# SailPoint Bitbucket Cloud Connector Documentation

> Bitbucket Cloud Connector Documentation

# Documentation

# Connecting SailPoint and Bitbucket Cloud

To connect SailPoint with Bitbucket Cloud, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Actions**.
5. In the **Actions** dropdown list, select the setup method:

   - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**.

   > **Note**
   >
   > The source name must be unique. You can change these settings later in the source configuration.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section.
5. Select **Finish**.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
6. (Optional) Select **Create Manual Work Items** to allow the connector to create manual work items for certain operations. You can also enable this option so the source supports additional source management features such as creating accounts and access profile management.

   > **Important**
   >
   > Once you enable this feature, you cannot disable it.

   For more information on manual work items in SailPoint, refer to [Work Items](<https://developer.sailpoint.com/docs/api/work-items>). For more information on SailPoint features, refer to [SailPoint Identity Services](<https://documentation.sailpoint.com/saas/help/index.html>).
7. Select **Save**.

## Connection Settings

SailPoint requires the following information to connect to Bitbucket Cloud and to your Atlassian organization.

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings page with the Base URL, Atlassian Account Email, Bitbucket API Token, Atlassian Organization ID, and Atlassian Organization API Key fields](<https://documentation.sailpoint.com/connectors/bitbucket_cloud/saas/help/img/connection_settings.png>)](<https://documentation.sailpoint.com/connectors/bitbucket_cloud/saas/help/img/connection_settings.png>)

1. Select **Connection Settings** from the menu.
2. In **Base URL**, enter the Bitbucket Cloud REST API 2.0 base URL, for example `https://api.bitbucket.org/2.0`. The URL must use HTTPS. Express Setup does not display this field.
3. In **Atlassian Account Email**, enter the email address of the Atlassian account that owns the Bitbucket API token.
4. In **Bitbucket API Token**, enter the account-level Bitbucket API token.
5. In **Atlassian Organization ID**, enter the organization UUID from Atlassian Administration.
6. In **Atlassian Organization API Key**, enter the organization API key from Atlassian Administration.
7. Select **Save**.

**Test Connection** validates both sets of credentials. It lists the workspaces that the Bitbucket account can access, and it searches the Atlassian organization you configure for Bitbucket groups.

## Dataset Aggregation Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Dataset Aggregation Settings page with the Workspace Filter field](<https://documentation.sailpoint.com/connectors/bitbucket_cloud/saas/help/img/aggregation_settings.png>)](<https://documentation.sailpoint.com/connectors/bitbucket_cloud/saas/help/img/aggregation_settings.png>)

| Field | Default | Description |
| --- | --- | --- |
| **Workspace Filter** | Every workspace that the authenticated Bitbucket account can access | Select one or more workspace slugs to include in dataset aggregation. |

> [!NOTE]
>
> To load the workspace list, first save a valid **Atlassian Account Email** and **Bitbucket API Token** on the [Connection Settings](<https://documentation.sailpoint.com/connectors/bitbucket_cloud/saas/help/connecting.html#connection-settings>) page. Then select **Test Connection** or refresh the workspace list.

## Advanced Settings

Configure how the connector sends requests to Bitbucket Cloud and to your Atlassian organization.

> [!NOTE]
>
> **Screenshot**
>
> [![Advanced Settings page with the Connection Timeout in Minutes and Page Size fields](<https://documentation.sailpoint.com/connectors/bitbucket_cloud/saas/help/img/additional_settings.png>)](<https://documentation.sailpoint.com/connectors/bitbucket_cloud/saas/help/img/additional_settings.png>)

| Field | Default | Description |
| --- | --- | --- |
| **Connection Timeout in Minutes** | 1 | Enter the number of minutes to wait for each Bitbucket Cloud and Atlassian Organizations REST API request. |
| **Page Size** | 100 | Enter the number of records that the connector requests on each page. Valid values are 1 through 100. |

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Dataset Management

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your Bitbucket Cloud source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

| Dataset name | Dataset ID | Associated resources |
| --- | --- | --- |
| Bitbucket Credentials | `bitbucket:credential` | Bitbucket Project Deploy Key, Bitbucket Repository Deploy Key, Bitbucket Pipeline Variable |

## Supported Resources

Bitbucket Cloud resources represent non-human identities: project deploy keys, repository deploy keys, and pipeline variables.

