Find out if a Bitbucket user has 2FA enabled

[Maria Nawrocik]

Hi! 

I know that on standard Bitbucket plan you can't enforce 2FA, but is there a way for an admin to see if a user has it enabled?

It seems to me that with managed accounts I can see if my users have Atlassian 2FA enabled but not Bitbucket, is that right?

[Theodora Boudale · Accepted solution]

Hi @Maria Nawrocik,

We don't display this info on the UI, but you can get it via API.

The API endpoint mentioned in the community question that Peter linked has been deprecated.

You can use an API call like the following now:

curl -u bitbucket_username:app_password https://api.bitbucket.org/2.0/workspaces/workspace-id/members?fields=%2Bvalues.user.has_2fa_enabled

where

bitbucket_username is the Bitbucket username of an account that has admin access to the workspace
app_password is an app password for this account, with at least Account: Read permissions
workspace-id is the workspace id for the workspace you want to check the users of

It's important to include the part ?fields=%2Bvalues.user.has_2fa_enabled at the end of the URL, otherwise the field will not show.

With a call like the one I gave you, you will see a field named has_2fa_enabled (which will be either true or false) for each user in the results.

Please feel free to let me know if you have any questions.

Kind regards,
Theodora

[Maria Nawrocik]

Thank you, that works for me :)

[Theodora Boudale]

You are very welcome, please feel free to reach out if you ever need anything else!

[Peter Van de Voorde]

Hey Maria,

would this answer help: https://community.atlassian.com/t5/Bitbucket-questions/Retrieve-list-of-users-with-two-step-verification-enabled-on/qaq-p/1203248 ?

It's a bit of a workaround but it should give you the information you need.

Cheers,
Peter

[Maria Nawrocik]

Thanks Peter, it worked with the updated endpoint