Bitbucket Data Center protected resources define which parts of your environment Xopero ONE can access, secure, and restore.

Backup coverage

The following list includes all Bitbucket Data Center resources covered by backup.

• Branches

• Commits

• LFS

• Pull requests

• Repository

• Tags

• Webhooks

Xopero ONE supports multiple repository selection methods that allow administrators to define the scope of backup and recovery operations according to organizational requirements. Repositories can be selected manually, automatically, or included and excluded based on configurable rules and filters.

Selecting data to protect

When creating a backup plan, one of the steps is to specify which repositories you want to protect. Xopero ONE offers several methods for selecting repositories:

1. Protect all: this option ensures that all existing repositories and projects, as well as any newly created ones, are automatically included in the backup plan without requiring manual updates.

2. Select projects: using checkboxes, you can choose specific projects to protect.

3. Select repositories: using checkboxes, you can choose specific repositories to protect.

1. Exclude repositories: using checkboxes, you can exclude specific repositories, allowing the plan to cover all other repositories by default.

2. Set rules: this option lets you define criteria to include repositories and projects based on attributes such as their names or associated topics, ensuring that repositories meeting these conditions are automatically protected.

When restoring repositories, one type of metadata that can be restored is teams. Xopero ONE ensures that teams and their associated users are reinstated.

Before starting the restoration process, a prompt will inform you of this action—accepting the prompt will restore teams and send invitations as needed. Canceling the prompt will exclude teams from the restoration process.

The maximum number of external collaborators that can be restored for a single repository in one operation is limited to 50. This restriction is due to GitHub API limitations, which define how many collaborators can be processed in a single batch. This constraint is independent of Xopero ONE and cannot be bypassed by the backup solution.

Rate limits are enforced for security and stability— excessive requests may block access or disrupt the application’s operation. For detailed information, refer to the .

Rate limits are enforced for security reasons to prevent a large number of requests from blocking or destabilizing the application.

GitHub limits the number of API requests that you can make within a specific time period to prevent abuse, protect against denial-of-service conditions, and maintain platform stability. Primary rate limit thresholds are determined by your authentication method, though specific resource-intensive endpoints—such as search APIs—enforce stricter request quotas.

You can learn more about GitHub API rate limits in the official GitHub documentation.

Rate limits are implemented to ensure the stability and security of the system, as excessive requests could overload or destabilize the application. For detailed information on GitLab rate limits, refer to .

When restoring repositories, one type of metadata that can be restored is teams. Xopero ONE ensures that teams and their associated users are reinstated.

Before starting the restoration process, a prompt will inform you of this action—accepting the prompt will restore teams and send invitations as needed. Canceling the prompt will exclude teams from the restoration process.

Rate limits enhance security by preventing an overwhelming number of requests that could disrupt, block, or destabilize the application's functionality—the system enforces these limits for stability. For more information, visit .

In Azure DevOps Server (on-premises), API limits are flexible and depend on server resources and configuration. Unlike the cloud version, there are no fixed, global request limits—administrators set performance parameters and limits tailored to the organization's specific needs.

Xopero ONE is designed to protect DevOps ecosystems, including Azure DevOps.

To ensure your entire Azure DevOps environment is reliably backed up, make sure to include all repositories along with their related metadata — the best practice is to create a backup plan for critical repositories and metadata that change daily (or even more frequently), for example, using the recommended Grandfather-Father-Son (GFS) rotation scheme.

Additionally, create a separate backup plan for unused repositories that you need to keep for future reference. This type of backup primarily serves Azure DevOps archival purposes, and with unlimited retention, you can store your copies for as long as needed — even indefinitely.

You can also delete repositories from your Azure DevOps account while keeping a copy in storage, which helps bypass Azure DevOps limits.

Incremental

Backup plan setup

Backup plan setup

Xopero ONE supports backup and recovery of Git Large File Storage (LFS) content for DevOps organizations, ensuring that repositories configured with Git LFS are protected together with their associated large binary objects. During restore operations, both standard Git data and LFS objects are recovered to preserve repository integrity and maintain consistency across supported DevOps platforms.

Restoring LFS metadata

Xopero ONE supports the backup and recovery of LFS objects across all supported DevOps platforms.

While you can choose whether to include LFS metadata during the recovery process, please note that LFS must be restored alongside its parent repository; it cannot be recovered as a standalone item.

Useful links and items

To protect a Bitbucket Data Center (DC) environment with Xopero ONE, the account used to authorize the connection must have sufficient permissions to access the workspaces, repositories, and related resources designated for backup.

