Cannot add known host via BitBucket API

[John van Terheijden]

Using the BitBucket API, I'm trying to

POST repositories/{user}/{slug}/pipelines_config/ssh/known_hosts/

with this json in the body:

{"hostname":"my.hostname.nl"} 

 The API responds with a

HTTP 400 Bad Request
{"error": {"message": "Bad request", "detail": "The request body contains invalid properties", "data": {"key": "variable-service.request.validation-error", "arguments": {}}}}

I also tried to include the fields that I get when I GET known hosts added manually, but the response stays the same. 

[Daniil Penkin · Accepted solution]

Hello @John van Terheijden,

The payload looks incomplete, besides hostname it should also contain the metadata about the public key of that hostname, for instance:

{
  "hostname": "bitbucket.org",
  "public_key": {
    "key": "AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==",
    "key_type": "ssh-rsa",
    "md5_fingerprint": "md5:97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40",
    "sha256_fingerprint": "SHA256:zzXQOXSRBEiUtuE8AikJYKwbHaxvSc0ojez9YXaGp1A",
    "type": "pipeline_ssh_public_key"
  }
}

Hope this helps.

Cheers,
Daniil

[John van Terheijden]

Hi @Daniil Penkin

Yea, that works! I tried before with those fields, but it returned an internal error. Are there any checks on the values that could cause that?

Thanks anyway!

[Daniil Penkin]

By internal error did you mean 500 HTTP response? If so, it would be interesting to find out and fix/improve error reporting. Can you advise when did you try this, roughly?

I'm not sure about the validation for this endpoint, need to clarify with the team next week.

Cheers,
Daniil

[vyshakhp]

May the api repo wiki should mention what is mandatory and what is not, I am not sure where a user can find 

"type": "pipeline_ssh_public_key"

This details are not available in the API wiki. 

[vyshakhp]

"public_key": {

Can't find where it mentioned the public_key section in the request sample.

[erwinmoes]

In Aug 2022 this solution seems that isn't working anymore.

curl -v --request POST --url 'https://${BITBUCKET_USERNAME}:${BITBUCKET_APP_PASSWORD}@api.bitbucket.org/2.0/repositories/${MY_ORG}/${MY_REPO}/pipelines_config/ssh/known_hosts/' \

 --header 'Accept: application/json' \

 --header 'Content-Type: application/json' \

 --data '{

"hostname": "34.238.233.67 ",

"public_key": {

"key": "AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==",

"key_type": "ssh-rsa",

"md5_fingerprint": "md5:97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40",

"sha256_fingerprint": "SHA256:zzXQOXSRBEiUtuE8AikJYKwbHaxvSc0ojez9YXaGp1A",

"type": "pipeline_ssh_public_key"

 }

}'

is returning the following, no errors, but not affecting the repo settings

Note: Unnecessary use of -X or --request, POST is already inferred.
* Trying 18.205.93.6:443...
* Connected to api.bitbucket.org (18.205.93.6) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: C=US; ST=California; L=San Francisco; O=Atlassian, Inc.; CN=*.bitbucket.org
* start date: Jul 1 00:00:00 2022 GMT
* expire date: Jul 21 23:59:59 2023 GMT
* subjectAltName: host "api.bitbucket.org" matched cert's "*.bitbucket.org"
* issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA
* SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Server auth using Basic with user '$BITBUCKET_USERNAME'
* Using Stream ID: 1 (easy handle 0x7ff0c9011400)
> POST /2.0/repositories/erwinmoes/vulnscan-ec2/pipelines_config/ssh/known_hosts/ HTTP/2
> Host: api.bitbucket.org
> authorization: Basic JEJJVEJVQ0tFVF9VU0VSTkFNRTokQklUQlVDS0VUX0FQUF9QQVNTV09SRA==
> user-agent: curl/7.79.1
> accept: application/json
> content-type: application/json
> content-length: 667
>
* We are completely uploaded and fine
* Connection state changed (MAX_CONCURRENT_STREAMS == 200)!
< HTTP/2 401
< server: nginx
* Authentication problem. Ignoring this.
< www-authenticate: Basic realm="Bitbucket.org HTTP"
< vary: Origin
< cache-control: max-age=0, no-cache, no-store, must-revalidate
< content-type: text/plain
< x-b3-traceid: 8c05d97a000466c3
< x-usage-output-ops: 0
< x-dc-location: Micros-3
< strict-transport-security: max-age=31536000; includeSubDomains; preload
< date: Mon, 08 Aug 2022 16:25:07 GMT
< x-usage-user-time: 0.018611
< x-usage-system-time: 0.000000
< x-served-by: e0b2abc10feb
< expires: Mon, 08 Aug 2022 16:25:07 GMT
< x-static-version: 25ac997ec994
< x-render-time: 0.01467442512512207
< x-usage-input-ops: 0
< x-frame-options: SAMEORIGIN
< x-version: 25ac997ec994
< x-request-count: 3453
< content-length: 0
<
* Connection #0 to host api.bitbucket.org left intact

[erwinmoes]

Something was broken on my variables I supposed, this version is working fine. Just be cautious on the key, the content of the key is not including the `ssh-rsa` and the signature at the end. 

curl -v -u "username:apppassword" \
--url 'https://api.bitbucket.org/2.0/repositories/org/repo-repo/pipelines_config/ssh/known_hosts/' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data '{
"type": "pipeline_ssh_public_key",
"uuid": "name_",
"hostname": "hostname",
"public_key": {
"key": "AAAAB3NzaC1yc2EAAAADAQABAAACAQDcM1v11lDz6vUgaokGXXXXXXXXXXXXXXXXXXXXXXX+46CLKHMdquV6Yg1Tqlo/gisw09NNAG26PyO4Ii+lxPZDKFVOU18enoCqKid/yCblMUJftRF1900eQYuTtyMdnibou+HSh6sEvSWSWmP6lVckA49v8dKWve882FbgqTC9EOeDJqBWwqWL5fBR2h8xiOWWrl9vL5LlhJ5w6FcCIrIKdErdO61scA4mZZKPUj80yKu4+uHu/kAlwAUcwUHJglHnHv1AB3LH8v8584VOwuGmq/d59jugUtZzWrNYwAPLGulnt6DuKMU09EPvNauyldtusBRTjlL2Wi7kV4wDs6SKrt/kqroPM2etMoNSJYywFFVQQZxK/4/BkhL/myPL2Riqs4VYSY3tZ1lom/+16FhZ2FMtaa+cDUd3+GU3t8RH6y6AXEj500dKsSsFA9O+exU/DCN6+z5uXPwpx9kA5MMtZPqPT4sjL1W2WpDcwnWF0fmnhZnmsSogxsKn0OSIxvJyFJKgo26uMpqxNHAV+6UrsztlgtPPf85Z4JbFAa0nbAmCjykdIVhoZlGdMk8KGHOl3p18XvY2pjs8ojvzhvrGBn4WyPgGv3ScLkubDmOUnap8ukg1T4Fa6BxuiM7Vi1SbccAr40zaYxHKKUat9YdiERuWNP/q6Sg+PQfeEOA+87kZOUpw==",
"key_type": "ssh-rsa",
"md5_fingerprint": "md5:e3:74:f6:2f:43:9b:26:88:69:3c:05:37:6c:bc:47:92",
"sha256_fingerprint": "SHA256:9r+RS/xWq+LB0Qd6cXyynml8J8qsgr3IznmIxrdLCzM",
"type": "pipeline_ssh_public_key"
}
}'