Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
All 92 tools →
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/bitbucket-addon-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Bitbucket Addon API
description: Code against the Bitbucket API to automate simple tasks, embed Bitbucket data into your own site, build mobile or desktop apps, or even add custom UI add-ons into Bitbucket itself using the Connect framework.
version: '2.0'
termsOfService: https://www.atlassian.com/legal/customer-agreement
contact:
name: Bitbucket Support
url: https://support.atlassian.com/bitbucket-cloud/
email: support@bitbucket.org
servers:
- url: https://api.bitbucket.org/2.0
tags:
- name: Addon
description: 'The addon resource is intended to use used by Bitbucket Cloud Connect
Apps, and only supports JWT authentication.
'
paths:
/addon:
parameters: []
delete:
tags:
- Addon
description: "Deletes the application for the user.\n\nThis endpoint is intended to be used by Bitbucket Connect apps\nand only supports JWT authentication -- that is how Bitbucket\nidentifies the particular installation of the app. Developers\nwith applications registered in the \"Develop Apps\" section\nof Bitbucket Marketplace need not use this endpoint as\nupdates for those applications can be sent out via the\nUI of that section.\n\n```\n$ curl -X DELETE https://api.bitbucket.org/2.0/addon \\\n -H \"Authorization: JWT <JWT Token>\"\n```"
summary: Delete an app
responses:
'204':
description: Request has succeeded. The application has been deleted for the user.
'401':
description: No authorization.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'403':
description: Improper authentication.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
put:
tags:
- Addon
description: "Updates the application installation for the user.\n\nThis endpoint is intended to be used by Bitbucket Connect apps\nand only supports JWT authentication -- that is how Bitbucket\nidentifies the particular installation of the app. Developers\nwith applications registered in the \"Develop Apps\" section\nof Bitbucket need not use this endpoint as updates for those\napplications can be sent out via the UI of that section.\n\nPassing an empty body will update the installation using the\nexisting descriptor URL.\n\n```\n$ curl -X PUT https://api.bitbucket.org/2.0/addon \\\n -H \"Authorization: JWT <JWT Token>\" \\\n --header \"Content-Type: application/json\" \\\n --data '{}'\n```\n\nThe new `descriptor` for the installation can be also provided\nin the body directly.\n\n```\n$ curl -X PUT https://api.bitbucket.org/2.0/addon \\\n -H \"Authorization: JWT <JWT Token>\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"descriptor\": $NEW_DESCRIPTOR}'\n```\n\nIn both these modes the URL of the descriptor cannot be changed. To\nchange the descriptor location and upgrade an installation\nthe request must be made exclusively with a `descriptor_url`.\n\n ```\n$ curl -X PUT https://api.bitbucket.org/2.0/addon \\\n -H \"Authorization: JWT <JWT Token>\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"descriptor_url\": $NEW_URL}'\n```\n\nThe `descriptor_url` must exactly match the marketplace registration\nthat Atlassian has for the application. Contact your Atlassian\ndeveloper advocate to update this registration. Once the registration\nhas been updated you may call this resource for each installation.\n\nNote that the scopes of the application cannot be increased\nin the new descriptor nor reduced to none."
summary: Update an installed app
responses:
'204':
description: Request has succeeded. The installation has been updated to the new descriptor.
'400':
description: Scopes have increased or decreased to none.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'401':
description: No authorization.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'403':
description: Improper authentication.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
/addon/linkers:
parameters: []
get:
tags:
- Addon
description: 'Gets a list of all [linkers](/cloud/bitbucket/modules/linker/)
for the authenticated application.
This endpoint is deprecated and will be removed by May 2026.'
summary: List linkers for an app
responses:
'200':
description: Successful.
'401':
description: Authentication must use app JWT
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
deprecated: true
/addon/linkers/{linker_key}:
parameters:
- name: linker_key
in: path
description: 'The unique key of a [linker module](/cloud/bitbucket/modules/linker/)
as defined in an application descriptor.'
required: true
schema:
type: string
get:
tags:
- Addon
description: 'Gets a [linker](/cloud/bitbucket/modules/linker/) specified by `linker_key`
for the authenticated application.
This endpoint is deprecated and will be removed by May 2026.'
summary: Get a linker for an app
responses:
'200':
description: Successful.
'401':
description: Authentication must use app JWT
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'404':
description: The linker does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
deprecated: true
/addon/linkers/{linker_key}/values:
parameters:
- name: linker_key
in: path
description: 'The unique key of a [linker module](/cloud/bitbucket/modules/linker/)
as defined in an application descriptor.'
required: true
schema:
type: string
delete:
tags:
- Addon
description: 'Delete all [linker](/cloud/bitbucket/modules/linker/) values for the
specified linker of the authenticated application.