Supported platform versions

Xopero ONE supports Bitbucket Data Center (DC) version 3.0.4 and higher, enabling comprehensive repository and metadata protection regardless of the underlying host operating system.

Account permissions

In Bitbucket Data Center, account permissions can be managed in three distinct ways, all of which are fully supported for use with Xopero ONE:

1. Global permissions — the user account connecting Bitbucket DC with Xopero ONE must have at least administrator privileges. Using global permissions grants the application access to protect all repositories across the entire Bitbucket DC instance.

2. Project permissions — alternatively, you can assign write permissions at the project level to the connecting user account. This method restricts Xopero ONE synchronization and backup scope strictly to the repositories within those specific projects.

3. Repository permissions — permissions can also be configured individually for each specific repository, offering granular control via two operational tiers:

   1. Read (sufficient to perform data backups, but cannot be used to execute repository restorations).

   2. Write (full authorization to perform both backup and restoration operations).

Connecting GitHub Enterprise with Xopero ONE requires appropriate permissions to access and protect repositories and their associated metadata. The required permissions depend on the type of data that needs to be protected.

General permissions

Integrating GitHub with Xopero ONE to back up and restore repositories, projects, and associated metadata requires an account with full administrative privileges.

To authenticate and access your account, Xopero ONE requires the following permission scopes:

• Personal user data (read-only): access to email addresses and profile information.

• Repositories: access to both public and private repositories.

• Code and resources: access to issues, pull requests, wikis, settings, webhooks and services, deploy keys, collaboration invites, and workflow management (including updating GitHub Actions workflow files).

Personal access tokens are generated in GitHub Enterprise account settings under Tokens and can be assigned different permissions.

Registering the Xopero ONE application and executing full repository backup and restore tasks requires a token configured with at least repo and workflow permissions.

Using Personal Access Token (PAT)

Backup plan setup

Backup plan setup

Backup plan setup

Account

To log in to your account, Xopero ONE requires the following permissions:

1. Access the authenticated user’s API — Xopero needs read and write access to the API, including:

   1. All groups and projects.

   2. The container registry.

   3. The package registry.

The following permissions are the minimum needed to register the Xopero ONE application in your account and access repositories:

• read_api

• read_repository

By creating Personal Access Token, you can assign various types of permissions. Below is a list of permissions that will allow you to backup the repository metadata you are interested in in your organization.

read_api - Read permission required to assign an organization to GitLab.

api - Grants complete read/write access to the API, including all groups and projects.

read_repository - it is required to access the list of repositories and to be able to back them up.

write_repository - it is required to access to restore repository.

read_registry - grants read access to a Container Registry images if a project is private and authorization is required.

By creating a personal access token, you can assign different types of permissions. The following permissions allow you to back up the repository metadata in your organization:

• read_api — required to assign an organization to GitLab.

• api — grants full read/write access to the API, including all groups and projects.

• read_repository — required to access the list of repositories and perform backups.

• write_repository — required to restore a repository.

Recovery process

Creating an Azure DevOps (or DevOps Server) backup plan ensures your projects and data are securely protected and easily restorable.

Backup plan setup

Backup plan setup

General information

Xopero ONE is designed to protect DevOps ecosystems, including GitHub.

To ensure your entire GitHub environment is reliably backed up, make sure to include all repositories along with their related metadata — the best practice is to create a backup plan for critical repositories and metadata that change daily (or even more frequently), for example, using the recommended Grandfather-Father-Son (GFS) rotation scheme.

Additionally, create a separate backup plan for unused repositories that you need to keep for future reference. This type of backup primarily serves GitHub archival purposes, and with unlimited retention, you can store your copies for as long as needed — even indefinitely.

You can also delete repositories from your GitHub account while keeping a copy in storage, which helps bypass GitHub limits.

Backup type

Incremental and differential backups help save storage space. In Xopero ONE you can define different retention and performance settings for each type of backup (full, incremental, and differential). For example, our software allows you to include only the blocks of GitHub data that have changed since the last backup, reducing storage usage, speeding up the process, and limiting bandwidth.

Use different types of storage to replicate backups, minimize the risk of outages or disasters, and comply with the 3-2-1 backup rule (which means having at least three copies of your data on two different storage types, with at least one copy stored in the cloud).

Xopero ONE is a multi-storage system that allows you to store your data:

• In the cloud (Xopero Cloud Storage, AWS S3, Wasabi Cloud, Backblaze B2, Google Cloud Storage, Azure Blob Storage, or any S3-compatible public cloud).

• Locally (NFS, CIFS, SMB network shares, or local disk resources).

• In a hybrid or multi-cloud environment.

