The Atlassian Community can help you and your team get more value out of Atlassian products and practices.
A user with read only access can clone the repository, and hence can read all commits and get information about the authors.
The 2.0 rest apis are sending the entire commit history and that includes the author information.
The logged in user with read only access can fetch the user information for any user with key of that user.
It's super weird that a user with read only access can fetch every possible data but not the list of members? Is there some logic behind this?
How can a user with read only access fetch the list of members for a repository via 2.0 REST api?
Is this behaviour documented somewhere? I have been reading the API docs for a few days now but unable to find anything on this.
Hi @Aalok Sood
Welcome to the community.
We do have the below API 2.0 endpoint that you can use to get repository users/members permissions.
/2.0/workspaces/{workspace}/permissions/repositories/{repo_slug}
However, according to the API 2.0 endpoint documentation:
Only users with admin permission for the repository may access this resource.
If you're using the above API 2.0 endpoint, I'm afraid that endpoint can only be accessed by users with Admin access.
Hence, users with read-only access cannot access that endpoint and get user/members' repository permission.
This is also true in a repository on the Bitbucket.org UI.
Users with read-only access can view the Commits page but the user will not be able to access the Repository settings to view all members/users added to that repository.
Do let me know if you have further questions about it.
Regards,
Mark C
Beginning on April 4th, we will be implementing push limits. This means that your push cannot be completed if it is over 3.5 GB. If you do attempt to complete a push that is over 3.5 GB, it will fail...
Connect with like-minded Atlassian users at free events near you!
Find an eventConnect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.
Host an eventYou're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.