Need endpoints for Group membership

[James_Rodgers]

I am trying to automate user access reviews for various software tools. At the moment it seems it will be impossible to automate Bitbucket because there is no endpoint that gives group membership information. I can find which repos are in what groups and get a list of all users, but there are no endpoints for getting all groups or group memberships, so it is not possible to pull together a full access review without getting into the ui. This seems like a huge hole in the API.

[James_Rodgers · Accepted solution]

For posterity, I did get this to work using the v1.0 api endpoint https://api.bitbucket.org/1.0/groups/{workspace} and an OAuth token created in bitbucket workspace settings / Apps and features / OAuth consumers. I granted it read permissions on Account, Workspace membership and Repositories. 

[Arkadiusz Wroblewski]

@James_Rodgers 

Awesome. Most important, it's working.

[Arkadiusz Wroblewski]

Hello @James_Rodgers 

You’ll want to start by calling GET [https://api.bitbucket.org/1.0/groups/](https://api.bitbucket.org/1.0/groups/){workspace_id}/ to pull your list of groups. Once you have those, you can iterate through the group slugs using the /members endpoint to see exactly who is assigned to each one. To get the full "effective access" picture, you'll then need to cross-reference those members with the 2.0 repository permission endpoints to see what those groups are actually allowed to do.

[James_Rodgers]

I tried the v1.0 endpoints, they are no longer available.

[Arkadiusz Wroblewski]

Well @James_Rodgers 

So they really gone ATM.

Then actually Missing in v2:
- list all Bitbucket groups
- list members of each Bitbucket group

Actually V2 Endpoints missing That.

[Ulrich Kuhnhardt _IzymesCo_]

@James_Rodgers 

the V1 api endpoints are 'deprecated' since god knows when, but they are still working.

Can you share your request to the v1 groups endpoint?

We're still using https://api.bitbucket.org/1.0/groups/{workspace_id} and this endpoint works with both basic auth and JWT auth (if you have an app).

[Arkadiusz Wroblewski]

@Ulrich Kuhnhardt _IzymesCo_ 

That's from what my confusion coming from.

Last I heard somebody was using them, that was officially "Dead" but actually fine 🤠

[James_Rodgers]

I get 403 when I try to Get to that endpoint. I've tried a couple of different kinds of API token, what token and permissions are needed to access that endpoint?