Xopero ONE provides selection rules, allowing administrators to determine which repositories and projects are included or excluded from backup and recovery tasks. Rules can be based on names, owners, creation dates, branches, or specific patterns, offering granular control over the backup scope and ensuring that only relevant repositories and projects are processed.

Below are the selection rules and rule patterns you can use in Xopero ONE to select repositories and projects for inclusion in backup jobs within your DevOps organization.

1. Repository name — you can use the full or partial name of a repository. Wildcard characters can be used at the end of the rule to match repository names:

Adding an Azure DevOps organization to Xopero ONE connects your environment to the platform, enabling secure backup of projects, repositories, and related data.

Using OAuth

When adding an organization, you may be prompted to grant additional permissions to the Xopero ONE application — make sure your browser allows Xopero to open pop-up windows.

Depending on your browser, you can either adjust the settings to allow pop-ups or permit the authorization window to open once.

Integrating a GitHub Enterprise organization with Xopero ONE allows centralized backup and management of all repositories within the selected GitHub environment. Once the organization is connected, administrators can set backup schedules, apply retention policies, organize repositories into groups, and monitor synchronization status and backup times directly from the dashboard to ensure consistent protection and compliance with data security policies.

Important notice

Integration with GitHub Enterprise Cloud and GitHub Enterprise Server in Xopero ONE is only possible through a personal access token (PAT).

Additionally, if a GitHub Enterprise Cloud organization with data residency includes managed users with SSO enabled, the token must be authorized. Although authorizing the token in a single organization allows Xopero ONE to retrieve all organizations, we recommend authorizing each one you intend to protect. Token authorization is also required in any organization to which you plan to restore data.

Integration process

The below steps demonstrate how to quickly integrate a GitHub Enterprise organization with Xopero ONE using Xopero ONE Management Service.

Recovering an organization wiki restores lost or overwritten documentation, enabling projects to quickly regain access to their knowledge base without affecting other repository or project metadata.

Recovery process for Bitbucket, GitHub, and GitLab

The following steps demonstrate how to quickly recover your wiki using Xopero ONE Management Service.

The following steps demonstrate how to quickly recover your Azure DevOps project wiki using Xopero ONE Management Service.

Recovering multiple Azure DevOps repositories simultaneously enables organizations to quickly restore only the selected repositories, ensuring consistent and reliable recovery across the development environment.

Recovery process

The following steps demonstrate how to restore multiple Azure DevOps repositories at once using Xopero ONE Management Service.

Xopero ONE enables multiple repositories recovery for Bitbucket DC, allowing administrators to restore several repositories simultaneously within a selected project or instance scope. The process preserves complete Git history, branches, tags, and supported metadata, ensuring consistency and data integrity across restored repositories.

Recovery process

The below steps demonstrate how to restore multiple Bitbucket DC repositories at once using Xopero ONE Management Service.

Recovery process

To protect a Bitbucket environment with Xopero ONE, the account or token used to authorize the connection must have sufficient permissions to access the workspaces, repositories, and related resources designated for backup. The specific permission scopes vary depending on the chosen authorization method.

OAuth permissions

When integrating Bitbucket using the OAuth authentication method, Xopero ONE requires the following permissions to securely access and protect your repository data:

• Account

  • Read and modify account information.

• Issues

  • Read and modify repositories' issues.

• Pipelines

  • Access repositories' build pipelines and configure their variables.

• Project settings

  • Read and modify workspace's project settings.

  • Read and transfer repositories within workspace's projects.

• Repositories & pull requests

  • Administer repositories.

  • Delete repositories.

  • Read and modify repositories and their pull requests.

• Manage runners

  • Access and edit workspaces and repositories' runners.

• Snippets

  • Read and modify code snippets.

• Team membership

  • Read and modify team membership details.

• Workspaces

  • Access your workspaces for authentication.

  • Access and edit your workspaces and repositories' test.

• Webhooks

  • Read and modify repositories' webhooks.

• Wikis

  • Read and modify repositories' wikis.

Every API token created for Bitbucket integration with Xopero ONE requires specific permission scopes to restrict data access and define the exact operations the token can execute.

To ensure successful backup and recovery tasks, API token must be provisioned with the below required permissions.

• read:webhook:bitbucket (hooks)

• read:user:bitbucket (required to link the organization)

• read:repository:bitbucket (repositories, downloads, synchronization)

• read:pullrequest:bitbucket (pull requests)

• read:pipeline:bitbucket (schedules)

• read:pullrequest:bitbucket (pull requests)

• read:webhook:bitbucket (hooks)

• read:issue:bitbucket (issues)

Connecting GitHub with Xopero ONE requires appropriate permissions to access and protect repositories and their associated metadata. The required permissions depend on the authorization method used, such as a GitHub App or personal access token (PAT), and on the type of data that needs to be protected.

