Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Why cannot a user with read only access fetch user list for a repository but it can clone the repo


A user with read only access can clone the repository, and hence can read all commits and get information about the authors.

The 2.0 rest apis are sending the entire commit history and that includes the author information.

The logged in user with read only access can fetch the user information for any user with key of that user.

It's super weird that a user with read only access can fetch every possible data but not the list of members? Is there some logic behind this?

How can a user with read only access fetch the list of members for a repository via 2.0 REST api? 

Is this behaviour documented somewhere? I have been reading the API docs for a few days now but unable to find anything on this.

1 answer

0 votes
Mark C Atlassian Team Aug 18, 2021

Hi @Aalok Sood

Welcome to the community.

We do have the below API 2.0 endpoint that you can use to get repository users/members permissions.


However, according to the API 2.0 endpoint documentation:

Only users with admin permission for the repository may access this resource.

If you're using the above API 2.0 endpoint, I'm afraid that endpoint can only be accessed by users with Admin access.
Hence, users with read-only access cannot access that endpoint and get user/members' repository permission.

This is also true in a repository on the UI.
Users with read-only access can view the Commits page but the user will not be able to access the Repository settings to view all members/users added to that repository.

Do let me know if you have further questions about it.

Mark C

Suggest an answer

Log in or Sign up to answer
Community showcase
Published in Bitbucket

Git push size limits are coming to Bitbucket Cloud starting April 4th, 2022

Beginning on April 4th, we will be implementing push limits. This means that your push cannot be completed if it is over 3.5 GB. If you do attempt to complete a push that is over 3.5 GB, it will fail...

2,223 views 2 9
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you