Integrating SailPoint with Bitbucket Cloud

Bitbucket Cloud is Atlassian's Git-based source control and continuous integration and continuous delivery (CI/CD) platform. Teams use workspaces, projects, repositories, and Pipelines to store code and run builds. The Bitbucket Cloud connector uses the Bitbucket Cloud REST API 2.0 and the Atlassian Organizations REST API v2 to aggregate those objects into SailPoint for governance and certifications.

Use this documentation for the requirements and field definitions that you need to configure a Bitbucket Cloud source in SailPoint.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Objects

Use the Bitbucket Cloud source to govern the following objects:

Bitbucket workspace members as accounts
Atlassian organization Bitbucket groups as entitlements
Workspace permissions as a multi-valued account attribute, without a separate entitlement schema
Project deploy keys, repository deploy keys, and pipeline variables as non-human identities

The connector is read-only and has no provisioning operations. Bitbucket omits secured pipeline variable values from API responses.

Supported Features

Feature	Description
Test Connection	Validates the Bitbucket Cloud credentials and the Atlassian organization credentials.
Account aggregation	Aggregates unique workspace members as accounts.
Entitlement aggregation	Aggregates Atlassian organization Bitbucket groups as entitlements.
Dataset aggregation	Aggregates project deploy keys, repository deploy keys, and pipeline variables through a single dataset. For more information, refer to Additional Permissions for SailPoint NHI Discovery.
Dataset aggregation with workspace filter	Restricts dataset aggregation to the workspaces that you select.

The connector does not support provisioning operations.

Non-Human Identity Discovery

Aggregate Bitbucket project deploy keys, repository deploy keys, and pipeline variables

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Aggregation Scope

Scope	Applies to	Behavior
User	Account aggregation and account read	Includes members of every workspace that the authenticated user belongs to. The configured organization does not restrict this scope.
Membership and groups	Account `groups` and group entitlements	Includes only groups from the configured Atlassian organization.
Non-human identity	Dataset aggregation	Includes every accessible workspace by default. Workspace Filter restricts only this scope.

Prerequisites

Before you configure the Bitbucket Cloud source, create an account-level Bitbucket API token and an Atlassian organization API key.

Creating a Bitbucket API Token

The connector uses HTTP Basic authentication for Bitbucket REST API requests. It sends the Atlassian account email as the user name and the Bitbucket API token as the password.

Sign in to Bitbucket Cloud with an account that belongs to every workspace you want to govern.
In the upper right, open the profile menu, and then select Account settings.
On your Atlassian account page, open the Security tab, and then select Create and manage API tokens.
Select Create API token with scopes.
Enter a name and an expiration date of up to one year, and then select Next.
Select Bitbucket as the app, and then select Next.
Select the read scopes listed in Required Permissions, and then create the token.
Copy the token immediately. Atlassian displays the token only once.

For more information, refer to Create an API token and API token permissions in the Atlassian documentation.

Creating an Atlassian Organization API Key

Sign in to Atlassian Administration as an organization admin.
Select the organization that owns the Bitbucket Cloud workspaces you want to govern.
Go to Organization settings > API keys.
Select Create API key.
Enter a name and an expiration date of up to one year.
Select the scopes listed in Required Permissions.
Copy the Organization ID and the API key immediately. Atlassian displays the API key only once.

For more information, refer to Manage an organization with the admin APIs and Atlassian Organizations REST API in the Atlassian documentation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

Grant the Bitbucket account permission to list workspaces and to read members, permissions, projects, repositories, keys, and pipelines in the workspaces you want to govern.

Bitbucket API Token Scopes

Scope	Description
`read:user:bitbucket`	Reads the authenticated user and user profiles.
`read:workspace:bitbucket`	Lists workspaces and reads workspace members and workspace permissions. Test Connection and account aggregation require this scope.
`read:project:bitbucket`	Lists projects, which the connector uses to resolve project group permission grants.
`read:repository:bitbucket`	Lists repositories, which the connector uses to resolve project group permission grants and repository-scoped pipeline variables.
`read:pipeline:bitbucket`	Reads Bitbucket Pipelines data.
`admin:project:bitbucket`	Discovers project deploy keys.
`admin:repository:bitbucket`	Reads repository deploy keys.

Organization API Key Scopes

Scope	Description
`read:groups:admin`	Searches organization groups through the Atlassian Organizations REST API v2 and filters them to Bitbucket.
`read:accounts:admin`	Searches directory users through the Atlassian Organizations REST API v2 to resolve group memberships on accounts.
`read:directories:admin`	Gets directories and users in a directory.

Create the organization API key with an organization admin account.

Additional Permissions for SailPoint Non-Human Identity (NHI) Discovery

The following permissions are required when you enable SailPoint NHI Discovery features on the Bitbucket Cloud connector. Grant only the permissions that correspond to the features you plan to use. For supported features, refer to Supported Features.

The following table lists additional Bitbucket API token scopes:

Permission	Type	Purpose
`read:gpg-key:bitbucket`	API token	Read GPG keys.
`read:issue:bitbucket`	API token	Read repository issues.
`read:package:bitbucket`	API token	Read packages.
`read:permission:bitbucket`	API token	Read permission data.
`read:pullrequest:bitbucket`	API token	Read pull requests.
`read:runner:bitbucket`	API token	Read Pipelines runners.
`read:snippet:bitbucket`	API token	Read snippets.
`read:ssh-key:bitbucket`	API token	Read deploy keys and SSH keys.
`read:webhook:bitbucket`	API token	Read webhooks.
`read:wiki:bitbucket`	API token	Read repository wikis.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.