> For the complete documentation index, see [llms.txt](https://helpcenter.xopero.com/xopero-one-en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpcenter.xopero.com/xopero-one-en/backup-and-recovery/devops/bitbucket/integration/required-permissions.md).

# Required permissions

**To protect a Bitbucket environment with Xopero ONE, the account or token used to authorize the connection must have sufficient permissions to access the workspaces, repositories, and related resources designated for backup. The specific permission scopes vary depending on the chosen authorization method.**

***

## OAuth permissions <a href="#account" id="account"></a>

When integrating **Bitbucket** using the OAuth authentication method, **Xopero ONE** requires the following permissions to securely access and protect your repository data:

* [x] Account
  * [x] Read and modify account information.

* [x] Issues
  * [x] Read and modify repositories' issues.

* [x] Pipelines
  * [x] Access repositories' build pipelines and configure their variables.

* [x] Project settings&#x20;
  * [x] Read and modify workspace's project settings.
  * [x] Read and transfer repositories within workspace's projects.

* [x] Repositories & pull requests&#x20;
  * [x] Administer repositories.
  * [x] Delete repositories.
  * [x] Read and modify repositories and their pull requests.

* [x] Manage runners
  * [x] Access and edit workspaces and repositories' runners.

* [x] Snippets
  * [x] Read and modify code snippets.

* [x] Team membership
  * [x] Read and modify team membership details.

* [x] Workspaces
  * [x] Access your workspaces for authentication.
  * [x] Access and edit your workspaces and repositories' test.

* [x] Webhooks
  * [x] Read and modify repositories' webhooks.

* [x] Wikis
  * [x] Read and modify repositories' wikis.

***

## Bitbucket API token scopes

{% hint style="warning" %}
**Xopero ONE** does not support unscoped API tokens for **Bitbucket** integrations.
{% endhint %}

Every API token created for **Bitbucket** integration with **Xopero ONE** requires specific permission scopes to restrict data access and define the exact operations the token can execute.

To ensure successful backup and recovery tasks, API token must be provisioned with the below required permissions.

{% hint style="danger" %}
Applying minimal privileges may cause certain metadata (such as issues) to be omitted from the backup. Furthermore, while read-only permissions are sufficient for running backups, restoring data requires write access, which will necessitate generating a new token with elevated privileges during a recovery operation. **To prevent backup omissions and ensure seamless, immediate data recovery, it is strongly recommended to select all required permissions when creating an API token for Bitbucket.**
{% endhint %}

#### Backup permission scopes

* [x] read:webhook:bitbucket (hooks)
* [x] read:user:bitbucket (required to link the organization)
* [x] read:repository:bitbucket (repositories, downloads, synchronization)
* [x] read:pullrequest:bitbucket (pull requests)
* [x] read:pipeline:bitbucket (variables, schedules, known hosts)
* [x] read:issue:bitbucket (issues)
* [x] read:wiki:bitbucket (wiki)
* [x] admin:repository:bitbucket (branch restriction rules, deployment keys, branching models)

#### Restore permission scopes

* [x] read:pipeline:bitbucket (schedules)
* [x] read:pullrequest:bitbucket (pull requests)
* [x] read:webhook:bitbucket (hooks)
* [x] read:issue:bitbucket (issues)
* [x] read:workspace:bitbucket (repositories)
* [x] read:wiki:bitbucket (wiki)
* [x] write:wiki:bitbucket (wiki)
* [x] write:webhook:bitbucket (hooks)
* [x] write:ssh-key:bitbucket (deployment keys)
* [x] write:repository:bitbucket (repositories, downloads)
* [x] write:pullrequest:bitbucket (pull requests)
* [x] write:pipeline:bitbucket (schedules)
* [x] write:issue:bitbucket (issues)
* [x] admin:pipeline:bitbucket (known hosts, variables)
* [x] admin:repository:bitbucket (repositories, schedules, deployment keys, advanced details, branching models, branch restrictions)
* [x] admin:project:bitbucket (project — in some cases, creation is required to restore the repository)
* [x] read:repository:bitbucket (required for synchronization, repositories)
* [x] read:user:bitbucket (required to link the organization, repositories)

***

## Useful links and items

{% embed url="<https://support.atlassian.com/bitbucket-cloud/docs/api-tokens>" %}