Bitbucket api creating repository

Question

We are using rest apis for creating repositories, inviting team members, creating branches, restricting its permissions etc. but we want that token with limited permissions, current token seems admin and has repository deletion permissions as well, and we dont want that, any idea howe we can make it limited access?

Patrik S · Answer

Hello @PravinU ,

If your workspace is under the premium plan, you can restrict access to the workspace to particular IPs by leveraging the IP allowlisting feature. However, this will restrict any access to the workspace originating from IPs that are not on the list. This includes both the API and UI access. It's not possible to limit only the admins APIs.

As for the repository deletion, support can help to recover if the repository was deleted within the last 7 days. You can open a support request on the following portal:

* https://support.atlassian.com/contact/

Also, given that git is a distributed version control system, any previous clone that you or any member of your team have can also be considered a backup of the repo, as it contains the history of the repository. If that is the case, you can create a new repository and push the local backup repo to the new repo.

Thank you, @PravinU !

Patrik S

PravinU · Answer

Ohh, thanks.

Is there any way to restrict admin apis from ip etc? This seems issue for us if we expose api token with admin access, also is there any way to recover deleted repo is its done by mistake?

Patrik S · Answer

Hello @PravinU and welcome to the Community!

Currently, the OAuth scope repository:admin is required to execute most of the actions that you listed. Unfortunately, there's not a particular scope that includes all the actions you listed, except repo deletion. The admin scope also comes with the ability to delete the repository.

You can have a full description of what is included in each scope in the following documentation :

* https://developer.atlassian.com/cloud/bitbucket/rest/intro/#bitbucket-oauth-2-0-scopes

Based on that list, you may adjust your scopes accordingly to the action being performed, and restrict the admin scope to only the API calls where it is strictly necessary.

Thank you, @PravinU !

Patrik S