I'm using Bitbucket server and want to know which users have created HTTP access tokens

Question

Hi Community,

I need to know is there any REST endpoint for Bitbucket server to fetch all users who have created HTTP access tokens.

I have more than 2000 users using Bitbucket and it is time consuming if I go and search each and every users account details. So, that's why need to know if any endpoint is available to ease this work.

Could you please help me with this?

Thanks,
Jayanth

Arkadiusz Wroblewski · Answer

@Jayanth

The endpoint itself does not look like the problem.

If it works in the browser but not in Postman, the most likely reason is that the browser call is riding on your existing SSO session, while Postman is only sending the token. In this case, a 401 does not automatically mean the endpoint is broken. It can also mean that the authentication method is wrong for that endpoint, or that the caller is not allowed to read token information for that user.

I would not focus too much on SSO as the blocker here. I would first retry it with an admin account using Basic auth or OAuth instead of a bearer token. If that still fails, then I would double-check the {userSlug} value as well, because that needs to be the actual user slug, not just the username.

Jayanth_39yfjq · Answer

Hello @Arkadiusz Wroblewski ,

I tried this endpoint in browser, it is working.

However, when I tried using postman, I'm getting 401 error. I'm not sure why this is happening. I created a HTTP access token and used as bearer token in postman request.

Note: We're using SSO to login to Bitbucket.

Arkadiusz Wroblewski · Answer

Hello @Jayanth

Yes, there is a per-user endpoint for Bitbucket Data Center.

GET /rest/access-tokens/1.0/users/{userSlug}

This returns the HTTP access tokens created by that user. There's no single admin endpoint that lists all tokens across all users in one call, but you can script around that: paginate through all users via GET /rest/api/1.0/admin/users and call the tokens endpoint for each user slug. It's not elegant for 2000 users, but it's fully automatable in a simple script.

Just make sure the account running the queries has admin-level access, as the access-tokens endpoint requires it for querying other users' tokens.