Permissions required to integrate Bitbucket with Xopero ONE to protect its resources.
To protect a Bitbucket environment with Xopero ONE, the account or token used to authorize the connection must have sufficient permissions to access the workspaces, repositories, and related resources designated for backup. The specific permission scopes vary depending on the chosen authorization method.
When integrating Bitbucket using the OAuth authentication method, Xopero ONE requires the following permissions to securely access and protect your repository data:
Issues
Read and modify repositories' issues.
Pipelines
Access repositories' build pipelines and configure their variables.
Project settings
Read and modify workspace's project settings.
Read and transfer repositories within workspace's projects.
Repositories & pull requests
Administer repositories.
Delete repositories.
Read and modify repositories and their pull requests.
Manage runners
Access and edit workspaces and repositories' runners.
Snippets
Read and modify code snippets.
Team membership
Read and modify team membership details.
Workspaces
Access your workspaces for authentication.
Access and edit your workspaces and repositories' test.
Webhooks
Read and modify repositories' webhooks.
Wikis
Read and modify repositories' wikis.
Xopero ONE does not support unscoped API tokens for Bitbucket integrations.
Every API token created for Bitbucket integration with Xopero ONE requires specific permission scopes to restrict data access and define the exact operations the token can execute.
To ensure successful backup and recovery tasks, API token must be provisioned with the below required permissions.
Applying minimal privileges may cause certain metadata (such as issues) to be omitted from the backup. Furthermore, while read-only permissions are sufficient for running backups, restoring data requires write access, which will necessitate generating a new token with elevated privileges during a recovery operation. To prevent backup omissions and ensure seamless, immediate data recovery, it is strongly recommended to select all required permissions when creating an API token for Bitbucket.
read:webhook:bitbucket (hooks)
read:user:bitbucket (required to link the organization)
read:repository:bitbucket (repositories, downloads, synchronization)
read:pullrequest:bitbucket (pull requests)
read:pipeline:bitbucket (variables, schedules, known hosts)
read:issue:bitbucket (issues)
read:wiki:bitbucket (wiki)
admin:repository:bitbucket (branch restriction rules, deployment keys, branching models)
read:pipeline:bitbucket (schedules)
read:pullrequest:bitbucket (pull requests)
read:webhook:bitbucket (hooks)
read:issue:bitbucket (issues)
read:workspace:bitbucket (repositories)
read:wiki:bitbucket (wiki)
write:wiki:bitbucket (wiki)
write:webhook:bitbucket (hooks)
write:ssh-key:bitbucket (deployment keys)
write:repository:bitbucket (repositories, downloads)
write:pullrequest:bitbucket (pull requests)
write:pipeline:bitbucket (schedules)
write:issue:bitbucket (issues)
admin:pipeline:bitbucket (known hosts, variables)
admin:repository:bitbucket (repositories, schedules, deployment keys, advanced details, branching models, branch restrictions)
admin:project:bitbucket (project — in some cases, creation is required to restore the repository)
read:repository:bitbucket (required for synchronization, repositories)
read:user:bitbucket (required to link the organization, repositories)