This endpoint is deprecated and will be removed by May 2026.'
summary: Delete all linker values
responses:
'204':
description: Successfully deleted the linker values.
'401':
description: Authentication must use app JWT
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'404':
description: The linker does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
deprecated: true
get:
tags:
- Addon
description: 'Gets a list of all [linker](/cloud/bitbucket/modules/linker/) values for the
specified linker of the authenticated application.
A linker value lets applications supply values to modify its regular expression.
The base regular expression must use a Bitbucket-specific match group `(?K)`
which will be translated to `([\w\-]+)`. A value must match this pattern.
[Read more about linker values](/cloud/bitbucket/modules/linker/#usingthebitbucketapitosupplyvalues)
This endpoint is deprecated and will be removed by May 2026.'
summary: List linker values for a linker
responses:
'200':
description: Successful.
'401':
description: Authentication must use app JWT
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'404':
description: The linker does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
deprecated: true
post:
tags:
- Addon
description: 'Creates a [linker](/cloud/bitbucket/modules/linker/) value for the specified
linker of authenticated application.
A linker value lets applications supply values to modify its regular expression.
The base regular expression must use a Bitbucket-specific match group `(?K)`
which will be translated to `([\w\-]+)`. A value must match this pattern.
[Read more about linker values](/cloud/bitbucket/modules/linker/#usingthebitbucketapitosupplyvalues)
This endpoint is deprecated and will be removed by May 2026.'
summary: Create a linker value
responses:
'201':
description: Successfully created the linker value.
'401':
description: Authentication must use app JWT
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'404':
description: The linker does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'409':
description: The linker already has the value being added.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
deprecated: true
put:
tags:
- Addon
description: 'Bulk update [linker](/cloud/bitbucket/modules/linker/) values for the specified
linker of the authenticated application.
A linker value lets applications supply values to modify its regular expression.
The base regular expression must use a Bitbucket-specific match group `(?K)`
which will be translated to `([\w\-]+)`. A value must match this pattern.
[Read more about linker values](/cloud/bitbucket/modules/linker/#usingthebitbucketapitosupplyvalues)
This endpoint is deprecated and will be removed by May 2026.'
summary: Update a linker value
responses:
'204':
description: Successfully updated the linker values.
'400':
description: Invalid input.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'401':
description: Authentication must use app JWT
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'404':
description: The linker does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
deprecated: true
/addon/linkers/{linker_key}/values/{value_id}:
parameters:
- name: linker_key
in: path
description: 'The unique key of a [linker module](/cloud/bitbucket/modules/linker/)
as defined in an application descriptor.'
required: true
schema:
type: string
- name: value_id
in: path
description: The numeric ID of the linker value.
required: true
schema:
type: integer
delete:
tags:
- Addon
description: 'Delete a single [linker](/cloud/bitbucket/modules/linker/) value
of the authenticated application.
This endpoint is deprecated and will be removed by May 2026.'
summary: Delete a linker value
responses:
'204':
description: Successfully deleted the linker value.
'401':
description: Authentication must use app JWT
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'404':
description: The linker value does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
deprecated: true
get:
tags:
- Addon
description: 'Get a single [linker](/cloud/bitbucket/modules/linker/) value
of the authenticated application.
This endpoint is deprecated and will be removed by May 2026.'
summary: Get a linker value
responses:
'200':
description: Successful.
'401':
description: Authentication must use app JWT
content:
application/json:
schema:
$ref: '#/components/schemas/error'
'404':
description: The linker value does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/error'
security:
- oauth2: []
- basic: []
- api_key: []
deprecated: true
components:
schemas:
error:
type: object
title: Error
description: Base type for most resource objects. It defines the common `type` element that identifies an object's type. It also identifies the element as Swagger's `discriminator`.
properties:
type:
type: string
error:
type: object
properties:
message:
type: string
detail:
type: string
data:
type: object
description: Optional structured data that is endpoint-specific.
properties: {}
additionalProperties: true
required:
- message
additionalProperties: false
required:
- type
additionalProperties: true
securitySchemes:
basic:
type: http
scheme: basic
description: Basic HTTP Authentication as per [RFC-2617](https://tools.ietf.org/html/rfc2617) (Digest not supported). Note that Basic Auth is available only with username and app password as credentials.
oauth2:
type: oauth2
flows:
authorizationCode:
scopes:
repository: Read your repositories
repository:write: Read and modify your repositories
repository:admin: Administer your repositories
repository:delete: Delete your repositories
project: Read your workspace's project settings and read repositories contained within your workspace's projects
project:admin: Read and modify settings for projects in your workspace
email: Read your account's primary email address
account: Read your account information
account:write: Read and modify your account information
team: Read your team membership information
team:write: Read and modify your team membership information
pipeline: Access your repositories' build pipelines
pipeline:write: Access and rerun your repositories' build pipelines
pipeline:variable: Access your repositories' build pipelines and configure their variables
runner: Access your workspaces/repositories' runners
runner:write: Access and edit your workspaces/repositories' runners
test: Access your workspaces/repositories' test
test:write: Access and edit your workspaces/repositories' test
pullrequest: Read your repositories and their pull requests
pullrequest:write: Read and modify your repositories and their pull requests
webhook: Read and modify your repositories' webhooks
issue: Read your repositories' issues
issue:write: Read and modify your repositories' issues
snippet: Read your snippets
snippet:write: Read and modify your snippets
wiki: Read and modify your repositories' wikis
authorizationUrl: https://bitbucket.org/site/oauth2/authorize
tokenUrl: https://bitbucket.org/site/oauth2/access_token
description: OAuth 2 as per [RFC-6749](https://tools.ietf.org/html/rfc6749).
api_key:
name: Authorization
type: apiKey
description: API Keys can be used as Basic HTTP Authentication credentials and provide a substitute for the account's actual username and password. API Keys are only available to team accounts and there is only 1 key per account. API Keys do not support scopes and have therefore access to all contents of the account.
in: header
x-revision: 84a5dd73aa83
x-atlassian-narrative:
documents:
- anchor: authentication
title: Authentication methods
description: How to authenticate API actions
icon: data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxOTcuNjQ3MyAxODYuODEzOCI+CiAgPGRlZnM+CiAgICA8c3R5bGU+CiAgICAgIC5jbHMtMSB7CiAgICAgICAgaXNvbGF0aW9uOiBpc29sYXRlOwogICAgICB9CgogICAgICAuY2xzLTIgewogICAgICAgIGZpbGw6ICNkZTM1MGI7CiAgICAgIH0KCiAgICAgIC5jbHMtMyB7CiAgICAgICAgZmlsbDogI2ZmNTYzMDsKICAgICAgfQoKICAgICAgLmNscy00IHsKICAgICAgICBmaWxsOiAjZGZlMWU1OwogICAgICAgIG1peC1ibGVuZC1tb2RlOiBtdWx0aXBseTsKICAgICAgfQoKICAgICAgLmNscy01IHsKICAgICAgICBmaWxsOiAjZmFmYmZjOwogICAgICB9CgogICAgICAuY2xzLTYgewogICAgICAgIGZpbGw6ICNlYmVjZjA7CiAgICAgIH0KCiAgICAgIC5jbHMtNyB7CiAgICAgICAgZmlsbDogbm9uZTsKICAgICAgICBzdHJva2U6ICMwMDY1ZmY7CiAgICAgICAgc3Ryb2tlLW1pdGVybGltaXQ6IDEwOwogICAgICAgIHN0cm9rZS13aWR0aDogMnB4OwogICAgICB9CgogICAgICAuY2xzLTggewogICAgICAgIGZpbGw6ICM1ZTZjODQ7CiAgICAgIH0KCiAgICAgIC5jbHMtOSB7CiAgICAgICAgZmlsbDogIzI1Mzg1ODsKICAgICAgfQoKICAgICAgLmNscy0xMCB7CiAgICAgICAgZmlsbDogIzI2ODRmZjsKICAgICAgfQoKICAgICAgLmNscy0xMSB7CiAgICAgICAgZmlsbDogIzAwNjVmZjsKICAgICAgfQogICAgPC9zdHlsZT4KICA8L2RlZnM+CiAgPHRpdGxlPlNlY3VyaXR5IHdpdGggS2V5PC90aXRsZT4KICA8ZyBjbGFzcz0iY2xzLTEiPgogICAgPGcgaWQ9IkxheWVyXzIiIGRhdGEtbmFtZT0iTGF5ZXIgMiI+CiAgICAgIDxnIGlkPSJPYmplY3RzIj4KICAgICAgICA8cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik00Mi4wNjcyLDBoLjYxMTRhOCw4LDAsMCwxLDgsOFYyMy4yMzM4YTAsMCwwLDAsMSwwLDBIMzQuMDY3MmEwLDAsMCwwLDEsMCwwVjhBOCw4LDAsMCwxLDQyLjA2NzIsMFoiLz4KICAgICAgICA8cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik0xMDguMjIsMGguNjExNGE4LDgsMCwwLDEsOCw4VjIzLjIzMzhhMCwwLDAsMCwxLDAsMEgxMDAuMjJhMCwwLDAsMCwxLDAsMFY4QTgsOCwwLDAsMSwxMDguMjIsMFoiLz4KICAgICAgICA8cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik0xNzQuMzcyMiwwaC42MTE0YTgsOCwwLDAsMSw4LDhWMjMuMjMzOGEwLDAsMCwwLDEsMCwwSDE2Ni4zNzIyYTAsMCwwLDAsMSwwLDBWOEE4LDgsMCwwLDEsMTc0LjM3MjIsMFoiLz4KICAgICAgICA8cmVjdCBjbGFzcz0iY2xzLTIiIHg9IjM0LjA2NzIiIHk9IjIzLjIzMzgiIHdpZHRoPSIxNjMuNTgiIGhlaWdodD0iMTYzLjU4Ii8+CiAgICAgICAgPHBhdGggY2xhc3M9ImNscy0yIiBkPSJNNDIuMDY3MiwwSDU5LjI5YTgsOCwwLDAsMSw4LDhWMjMuMjIyOGEwLDAsMCwwLDEsMCwwSDM0LjA2NzJhMCwwLDAsMCwxLDAsMFY4YTgsOCwwLDAsMSw4LThaIi8+CiAgICAgICAgPHBhdGggY2xhc3M9ImNscy0yIiBkPSJNMTA3LjI0NTgsMGgxNy4yMjI4YTgsOCwwLDAsMSw4LDhWMjMuMjIyOGEwLDAsMCwwLDEsMCwwSDk5LjI0NThhMCwwLDAsMCwxLDAsMFY4YTgsOCwwLDAsMSw4LThaIi8+CiAgICAgICAgPHBhdGggY2xhc3M9ImNscy0yIiBkPSJNMTcyLjQyNDQsMGgxNy4yMjI4YTgsOCwwLDAsMSw4LDhWMjMuMjIyOGEwLDAsMCwwLDEsMCwwSDE2NC40MjQ0YTAsMCwwLDAsMSwwLDBWOGE4LDgsMCwwLDEsOC04WiIvPgogICAgICAgIDxyZWN0IGNsYXNzPSJjbHMtMyIgeD0iMTcuNDU1OCIgeT0iMjMuMjMzOCIgd2lkdGg9IjE2My41OCIgaGVpZ2h0PSIxNjMuNTgiLz4KICAgICAgICA8cGF0aCBjbGFzcz0iY2xzLTMiIGQ9Ik0yNS40NTU4LDBINDIuNjc4NmE4LDgsMCwwLDEsOCw4VjIzLjIyMjhhMCwwLDAsMCwxLDAsMEgxNy40NTU4YTAsMCwwLDAsMSwwLDBWOEE4LDgsMCwwLDEsMjUuNDU1OCwwWiIvPgogICAgICAgIDxwYXRoIGNsYXNzPSJjbHMtMyIgZD0iTTkwLjYzNDQsMGgxNy4yMjI4YTgsOCwwLDAsMSw4LDhWMjMuMjIyOGEwLDAsMCwwLDEsMCwwSDgyLjYzNDRhMCwwLDAsMCwxLDAsMFY4QTgsOCwwLDAsMSw5MC42MzQ0LDBaIi8+CiAgICAgICAgPHBhdGggY2xhc3M9ImNscy0zIiBkPSJNMTU1LjgxMywwaDE3LjIyMjhhOCw4LDAsMCwxLDgsOFYyMy4yMjI4YTAsMCwwLDAsMSwwLDBIMTQ3LjgxM2EwLDAsMCwwLDEsMCwwVjhBOCw4LDAsMCwxLDE1NS44MTMsMFoiLz4KICAgICAgICA8cGF0aCBjbGFzcz0iY2xzLTMiIGQ9Ik0yNS40NTU4LDBINDIuNjc4NmE4LDgsMCwwLDEsOCw4VjIzLjIyMjhhMCwwLDAsMCwxLDAsMEgxNy40NTU4YTAsMCwwLDAsMSwwLDBWOEE4LDgsMCwwLDEsMjUuNDU1OCwwWiIvPgogICAgICAgIDxwYXRoIGNsYXNzPSJjbHMtMyIgZD0iTTkwLjYzNDQsMGgxNy4yMjI4YTgsOCwwLDAsMSw4LDhWMjMuMjIyOGEwLDAsMCwwLDEsMCwwSDgyLjYzNDRhMCwwLDAsMCwxLDAsMFY4QTgsOCwwLDAsMSw5MC42MzQ0LDBaIi8+CiAgICAgICAgPHBhdGggY2xhc3M9ImNscy0zIiBkPSJNMTU1LjgxMywwaDE3LjIyMjhhOCw4LDAsMCwxLDgsOFYyMy4yMjI4YTAsMCwwLDAsMSwwLDBIMTQ3LjgxM2EwLDAsMCwwLDEsMCwwVjhBOCw4LDAsMCwxLDE1NS44MTMsMFoiLz4KICAgICAgICA8cmVjdCBjbGFzcz0iY2xzLTIiIHg9IjM1Ljc1OTYiIHk9IjU2LjgwNjUiIHdpZHRoPSIzMy4yMjI4IiBoZWlnaHQ9IjE1LjYwMzgiLz4KICAgICAgICA8cmVjdCBjbGFzcz0iY2xzLTIiIHg9IjEzMS4yMDE2IiB5PSIxMzYuOTYxNSIgd2lkdGg9IjMzLjIyMjgiIGhlaWdodD0iMTUuNjAzOCIvPgogICAgICAgIDxwYXRoIGNsYXNzPSJjbHMtNCIgZD0iTTU3LjM3MDksNzEuNjAzNmg3MC43NWE5LDksMCwwLDEsOSw5djM1LjM3NDlhNDQuMzc0OCw0NC4zNzQ4LDAsMCwxLTQ0LjM3NDgsNDQuMzc0OGgwYTQ0LjM3NDgsNDQuMzc0OCwwLDAsMS00NC4zNzQ4LTQ0LjM3NDhWODAuNjAzNkE5LDksMCwwLDEsNTcuMzcwOSw3MS42MDM2WiIvPgogICAgICAgIDxwYXRoIGNsYXNzPSJjbHMtNSIgZD0iTTY2LjM3MSw2Ni42NjE3aDcwLjc1YTksOSwwLDAsMSw5LDl2MzUuMzc0OWE0NC4zNzQ4LDQ0LjM3NDgsMCwwLDEtNDQuMzc0OCw0NC4zNzQ4aDBBNDQuMzc0OCw0NC4zNzQ4LDAsMCwxLDU3LjM3MSwxMTEuMDM2NlY3NS42NjE3YTksOSwwLDAsMSw5LTlaIi8+CiAgICAgICAgPHBhdGggaWQ9Il9SZWN0YW5nbGVfIiBkYXRhLW5hbWU9IiZsdDtSZWN0YW5nbGUmZ3Q7IiBjbGFzcz0iY2xzLTYiIGQ9Ik02MS4zNzEsNjYuNjYxN2g3MC43NWE5LDksMCwwLDEsOSw5djM1LjM3NDlhNDQuMzc0OCw0NC4zNzQ4LDAsMCwxLTQ0LjM3NDgsNDQuMzc0OGgwQTQ0LjM3NDgsNDQuMzc0OCwwLDAsMSw1Mi4zNzEsMTExLjAzNjZWNzUuNjYxN0E5LDksMCwwLDEsNjEuMzcxLDY2LjY2MTdaIi8+CiAgICAgICAgPHBhdGggY2xhc3M9ImNscy03IiBkPSJNOTYuNzQ1OSwxNDcuNzQ0MWEzNi43NDg3LDM2Ljc0ODcsMCwwLDEtMzYuNzA3NC0zNi43MDc0Vjc4LjA1ODRhMy43MzMzLDMuNzMzMywwLDAsMSwzLjcyOS0zLjcyOWg2NS45NTYzYTMuNzMzMywzLjczMzMsMCwwLDEsMy43MjksMy43Mjl2MzIuOTc4NEEzNi43NDg2LDM2Ljc0ODYsMCwwLDEsOTYuNzQ1OSwxNDcuNzQ0MVoiLz4KICAgICAgICA8cGF0aCBjbGFzcz0iY2xzLTQiIGQ9Ik0xMDAuNjg5MywxNjMuMzE2N1YxMTEuMDk3M2EzLjk0NDMsMy45NDQzLDAsMCwwLTcuODg4NywwdjUyLjIyYTIyLjUyNTIsMjIuNTI1MiwwLDAsMC0xOC41NDc5LDIyLjE0YzAsLjQ1Ni4wMTc4LjkwNzguMDQ0NywxLjM1NzFIODIuMjFjLS4wNDE0LS40NDc0LS4wNjg4LS44OTktLjA2ODgtMS4zNTcxYTE0LjYyLDE0LjYyLDAsMCwxLDE0LjU5NzQtMTQuNjA0MWwuMDA2MS4wMDA2LjAwNjgtLjAwMDdBMTQuNjIxMSwxNC42MjExLDAsMCwxLDExMS4zNSwxODUuNDU2NmMwLC40NTgxLS4wMjczLjkxLS4wNjg4LDEuMzU3MWg3LjkxMjhjLjAyNjktLjQ0OTMuMDQ0Ny0uOTAxMS4wNDQ3LTEuMzU3MUEyMi41MjU5LDIyLjUyNTksMCwwLDAsMTAwLjY4OTMsMTYzLjMxNjdaIi8+CiAgICAgICAgPHJlY3QgY2xhc3M9ImNscy0yIiB4PSIxNy40NTU4IiB5PSIzNi40NzAyIiB3aWR0aD0iMzMuMjIyOCIgaGVpZ2h0PSIxNS42MDM4Ii8+CiAgICAgICAgPHJlY3QgY2xhc3M9ImNscy0yIiB4PSIxNy40NTU4IiB5PSIxNTguMTIxNyIgd2lkdGg9IjMzLjIyMjgiIGhlaWdodD0iMTUuNjAzOCIvPgogICAgICAgIDxyZWN0IGNsYXNzPSJjbHMtMiIgeD0iMTQ3LjgxMyIgeT0iMzYuNDcwMiIgd2lkdGg9IjMzLjIyMjgiIGhlaWdodD0iMTUuNjAzOCIvPgogICAgICAgIDxyZWN0IGNsYXNzPSJjbHMtMiIgeD0iMTUwLjA2NDMiIHk9IjE1Ny41NTEzIiB3aWR0aD0iMzMuMjIyOCIgaGVpZ2h0PSIxNS42MDM4Ii8+CiAgICAgICAgPHBhdGggaWQ9Il9QYXRoXyIgZGF0YS1uYW1lPSImbHQ7UGF0aCZndDsiIGNsYXNzPSJjbHMtOCIgZD0iTTEwNy41MjU0LDEwMS4wMDI3YTExLjc3OTQsMTEuNzc5NCwwLDEsMC0xOS44Niw4LjU1NDhBNC4wNDE3LDQuMDQxNywwLDAsMSw4OC44NSwxMTMuNjJsLTIuMTA0LDcuMjY4MWEzLDMsMCwwLDAsMi44ODE3LDMuODM0MmgxMi4yMzcxYTMsMywwLDAsMCwyLjg4MTctMy44MzQybC0yLjA5NTktNy4yNGE0LjA3NDMsNC4wNzQzLDAsMCwxLDEuMTgwOC00LjA5NDVBMTEuNzE3MiwxMS43MTcyLDAsMCwwLDEwNy41MjU0LDEwMS4wMDI3WiIvPgogICAgICAgIDxwYXRoIGNsYXNzPSJjbHMtOSIgZD0iTTEwNC43NDYxLDEyMC44ODc3bC0yLjA5NTktNy4yNGE0LjA3NDQsNC4wNzQ0LDAsMCwxLDEuMTgwOC00LjA5NDUsMTEuNzYyOSwxMS43NjI5LDAsMCwwLTUuMDYtMTkuOTMxMywxMS45MSwxMS45MSwwLDAsMC04Ljc5OCwxMC45OTQ5LDExLjcxODUsMTEuNzE4NSwwLDAsMCwzLjY5MjksOC45NDFBNC4wNDE2LDQuMDQxNiwwLDAsMSw5NC44NSwxMTMuNjJsLTMuMjE0LDExLjEwMjNoMTAuMjI4OEEzLDMsMCwwLDAsMTA0Ljc0NjEsMTIwLjg4NzdaIi8+CiAgICAgICAgPHBhdGggY2xhc3M9ImNscy0xMCIgZD0iTTgxLjc5NzUsMTAwLjMxYTMuOTQzOSwzLjk0MzksMCwwLDAtMy45NDQzLTMuOTQ0M0g0MS4wNDE3YTMuOTQ0MywzLjk0NDMsMCwwLDAsMCw3Ljg4ODdINzcuODUzMkEzLjk0MzksMy45NDM5LDAsMCwwLDgxLjc5NzUsMTAwLjMxWiIvPgogICAgICAgIDxwYXRoIGlkPSJfUGF0aF8yIiBkYXRhLW5hbWU9IiZsdDtQYXRoJmd0OyIgY2xhc3M9ImNscy0xMSIgZD0iTTQxLjA0MTYsMTA0LjI1MzlIOTYuODUzMmEzLjk0NDMsMy45NDQzLDAsMCwwLDAtNy44ODg3SDQxLjA0MTZhMy45NDQzLDMuOTQ0MywwLDAsMCwwLDcuODg4N1oiLz4KICAgICAgICA8cGF0aCBjbGFzcz0iY2xzLTEwIiBkPSJNODEuNzk3NSwxMDAuMzFhMy45NDM5LDMuOTQzOSwwLDAsMC0zLjk0NDMtMy45NDQzSDQxLjA0MTdhMy45NDQzLDMuOTQ0MywwLDAsMCwwLDcuODg4N0g3Ny44NTMyQTMuOTQzOSwzLjk0MzksMCwwLDAsODEuNzk3NSwxMDAuMzFaIi8+CiAgICAgICAgPHBhdGggY2xhc3M9ImNscy0xMCIgZD0iTTIyLjQ5MzIsMTIyLjgwMjlBMjIuNDkyOSwyMi40OTI5LDAsMSwxLDQ0Ljk4NTgsMTAwLjMxLDIyLjUxODUsMjIuNTE4NSwwLDAsMSwyMi40OTMyLDEyMi44MDI5Wm0wLTM3LjA5NzJBMTQuNjA0MiwxNC42MDQyLDAsMSwwLDM3LjA5NzIsMTAwLjMxLDE0LjYyMDcsMTQuNjIwNywwLDAsMCwyMi40OTMyLDg1LjcwNTdaIi8+CiAgICAgIDwvZz4KICAgIDwvZz4KICA8L2c+Cjwvc3ZnPgo=
body: "\nThe purpose of this section is to describe how to authenticate when making API calls using the Bitbucket REST API.\n\n-----\n\n* [Access tokens](#access-tokens)\n * [Repository access tokens](#repository-access-tokens)\n * [Project access tokens](#project-access-tokens)\n * [Workspace access tokens](#workspace-access-tokens)\n* [App passwords](#app-passwords)\n* [API tokens](#api-tokens)\n* [OAuth 2.0](#oauth-2-0)\n * [Making requests](#making-requests)\n * [Repository cloning](#repository-cloning)\n * [Refresh tokens](#refresh-tokens)\n* [Bitbucket OAuth 2.0 Scopes](#bitbucket-oauth-2-0-scopes)\n* [Forge app and API token scopes](#forge-app-and-api-token-scopes)\n\n---\n\n### Access tokens\n\nAccess tokens are passwords (or tokens) that provide access to a _single_ repository, project or workspace.\nThese tokens can authenticate with Bitbucket APIs for scripting, CI/CD tools, Bitbucket Cloud-connected apps,\nand Bitbucket Cloud integrations.\n\nAccess tokens are linked to a repository, project, or workspace, not a user account.\nThe level of access provided by the token is set when a repository, or workspace admin creates it,\nby setting privilege scopes.\n\nThere are three types of access token:\n\n* **Repository access tokens** can connect to a single repository, preventing them from accessing any other repositories or workspaces.\n* **Project access tokens** can connect to a single project, providing access to any repositories within the project.\n* **Workspace access tokens** can connect to a single workspace and have access to any projects and repositories within that workspace.\n\nWhen using Bitbucket APIs with an access token, the token will be treated as the \"user\" in the\nBitbucket UI and Bitbucket logs. This includes when using the access token to leave a comment on a pull request,\npush a commit, or merge a pull request. The Bitbucket UI and API responses will show the\nrepository/project/workspace access token as a user. The username shown in the Bitbucket UI is the Access\nToken _name_, and a custom icon is used to differentiate it from a regular user in the UI.\n\n#### Considerations for using access tokens\n\n* After creation, an access token can't be viewed or modified. The token's name, created date,\nlast accessed date, and scopes are visible on the repository, project, or workspace **access tokens** page.\n* Access tokens can access a limited set of Bitbucket's privilege scopes.\n* Provided you set the correct privilege scopes, you can use an access token to clone (`repository`)\nand push (`repository:write`) code to the token's repository or the repositories the token can access.\n* You can't use an access token to log into the Bitbucket website.\n* Access tokens don't require two-step verification.\n* You can set privilege scopes (specific access rights) for each access token.\n* You can't use an access token to manipulate or query repository, project, or workspace permissions.\n* Access tokens are not listed in any repository or workspace permission API response.\n* Access tokens are deactivated when deleting the resource tied to it (a repository, project, or workspace).\n* Repository access tokens are also revoked when transferring the repository to another workspace.\n* Any content created by the access token will persist after the access token has been revoked.\n* Access tokens can interact with branch restriction APIs, but the token can't be configured as a user with merge access when using branch restrictions.\n\nThere are some APIs which are inaccessible for Access tokens, these are:\n\n* [Add a repository deploy key](/cloud/bitbucket/rest/api-group-deployments/#api-repositories-workspace-repo-slug-deploy-keys-post)\n* [Update a repository deploy key](/cloud/bitbucket/rest/api-group-deployments/#api-repositories-workspace-repo-slug-deploy-keys-key-id-put)\n* [Delete a repository deploy key](/cloud/bitbucket/rest/api-group-deployments/#api-repositories-workspace-repo-slug-deploy-keys-key-id-delete)\n\n#### Repository access tokens\n\nFor details on creating, managing, and using repository access tokens, visit\n[Repository access tokens](https://support.atlassian.com/bitbucket-cloud/docs/repository-access-tokens/).\n\nThe available scopes for repository access tokens are:\n\n- [`repository`](#repository)\n- [`repository:write`](#repository-write)\n- [`repository:admin`](#repository-admin)\n- [`repository:delete`](#repository-delete)\n- [`pullrequest`](#pullrequest)\n- [`pullrequest:write`](#pullrequest-write)\n- [`webhook`](#webhook)\n- [`pipeline`](#pipeline)\n- [`pipeline:write`](#pipeline-write)\n- [`pipeline:variable`](#pipeline-variable)\n- [`runner`](#runner)\n- [`runner:write`](#runner-write)\n\n#### Project access tokens\n\nFor details on creating, managing, and using project access tokens, visit\n[Project access tokens](https://support.atlassian.com/bitbucket-cloud/docs/project-access-tokens/).\n\nThe available scopes for project access tokens are:\n\n- [`project`](#project)\n- [`repository`](#repository)\n- [`repository:write`](#repository-write)\n- [`repository:admin`](#repository-admin)\n- [`repository:delete`](#repository-delete)\n- [`pullrequest`](#pullrequest)\n- [`pullrequest:write`](#pullrequest-write)\n- [`webhook`](#webhook)\n- [`pipeline`](#pipeline)\n- [`pipeline:write`](#pipeline-write)\n- [`pipeline:variable`](#pipeline-variable)\n- [`runner`](#runner)\n- [`runner:write`](#runner-write)\n\n#### Workspace access tokens\n\nFor details on creating, managing, and using workspace access tokens, visit\n[Workspace access tokens](https://support.atlassian.com/bitbucket-cloud/docs/workspace-access-tokens/).\n\nThe available scopes for workspace access tokens are:\n\n- [`project`](#project)\n- [`project:admin`](#project-admin)\n- [`repository`](#repository)\n- [`repository:write`](#repository-write)\n- [`repository:admin`](#repository-admin)\n- [`repository:delete`](#repository-delete)\n- [`pullrequest`](#pullrequest)\n- [`pullrequest:write`](#pullrequest-write)\n- [`webhook`](#webhook)\n- [`account`](#account)\n- [`pipeline`](#pipeline)\n- [`pipeline:write`](#pipeline-write)\n- [`pipeline:variable`](#pipeline-variable)\n- [`runner`](#runner)\n- [`runner:write`](#runner-write)\n\n### App passwords\n\nApp passwords are deprecated. Use [API tokens](#api-tokens).\n\n### API tokens\n\nAPI Tokens are personal access tokens that users can create to authenticate with Bitbucket's REST APIs\nor interact with Git. They are designed as a long term replacement for app passwords, while retaining a\nlot of the functionality you are already familiar with.\n\nSome important points about API tokens:\n\n* To authenticate with an API token, use Basic HTTP Authentication as per [RFC-2617](https://tools.ietf.org/html/rfc2617), where\n the username is your Atlassian email and password is the API token.\n* You cannot view an API token or adjust permissions after you create the API token. They are\n designed to be disposable. If you need to change the scopes or you've lost the token, you should just create a new one.\n* API token require an expiry date at creation, with a maximum duration of 1 year.\n* You cannot use them to log into Bitbucket website.\n* API tokens are tied to an individual account's credentials and should not be shared. If you're sharing your API token\n you're giving direct, authenticated access to everything that the token has been scoped\n to do with Bitbucket's APIs.\n* You can set privilege scopes (specific access rights) for each API token.\n\nFor details on creating, managing, and using API tokens, visit\n[API tokens](https://support.atlassian.com/bitbucket-clo
# --- truncated at 32 KB (126 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/bitbucket/refs/heads/main/openapi/bitbucket-addon-api-openapi.yml