Configuring Bitbucket with AppScan on Cloud

Detailed instructions for integrating Bitbucket with AppScan on Cloud.

Prerequisites

  • An active Atlassian account (used across Jira and Bitbucket).
  • Admin privileges in your Bitbucket Workspace to create OAuth consumers.

Set up a Bitbucket workspace and repository

  1. Log in to Bitbucket:
    1. At bitbucket.org, click Log in at the top right.
    2. Enter your Atlassian account credentials.
    3. If prompted, complete any two-step verification (2FA) configured on your account.
  2. Create a new workspace to organize your projects and repositories:
    1. Click your profile avatar at the top right.
    2. Select All workspaces or click Create workspace directly from the menu.
    3. Fill in the workspace details:
      • Workspace name: Enter an identifiable name (for example, My Team Workspace or John Doe Projects).
      • Workspace ID: This auto-generates based on your name and becomes part of your URL (for example, bitbucket.org/workspace-id/).
    4. Click Create.
  3. Create a new repository:
    1. Inside your workspace, click the + (Create) button in the left sidebar or global navigation bar.
    2. Select Repository.
    3. Complete the repository creation form:
      • Project name: Select an existing project or create a new project container.
      • Repository name: Enter your repository name (for example, my-first-repo).
      • Access level: Check Private repository to restrict access.
      • Include a README?: Select No if you have existing local code to push, or Yes to initialize a new README file.
    4. Click Create repository.

Create an OAuth consumer in Bitbucket

OAuth consumers (clients) are managed at the workspace level and enable secure application interaction.
  1. Log in to Bitbucket Cloud and ensure you are in the target workspace.
  2. Click Settings (gear icon) in the top navigation bar.
  3. Select Workspace settings from the menu.
  4. In the left navigation menu under Apps and features, select OAuth consumers.
  5. Click Add consumer at the top of the page.
  6. Fill in the consumer form fields:
    • Name: Give your application a clear name (for example, My Custom Integration App).
    • Description: Describe the OAuth client's function. Optional.
    • Supported grant types: Check both Authorization code and Client Credentials.
    • Callback URL: Your AppScan Presence-embedded web application URL plus /signin-bitbucket. For example, https://my-presence-host-fqdn/signin-bitbucket.
    • URL: Link to your application or organization website. Optional.
    • This is a private consumer: Keep checked if your client application runs on a secure server capable of maintaining secret confidentiality.
  7. Under the Scope section, grant the minimum required scopes:
    • Account: Read or Email
    • Repositories: Read
    • Workspace Membership: Read
    • Projects: Read
    • Pull requests: Read
    • Pipeline: Read

  8. Click Save.

  9. Under OAuth consumers, click on the consumer name to expand it and record your credentials:
    • Key: This represents your client_id.
    • Secret: Click to reveal your client_secret.

Generate an Atlassian API token

  1. Navigate to id.atlassian.com/manage-profile/security and log in with your Atlassian credentials.
  2. Under API Tokens, click Create API token with scopes.
  3. Configure the token settings:
    • Token name: Enter a descriptive name for the integration token.
    • Expiry duration: Choose an appropriate validity duration (for example, 30 days or 1 year).
    • Application: Select Bitbucket.
    • Scopes / Permissions: Select required access privileges (for example, read:repository:bitbucket).
  4. Click Create token.
  5. Copy the newly generated token value immediately and store it in a secure secret store; it cannot be retrieved again after closing the dialog box.

Integration configuration mapping

Map the retrieved credentials into your git_connect_settings.json file:
JSON property key Source credential field Description
ClientId Bitbucket OAuth Consumer Key Unique identifier for the OAuth consumer client.
ClientSecret Bitbucket OAuth Consumer Secret Secret key generated for the OAuth consumer.
GitApiToken Atlassian API Token Scoped API token string created in Atlassian Security.
GitEmail Atlassian Account Email Email address associated with the primary Atlassian account.