Issue with Adding Webhook via API - "Access Denied" Error Despite Correct Scopes

Vishal Singh_em5kj8

Hello,

I am currently trying to add a webhook to a repository using the Bitbucket API, but I am encountering the following error message:
"Access denied. You must have write or admin access."

I am using an OAuth2 token with the following scopes: ['repository:admin', 'repository:write', 'webhook'].

Despite having these scopes, I am still unable to add the webhook. Here is a brief overview of my implementation:

Token Retrieval and Webhook Creation

async getAccessToken(code: string): Promise<Record<string, any>> { const params = { code, client_id: process.env.BITBUCKET_CLIENT_ID, client_secret: process.env.BITBUCKET_CLIENT_SECRET, grant_type: 'authorization_code', scope: ['repository:admin', 'repository:write', 'webhook'], redirect_uri: redirect_url }; const response = await axios.post( 'https://bitbucket.org/site/oauth2/access_token', qs.stringify(params), { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } } ); return { accessToken: response.data.access_token, refreshToken: response.data.refresh_token }; 

async createWebhook( repoSlug: string, webhookUrl: string, accessToken: string ): Promise { const webhookPayload = { description: 'Webhook for pull request created event', url: webhookUrl, active: true, events: ['repo:push', 'repo:updated'] }; const url = `${BB_API_BASE_URL}/repositories/${repoSlug}/hooks`; return firstValueFrom( this.httpService.post(url, webhookPayload, { headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' } }) ); } 

 

Despite this, I receive the "Access denied" error when attempting to add the webhook.

I have ensured the following:

1. The OAuth2 token includes the required scopes.
2. The repository slug is correct.
3. The repository is not archived or subject to additional restrictions.

Could you please help me understand why this error is occurring? Is there any additional permission or configuration required that I may have missed?

 

Patrik S

Hello @Vishal Singh ,

and welcome to the Community!

I was able to successfully create a repository webhook utilizing an OAuth Access Token with the scopes repository:admin and webhook admin, so I think it may be something related to your particular implementation.

I'd recommend first trying to test the authentication/creation of the webhook outside of your code, using curl, and once that is tested, you can then make the changes to your source code to match.

Following are the steps I followed to test the webhook creation:

1. Exchange the authorization code by an Access token : 

curl -u CLIENT_ID:CLIENT_SECRET --location 'https://bitbucket.org/site/oauth2/access_token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'code=AUTHORIZATION_CODE'

The access token I used to test had the following scopes returned in the response:

"scopes": "repository:admin repository:write webhook"

2. Use the bearer access token from the previous step to create the webhook:

curl --location 'https://api.bitbucket.org/2.0/repositories/WORKSPACE/REPOSITORY/hooks' \

--header 'Content-Type: application/json' \

--header 'Authorization: Bearer <ACCESS_TOKEN>' \

--data '{

"description": "Webhook for pull request created event",

"url": "webhookUrl.com",

"active": "true",

"events": [

"repo:push",

"repo:updated"

 ]

}'

Could you try with those steps and let us know how it goes?

Should you have any questions, feel free to ask.

Thank you, @Vishal Singh !

Patrik S