes

Xopero ONE does not support unscoped API tokens for Bitbucket integrations.

Every API token created for Bitbucket integration with Xopero ONE requires specific permission scopes to restrict data access and define the exact operations the token can execute.

To ensure successful backup and recovery tasks, API token must be provisioned with the below required permissions.

Applying minimal privileges may cause certain metadata (such as issues) to be omitted from the backup. Furthermore, while read-only permissions are sufficient for running backups, restoring data requires write access, which will necessitate generating a new token with elevated privileges during a recovery operation. To prevent backup omissions and ensure seamless, immediate data recovery, it is strongly recommended to select all required permissions when creating an API token for Bitbucket.

Backup permission scopes

• read:webhook:bitbucket (hooks)

• read:user:bitbucket (required to link the organization)

• read:repository:bitbucket (repositories, downloads, synchronization)

• read:pullrequest:bitbucket (pull requests)

• read:pipeline:bitbucket (variables, schedules, known hosts)

• read:issue:bitbucket (issues)

• read:wiki:bitbucket (wiki)

• admin:repository:bitbucket (branch restriction rules, deployment keys, branching models)

Restore permission scopes

• read:pipeline:bitbucket (schedules)

• read:pullrequest:bitbucket (pull requests)

• read:webhook:bitbucket (hooks)

• read:issue:bitbucket (issues)

• read:workspace:bitbucket (repositories)

• read:wiki:bitbucket (wiki)

• write:wiki:bitbucket (wiki)

• write:webhook:bitbucket (hooks)

• write:ssh-key:bitbucket (deployment keys)

• write:repository:bitbucket (repositories, downloads)

• write:pullrequest:bitbucket (pull requests)

• write:pipeline:bitbucket (schedules)

• write:issue:bitbucket (issues)

• admin:pipeline:bitbucket (known hosts, variables)

• admin:repository:bitbucket (repositories, schedules, deployment keys, advanced details, branching models, branch restrictions)

• admin:project:bitbucket (project — in some cases, creation is required to restore the repository)

• read:repository:bitbucket (required for synchronization, repositories)

• read:user:bitbucket (required to link the organization, repositories)

---

Useful links and items

API tokens | Bitbucket Cloud | Atlassian SupportAtlassian Support