Go to **Dataset Management \> Resources** on your Bitbucket Cloud source to view each non-human identity resource that the connector aggregates. Select a resource to review its schema on the **Schema** page.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> **Workspace Filter** applies to these resource aggregations.

| Resource name | Resource type | Resource ID |
| --- | --- | --- |
| [Bitbucket Project Deploy Key](<#bitbucket-project-deploy-key>) | Credential | `bitbucket:project-deploy-key` |
| [Bitbucket Repository Deploy Key](<#bitbucket-repository-deploy-key>) | Credential | `bitbucket:repository-deploy-key` |
| [Bitbucket Pipeline Variable](<#bitbucket-pipeline-variable>) | Credential | `bitbucket:pipeline-variable` |

## Bitbucket Project Deploy Key

| Property | Value |
| --- | --- |
| Resource ID | `bitbucket:project-deploy-key` |
| Dataset ID | `bitbucket:credential` |
| Resource type | Credential (`std:credential`) |
| Identity attribute | `id` |
| Display attribute | `label` |

### Attributes

| Attribute | Type | Description |
| --- | --- | --- |
| `id` | integer | Unique project deploy key identifier. |
| `type` | string | Resource type that identifies the object as a project deploy key. |
| `label` | string | Display label assigned to the deploy key. |
| `comment` | string | Additional description associated with the deploy key. |
| `created_on` | string | Date and time when the deploy key was created. |
| `last_used` | string | Date and time when the deploy key was last used, when available. |
| `workspace_slug` | string | Owning workspace slug. |
| `project_key` | string | Key of the associated project. |
| `project_name` | string | Display name of the associated project. |

## Bitbucket Repository Deploy Key

| Property | Value |
| --- | --- |
| Resource ID | `bitbucket:repository-deploy-key` |
| Dataset ID | `bitbucket:credential` |
| Resource type | Credential (`std:credential`) |
| Identity attribute | `id` |
| Display attribute | `label` |

### Attributes

| Attribute | Type | Description |
| --- | --- | --- |
| `id` | integer | Unique repository deploy key identifier. |
| `type` | string | Resource type that identifies the object as a repository deploy key. |
| `label` | string | Display label assigned to the deploy key. |
| `comment` | string | Additional description associated with the deploy key. |
| `created_on` | string | Date and time when the deploy key was created. |
| `last_used` | string | Date and time when the deploy key was last used, when available. |
| `workspace_slug` | string | Owning workspace slug. |
| `repository_full_name` | string | Workspace-qualified name of the associated repository. |

## Bitbucket Pipeline Variable

| Property | Value |
| --- | --- |
| Resource ID | `bitbucket:pipeline-variable` |
| Dataset ID | `bitbucket:credential` |
| Resource type | Credential (`std:credential`) |
| Identity attribute | `variable_uuid` |
| Display attribute | `variable_name` |

### Attributes

| Attribute | Type | Description |
| --- | --- | --- |
| `type` | string | Resource type that identifies the object as a pipeline variable. |
| `variable_uuid` | string | Unique variable identifier and resource ID. |
| `variable_name` | string | Variable name or key. |
| `secured` | boolean | Whether Bitbucket marks the variable as secured. |
| `system` | boolean | Indicates whether Bitbucket manages the variable as a system variable. |
| `scope` | string | Scope that the API reports, such as `ACCOUNT` or `REPOSITORY`. |
| `variable_scope` | string | Normalized connector scope: `workspace`, `repository`, or `environment`. |
| `workspace_slug` | string | Owning workspace slug. |
| `repo_slug` | string | Repository slug for repository-scoped or environment-scoped variables. |
| `repository_full_name` | string | Workspace-qualified repository name for a repository-scoped or environment-scoped variable. |
| `deployment_environment` | string | Environment UUID for an environment-scoped variable. |
| `deployment_environment_name` | string | Environment name for an environment-scoped variable. |

# Integrating SailPoint with Bitbucket Cloud

Bitbucket Cloud is Atlassian's Git-based source control and continuous integration and continuous delivery (CI/CD) platform. Teams use workspaces, projects, repositories, and Pipelines to store code and run builds. The Bitbucket Cloud connector uses the [Bitbucket Cloud REST API 2.0](<https://developer.atlassian.com/cloud/bitbucket/rest/intro/>) and the [Atlassian Organizations REST API v2](<https://developer.atlassian.com/cloud/admin/organization/rest/intro/>) to aggregate those objects into SailPoint for governance and certifications.

Use this documentation for the requirements and field definitions that you need to configure a Bitbucket Cloud source in SailPoint.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Objects

Use the Bitbucket Cloud source to govern the following objects:

- Bitbucket workspace members as accounts
- Atlassian organization Bitbucket groups as entitlements
- Workspace permissions as a multi-valued account attribute, without a separate entitlement schema
- Project deploy keys, repository deploy keys, and pipeline variables as non-human identities

The connector is read-only and has no provisioning operations. Bitbucket omits secured pipeline variable values from API responses.

