Bitbucket webhook managed by Jenkins returns "The requested URL could not be retrieved" code: 403

[Phillip Short]

Ive used jenkins to manage my bitbucket webhooks. As far as I can tell this has worked. When I go into my repos webhook settings I see "http://<my jenkins url>/bitbucket-scmsource-hook/notify"  this is configured to trigger a multi pipeline build on Jenkins when ever code is pushed to this repo, however, when looking at "view requests" on this hook I get the following with the code 403

"ERROR: The requested URL could not be retrieved"

In manage jenkings -> system my jenkins url matches that of my jenkins location and custom jenkins root url in bitbucket endpoints and my bitbucket credentials are correct.

Anyone got any ideas?

Thanks,
Phillip

[Jim Knepley - ReleaseTEAM]

Code 403 is normally a "permission denied" response (canonically "Forbidden") but it's not clear if the problem is an authentication failure or an authorization failure.

I would look for logs on the Bitbucket side to see if it's either an expired or invalid token, or if that token is missing a permission. It's more likely to be the token If you don't see any logs.

[Theodora Boudale]

Hi Phillip and welcome to the community!

Are you using a public IP address or domain name in the webhook URL? I see 403 errors quite often because users use a local IP. Bitbucket webhooks send requests over the internet, so they can't reach a private IP address in your internal network, and then we'll show a 403 error.

If you use a secret in the webhook, please ensure it is correct.

If you still cannot figure it out, you can do either of the following:

• Let me know the last two letters of the repo name (or any other combination of letters that will help me identify it among the ones you have access to) and I can check logs from our side. Please ensure there are requests within the last 30 days.
  
  
• Alternatively, you can create a ticket with the support team for further investigation. You can create a ticket via https://support.atlassian.com/contact/#/, in "What can we help you with?" select "Technical issues and bugs" and then Bitbucket Cloud as product. When you are asked to provide the workspace URL, please make sure you enter the URL of the workspace that is on a paid billing plan to proceed with ticket creation.
  
  Please also include the repo URL and the webhook URL in the ticket. The support ticket will be visible to you and Atlassian staff only, so anything you post there won't be publicly visible.

Kind regards,
Theodora

[Phillip Short]

Hi Theodora.
Sorry for the late reply.

Im running Jenkins locally on my PC, Im assuming thats what Bitbucket is having problems connecting to as its private in the context of the whole network. I would need to provide the IP of my server in the webhook URL right, and forward it to my local PC from there.

Am I barking up the right tree here?

Best,
Phillip 

[Theodora Boudale]

Hi Phillip,

Indeed, Bitbucket won't be able to connect to a private IP on your network.

If you can't or don't want to make Jenkins accessible with a public IP address, then you can set up a server on the same network with a public IP address to receive the webhook requests and forward them to Jenkins on your PC.

If that server is behind a firewall, you will need to allowlist the IP addresses that Bitbucket uses for webhook delivery. You can find these IPs here, in the section "Outgoing Connections":

• https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/#Outgoing-Connections

Kind regards,
Theodora