I'm using Bitbucket server and want to know which users have created HTTP access tokens

[Jayanth]

Hi Community,

I need to know is there any REST endpoint for Bitbucket server to fetch all users who have created HTTP access tokens.

I have more than 2000 users using Bitbucket and it is time consuming if I go and search each and every users account details. So, that's why need to know if any endpoint is available to ease this work.

Could you please help me with this?

Thanks,
Jayanth

[Arkadiusz Wroblewski]

Hello @Jayanth 

you may want to clarify the deployment first, because your post says Bitbucket server, but the thread is tagged Bitbucket Cloud?

If you really mean Server / Data Center, then I do not know a single endpoint that gives you one full list of all users who created personal HTTP access tokens across the whole instance. What you usually have is a per-user check, so for 2000 users this normally means querying it user by user.

If you actually mean Cloud, then you are looking at a different token model entirely.

[Jayanth]

Hello @Arkadiusz Wroblewski

Thanks for your response.

Yes, I'm asking this for Bitbucket Data Center. If there is no endpoint for full list of users with HTTP token created, is there any other endpoint to get HTTP token details for single user search?

[Arkadiusz Wroblewski]

Hello @Jayanth 

Yes, there is a per-user endpoint for Bitbucket Data Center.

GET /rest/access-tokens/1.0/users/{userSlug}

This returns the HTTP access tokens created by that user. There's no single admin endpoint that lists all tokens across all users in one call, but you can script around that: paginate through all users via GET /rest/api/1.0/admin/users and call the tokens endpoint for each user slug. It's not elegant for 2000 users, but it's fully automatable in a simple script.

Just make sure the account running the queries has admin-level access, as the access-tokens endpoint requires it for querying other users' tokens.

[Jayanth]

Hello @Arkadiusz Wroblewski ,

I tried this endpoint in browser, it is working.

However, when I tried using postman, I'm getting 401 error. I'm not sure why this is happening. I created a HTTP access token and used as bearer token in postman request.

Note: We're using SSO to login to Bitbucket.

[Arkadiusz Wroblewski]

@Jayanth 

The endpoint itself does not look like the problem.

If it works in the browser but not in Postman, the most likely reason is that the browser call is riding on your existing SSO session, while Postman is only sending the token. In this case, a 401 does not automatically mean the endpoint is broken. It can also mean that the authentication method is wrong for that endpoint, or that the caller is not allowed to read token information for that user.

I would not focus too much on SSO as the blocker here. I would first retry it with an admin account using Basic auth or OAuth instead of a bearer token. If that still fails, then I would double-check the {userSlug} value as well, because that needs to be the actual user slug, not just the username.