## Supported Features

| Feature | Description |
| --- | --- |
| Test Connection | Validates the Bitbucket Cloud credentials and the Atlassian organization credentials. |
| Account aggregation | Aggregates unique workspace members as accounts. |
| Entitlement aggregation | Aggregates Atlassian organization Bitbucket groups as entitlements. |
| Dataset aggregation | Aggregates project deploy keys, repository deploy keys, and pipeline variables through a single dataset. For more information, refer to [Additional Permissions for SailPoint NHI Discovery](<#additional-permissions-for-sailpoint-non-human-identity-nhi-discovery>). |
| Dataset aggregation with workspace filter | Restricts dataset aggregation to the workspaces that you select. |

The connector does not support provisioning operations.

### Non-Human Identity Discovery

- Aggregate Bitbucket project deploy keys, repository deploy keys, and pipeline variables

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Aggregation Scope

| Scope | Applies to | Behavior |
| --- | --- | --- |
| User | Account aggregation and account read | Includes members of every workspace that the authenticated user belongs to. The configured organization does not restrict this scope. |
| Membership and groups | Account `groups` and group entitlements | Includes only groups from the configured Atlassian organization. |
| Non-human identity | Dataset aggregation | Includes every accessible workspace by default. **Workspace Filter** restricts only this scope. |

## Prerequisites

Before you configure the Bitbucket Cloud source, create an account-level Bitbucket API token and an Atlassian organization API key.

### Creating a Bitbucket API Token

The connector uses HTTP Basic authentication for Bitbucket REST API requests. It sends the Atlassian account email as the user name and the Bitbucket API token as the password.

1. Sign in to Bitbucket Cloud with an account that belongs to every workspace you want to govern.
2. In the upper right, open the profile menu, and then select **Account settings**.
3. On your Atlassian account page, open the **Security** tab, and then select **Create and manage API tokens**.
4. Select **Create API token with scopes**.
5. Enter a name and an expiration date of up to one year, and then select **Next**.
6. Select **Bitbucket** as the app, and then select **Next**.
7. Select the read scopes listed in [Required Permissions](<#required-permissions>), and then create the token.
8. Copy the token immediately. Atlassian displays the token only once.

For more information, refer to [Create an API token](<https://support.atlassian.com/bitbucket-cloud/docs/create-an-api-token/>) and [API token permissions](<https://support.atlassian.com/bitbucket-cloud/docs/api-token-permissions/>) in the Atlassian documentation.

### Creating an Atlassian Organization API Key

1. Sign in to [Atlassian Administration](<https://admin.atlassian.com>) as an organization admin.
2. Select the organization that owns the Bitbucket Cloud workspaces you want to govern.
3. Go to **Organization settings \> API keys**.
4. Select **Create API key**.
5. Enter a name and an expiration date of up to one year.
6. Select the scopes listed in [Required Permissions](<#required-permissions>).
7. Copy the **Organization ID** and the API key immediately. Atlassian displays the API key only once.

For more information, refer to [Manage an organization with the admin APIs](<https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/>) and [Atlassian Organizations REST API](<https://developer.atlassian.com/cloud/admin/organization/rest/intro/>) in the Atlassian documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

Grant the Bitbucket account permission to list workspaces and to read members, permissions, projects, repositories, keys, and pipelines in the workspaces you want to govern.

### Bitbucket API Token Scopes

| Scope | Description |
| --- | --- |
| `read:user:bitbucket` | Reads the authenticated user and user profiles. |
| `read:workspace:bitbucket` | Lists workspaces and reads workspace members and workspace permissions. **Test Connection** and account aggregation require this scope. |
| `read:project:bitbucket` | Lists projects, which the connector uses to resolve project group permission grants. |
| `read:repository:bitbucket` | Lists repositories, which the connector uses to resolve project group permission grants and repository-scoped pipeline variables. |
| `read:pipeline:bitbucket` | Reads Bitbucket Pipelines data. |
| `admin:project:bitbucket` | Discovers project deploy keys. |
| `admin:repository:bitbucket` | Reads repository deploy keys. |

### Organization API Key Scopes

| Scope | Description |
| --- | --- |
| `read:groups:admin` | Searches organization groups through the Atlassian Organizations REST API v2 and filters them to Bitbucket. |
| `read:accounts:admin` | Searches directory users through the Atlassian Organizations REST API v2 to resolve group memberships on accounts. |
| `read:directories:admin` | Gets directories and users in a directory. |

Create the organization API key with an organization admin account.

