Error 403 when creating new pull request

Question

Hi,

I'm having trouble creating new pull request on /pull-requests/new.

app.251220f92d2d675b056fc945e55c928f6fb92cda.js:sourcemap:1 POST https://bitbucket.org/!api/2.0/repositories/${workspace}/${repository}/pullrequests/?fields=links.html.href 403 (Forbidden).

I'am able to push code from my local repo to bitbucket cloud

Syahrul · Answer

Hi @jhobert

Welcome to the community.

A 403 (Forbidden) response means that Bitbucket received the request but the account or token used for creating the pull request is not authorized to perform that action.

Being able to push code does not necessarily mean you have permission to create pull requests, because these actions can use different authorization checks.

I suggest check your API token scope and make sure you have the appropriate permission. Try creating new API token with scope repository:write and pullrequest:write

Let me know how it goes.

Regards,
Syahrul

Gabriela - LeanZero · Answer

The KB that comes up first for this one is about Git operations rather than this call: "This article covers three scenarios where you may encounter the 403 error while performing Git operations such as push/clone." Its three causes are IP allowlisting on the workspace, the two-step verification requirement, and having no access to the repository or workspace. Each of those would break your push as well. Your push works.

What reconciles that is that the two authenticate separately: your push uses whatever sits in your credential helper or your SSH key, while the call from /pull-requests/new uses your browser session. Nothing forces those to be the same Atlassian account, and when they are not, this is the exact shape you get. Run git remote -v to see whether you are on SSH or HTTPS, work out which account that credential belongs to, then compare it against the avatar you are actually logged in as.

Cheap to rule out first.

The other half is that pushing and pull requests are separate ideas in Bitbucket's permission model. Repository Write reads "Allows users to contribute to the repository by pushing changes directly", and on the token side repository:write "does not include pull requests" at all.