replacements for deprecated user-scoped permission endpoints being removed in CHANGE-2770

[Roman Chametka]

Hello,

I'm working on a Bitbucket Cloud integration and need clarification on several critical API endpoints that are being deprecated as part of CHANGE-2770.

Deprecated Endpoints in Question:

1. GET /user/permissions/workspaces - Documentation
2. GET /user/permissions/repositories - Documentation
3. GET /repositories - Documentation

The suggested workspace-scoped alternatives appear to be:

• /workspaces/{workspace}/permissions/repositories
• /workspaces/{workspace}/permissions/repositories/{repo_slug}

However, these alternatives have a critical limitation: they require the authenticated user to have admin permissions on the repository (as stated in the documentation: "Only users with admin permission for the repository may access this resource").

Our integration needs to allow non-admin users to:

• List all repositories the authenticated user has access to (across all workspaces)
• Discover which workspaces they have access to and their permission level in each workspace
• Check their own permission level (read/write/admin) on specific repositories

The deprecated endpoints were perfect for this because they:

• Returned data scoped to the authenticated user's access
• Didn't require admin permissions
• Allowed filtering (e.g., GET /repositories?role=member)

Questions:

1. What are the planned replacement endpoints that will allow non-admin users to:
   • List all repositories they have access to?
   • Check their own permission level on repositories?
   • List workspaces they're members of with their permission levels?
2. Will there be user-scoped endpoints (similar to the deprecated ones) that return data based on the authenticated user's access without requiring admin permissions?
3. What is the timeline for announcing/releasing these replacement endpoints?
4. Is there a recommended workaround that doesn't require admin access for users to check their own permissions?

Thank you

[Ben]

Hi Roman,

To answer your questions:

1. We currently don't have any information regarding a planned replacement for these endpoints or a concrete date for their full deprecation, unfortunately. I can confirm that all of these still function at this stage, and that any deprecation will have an appropriate notice period prior to implementation.

2. Refer to question 1.

3. Refer to question 1.

4. If you wish to check user-scoped access, this is technically possible without admin access using the new endpoint (it just requires extra queries) by using the role filter. 

For a given workspace and repo_slug:

• Check if the repo appears under:

  GET /2.0/repositories/{workspace}?role=admin

  • If yes → user is admin on that repo.

• Else, check:

  GET /2.0/repositories/{workspace}?role=contributor

  • If yes → user has write (but not admin).

• Else, check:

  GET /2.0/repositories/{workspace}?role=member

  • If yes → user has at least read access.

This is a workaround alternative using the new endpoint as an alternative to a replacement (which does not yet exist). Combining those 3 calls together will give a list of repositories in a workspace where it can be inferred if the current scoped user is an admin, has write, or read access.

I hope this helps somewhat, please let me know if I can be of any further assistance :)

Cheers!

- Ben (Bitbucket Cloud Support)