## Additional Permissions for SailPoint Non-Human Identity (NHI) Discovery

The following permissions are required when you enable SailPoint NHI Discovery features on the Bitbucket Cloud connector. Grant only the permissions that correspond to the features you plan to use. For supported features, refer to [Supported Features](<#supported-features>).

The following table lists additional Bitbucket API token scopes:

| Permission | Type | Purpose |
| --- | --- | --- |
| `read:gpg-key:bitbucket` | API token | Read GPG keys. |
| `read:issue:bitbucket` | API token | Read repository issues. |
| `read:package:bitbucket` | API token | Read packages. |
| `read:permission:bitbucket` | API token | Read permission data. |
| `read:pullrequest:bitbucket` | API token | Read pull requests. |
| `read:runner:bitbucket` | API token | Read Pipelines runners. |
| `read:snippet:bitbucket` | API token | Read snippets. |
| `read:ssh-key:bitbucket` | API token | Read deploy keys and SSH keys. |
| `read:webhook:bitbucket` | API token | Read webhooks. |
| `read:wiki:bitbucket` | API token | Read repository wikis. |

# Schema Reference

The connector uses the following identity attributes for its account and group schemas.

| Identity attribute | Schema object type |
| --- | --- |
| `account_id` | Account |
| `group_slug` | Group |

Accounts represent Bitbucket workspace members. The connector does not aggregate organization directory users who are not workspace members.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account Attributes

The Bitbucket Cloud connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute | Type | Description | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| `account_id` | string | Unique identifier for the Bitbucket user account. | No | No |
| `uuid` | string | Unique UUID of the user. | No | No |
| `display_name` | string | Display name of the user. | No | No |
| `nickname` | string | Nickname of the user. | No | No |
| `is_staff` | boolean | Indicates whether the user is a Bitbucket staff member. | No | No |
| `location` | string | Location associated with the user. | No | No |
| `account_status` | string | Current status of the user account. | No | No |
| `created_on` | string | Date and time when the user account was created. | No | No |
| `type` | string | Resource type that identifies the object as a user. | No | No |
| `workspace` | string | Workspace slugs that the user belongs to across every workspace visible to the Bitbucket token. | No | Yes |
| `groups` | string | Atlassian organization groups that the user belongs to. | Yes | Yes |
| `workspace_permission` | string | Workspace-level permission for the user, such as `workspace_slug:owner`. The connector does not provide an entitlement schema for this attribute. | Yes | Yes |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Bitbucket Cloud connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute | Type | Description | Multi-valued |
| --- | --- | --- | --- |
| `group_slug` | string | Unique identifier for the group, which is the Atlassian Administration group UUID. | No |
| `name` | string | Display name of the group. | No |
| `description` | string | Group description from Atlassian Administration. | No |
| `directory_id` | string | Atlassian directory that owns the group. | No |
| `deletable` | boolean | Indicates whether administrators can delete the group. | No |
| `modifiable` | boolean | Indicates whether administrators can modify the group. | No |
| `readable` | boolean | Indicates whether administrators can read the group. | No |
| `external_synced` | boolean | Indicates whether an external identity provider synchronizes the group. | No |
| `managed_by` | string | Entity that manages the group, such as `admins` or `external`. | No |
| `projects` | string | Projects with an explicit group permission grant, formatted as `workspace_slug:project_key`. | Yes |
| `repositories` | string | Repositories with an explicit group permission grant, formatted as the workspace-qualified repository name. | Yes |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Test Connection fails for Bitbucket Cloud

**Resolution**: Confirm that **Atlassian Account Email** belongs to the account that owns the **Bitbucket API Token**. Confirm that the token includes `read:workspace:bitbucket` and that the account can access at least one workspace.

## Test Connection fails for the Atlassian organization

**Resolution**: Confirm that **Atlassian Organization ID** identifies the organization that owns the Bitbucket workspaces. Confirm that the organization API key is valid and includes `read:groups:admin`, `read:accounts:admin`, and `read:directories:admin`.

## Workspace Filter does not load workspaces

**Error**: `` `{ExceptionType=sailpoint.connector.ConnectorException, LocalizedMessage=[ConnectorError] error receiving response from connector: stream client connection is broken (connector process may have crashed) (requestId: 138548c59c924bcca257af43bb895410)}` ``

**Resolution**: Save a valid **Atlassian Account Email** and **Bitbucket API Token**. Then select **Test Connection** or refresh the workspace list.

## Pipeline variables are missing

**Resolution**: Confirm that the Bitbucket API token includes `read:pipeline:bitbucket`. For repository-scoped pipeline variables, confirm that the token also includes `read:repository:bitbucket`.

## Secured pipeline variable values are missing

**Resolution**: Bitbucket omits secured pipeline variable values from API responses. No action is required.