Account permissions

Integrating GitHub with Xopero ONE to back up and restore repositories, projects, and associated metadata requires an account with full administrative privileges.

Exact roles and permission levels may vary depending on individual repository settings, project configurations, or organization-level security policies. Below are examples of different roles, along with the corresponding permissions and the capabilities they provide in Xopero ONE.

Permissions for the OAuth app

To ensure seamless integration and correct operation, the Xopero ONE OAuth application* requires the following permissions:

• Full control of projects.

• Read team discussions.

• Read org and team membership, read org projects.

• Read all user profile data.

• Full control of private repositories.

• Access user email addresses (read-only).

• Update GitHub Actions workflows.

_{*The Xopero ONE OAuth application for GitHub is called GitProtect.}

Xopero ONE GitHub App* installation requires the following permissions:

• Read access to actions, deployments, metadata, and repository projects.

• Read and write access to administration, code, issues, pull requests, repository hooks, and workflows.

_{*The Xopero ONE GitHub App is called GitProtect.}

Personal access tokens are generated in GitHub account settings under Settings > Developer settings > Personal access tokens and can be assigned different permissions.

Registering the Xopero ONE application and executing full repository backup and restore tasks requires a token configured with at least repo and workflow permissions.

The following list outlines the permissions required to back up repository metadata within an organization:

• repo (access repositories)

• project (read the projects associated with the repository)

• admin:org (read the organization's projects)

• read:discussion (read team discussions)

Restoring multiple Azure DevOps projects enables organizations to quickly recover projects, repositories, and source code at scale, ensuring consistent and reliable restoration across the development environment.

The below steps demonstrate how to restore multiple Azure DevOps projects at once using Xopero ONE Management Service.

Xopero ONE allows organizations to restore individual Azure DevOps repositories along with their associated metadata. The process ensures repository integrity and consistency while minimizing impact on other projects, supporting efficient disaster recovery, migration, and point-in-time restore operations.

The following steps demonstrate how to quickly restore a single Azure DevOps repository using Xopero ONE Management Service.

Azure DevOps protected resources define which parts of the environment Xopero ONE can access, backup, and restore.

The following tables list all Azure DevOps and Azure DevOps Server resources covered by backup.

Xopero ONE enables multiple Bitbucket repositories recovery, allowing administrators to restore several repositories simultaneously within a selected organization or project scope. The process preserves Git history, branches, tags, and supported metadata, ensuring data integrity and consistency across the restored resources.

The below steps demonstrate how to restore multiple Bitbucket repositories at once using Xopero ONE Management Service.

Xopero ONE enables single repository recovery for Bitbucket DC, allowing restoration of an individual repository together with its complete Git history, branches, tags, and supported metadata. The recovery process maintains repository integrity while ensuring that other projects and repositories within the Bitbucket DC instance remain unaffected.

The following steps demonstrate how to quickly restore a single Bitbucket DC repository using Xopero ONE Management Service.

GitHub can be integrated with Xopero ONE using several authorization methods, including a GitHub App, which provides a secure and scalable way to connect GitHub organizations for backup and recovery operations. With granular permissions, repository-level access, and short-lived authentication tokens, GitHub Apps help protect repositories and related metadata while supporting automated backup workflows, repository synchronization, and streamlined management across the Xopero ONE environment.

A GitHub App is a type of integration you can build to interact with and extend GitHub's functionality. GitHub Apps can provide flexibility and reduce friction in your processes without requiring users to sign in or create a service account.

Like OAuth apps, GitHub Apps use OAuth 2.0 and can act on a user's behalf. Unlike OAuth apps, GitHub Apps can also act independently of a user.

The key advantages of using the GitHub App for integration with Xopero ONE include enhanced security, better rate limit handling, and more reliable repository management.

Single repository recovery for Bitbucket enables restoration of an individual repository together with its complete Git history, branches, tags, and associated metadata, without impacting other projects or repositories within the workspace.

The below steps demonstrate how to quickly restore a single Bitbucket repository using Xopero ONE Management Service.

According to the official GitHub page, projects (classic) are being discontinued.

You can only create a new project (classic) for an organization, repository, or user that already has at least one project (classic). If you are unable to create a project (classic), create a project v2 instead.

When repositories containing projects (classic) are restored to an organization that does not support this feature, direct restoration in the original format is not possible. Instead, the system converts the restoration from projects (classic) to projects v2.

Key considerations include: