Bitbucket

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Bitbucket using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules. Compliance checks re-run once a day at 02:00 America/New_York.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Bitbucket environment.

What DSALTA reads

DSALTA reads the Bitbucket workspace member roster — display name and Bitbucket nickname — which appears on your Access page (Bitbucket’s members API returns no email address, and every row is recorded with the role Member and status Active); and your Bitbucket resources, which appear on your Inventory page. It also reads your open and merged pull requests, which appear on your Code Changes page — DSALTA does not read commits.It calls these Bitbucket endpoints:

/user
/user/workspaces
/workspaces/{workspace}/members
/repositories/{workspace}
/repositories/{workspace}/{repo}/pullrequests
/repositories/{workspace}/{repo}/branch-restrictions
/repositories/{workspace}/{repo}/pipelines

Permissions the checks require: the scoped API token must carry read:repository, read:pullrequest, read:pipeline, read:project, read:permission, read:workspace and read:user (all :bitbucket)Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Bitbucket environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Bitbucket card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Bitbucket. This usually happens when API tokens expire.

Data is not syncing

Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

Atlassian account email + scoped API token (read-only).Before you begin

Bitbucket Cloud account with access to the workspace you want to monitor
Permission to create a scoped API token in Atlassian account → Security

You will need:

Field	Where to find it	Example
Atlassian account email	See the steps below	`[email protected]`
Scoped API token	See the steps below	—
Workspace slug	See the steps below	`dsalta`

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Bitbucket, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

What DSALTA connects to

DSALTA reads repositories, pull requests, branch policies, workspace members, and pipelines for compliance monitoring.

Create a scoped API token

Create scoped API token (not Create API token). Read scopes: read:repository, read:pullrequest, read:pipeline, read:project, read:permission, read:workspace, read:user.The path in Atlassian: your avatar (top right) → Account settings → Security tab → Create and manage API tokens → Create API token with scopes (not the plain “Create API token” button next to it). Give it a name and an expiry date, select Bitbucket as the app, tick the read scopes above, then Create token and copy the value — Atlassian shows it once and it cannot be retrieved later.

A token created without scopes will not work here: Atlassian requires that “API tokens used to access Bitbucket APIs or perform Git commands must have scopes”. If DSALTA reports missing scopes when you connect, create a new token — scopes cannot be added to an existing one.

Connect Bitbucket

Atlassian account email, scoped API token, and Bitbucket workspace slug.The workspace slug is the segment straight after bitbucket.org in your URL — bitbucket.org/acme-inc/my-repo has the slug acme-inc. Pasting the full URL is tolerated: DSALTA strips the scheme and the bitbucket.org/ prefix and keeps the first path segment. The email must be the Atlassian account that owns the token — Bitbucket authenticates the pair as email:token.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Check email, token scopes, or workspace slug.The on-screen message is generic — see Connection error messages.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
Branch protection should be enabled on repositories	Info	Checks that branch restrictions exist on Bitbucket repositories.
User access to Critical System should be valid	Info	Checks that everyone with Bitbucket access is an active employee on the People page.
Offboarded users should not have active access	High	Checks that offboarded employees no longer have active Bitbucket access.

Topic	Link
Setup	Create a scoped API token (Bitbucket Cloud)
Setup	Using API tokens
General	Bitbucket website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting