> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-bitbucket.md).
# Bitbucket
Integrate Prisma Cloud with your Bitbucket version control system (VCS) to gain visibility into, and monitor the systems, technologies, configurations, and pipelines that make up the Bitbucket platform. This integration enables security scans to identify Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) vulnerabilities, exposed secrets, license mis-compliance and CI/CD pipeline risks in your Bitbucket environment, allowing you to understand and fix issues as soon as they are detected, resulting in an enhanced security posture for your organization.
The Bitbucket integration creates a webhook that triggers periodic scans of your code. These scans run on all pull requests (PRs), and their results are displayed in both the PR comments and reports.
Refer to [Subscribed Events](#subscribed-events) below for a list of events to which the integration is subscribed.
1. Before you begin.
1. Grant the Prisma Cloud user the necessary permissions for integrating Prisma Cloud with your Bitbucket VCS, as specified in [User Permissions](#user-permissions) below.
For write access, go to **Bitbucket** > **Repository Settings** and grant the user write access to the relevant repositories.
2. Add the Prisma Cloud IP addresses and hostname for Application Security to an [allow list](/content-collections/get-started/console-prerequisites.md) to enable access to the Prisma Cloud Console.
1. Log in to Bitbucket with the correct user credentials before integrating with Prisma Cloud, as Prisma Cloud uses OAuth for authorizing access.
3. On the Prisma Cloud Application Security console.
1. Select **Settings** > **Connect Provider** > **Code & Build Providers**.
2. Select **Bitbucket** (under Code Repositories) in the catalog that is displayed.
3. Select **Authorize** in the **Configure Account** step of the integration wizard that is displayed.
You are redirected to *Bitbucket* to authorize Prisma Cloud access.
4. Authorize Prisma Cloud on Bitbucket.
1. Review the requested permissions and then select **Grant access**.
You are redirected to the **Enable CI/CD Security (Optional)** step of the Bitbucket integration wizard on the Prisma Cloud console. This step is optional and provides protection for the CI/CD systems in your Bitbucket environment.
5. Enable CI/CD Security.
1. To begin, you must first enable the [CI/CD Security Module](/content-collections/application-security/get-started/application-security-license-types.md).
2. Fill in the provided fields.
* **User Name**: To retrieve your Bitbucket user name, in Bitbucket, click the Bitbucket settings cog > **Settings** > locate your username under **Personal information**.
* **App Password**: To enable CI/CD Security you need to provide an additional Bitbucket App Password with repository read and repository admin permissions:
* In Bitbucket: Go to your **Personal Settings** page > **App Passwords**.
* Give your App Password a **Label**.
* Select the **Repository Read And Repository Admin** permissions.
* Click **Create** > Copy the generated App password from the **New app password** dialog. The App password is only displayed once and cannot be retrieved later.
See [here](https://support.atlassian.com/bitbucket-cloud/docs/create-an-app-password/) for more on generating App Passwords on Bitbucket.
3. Select **Next**.
Your redirected to the **Select Repositories** step of the integration wizard.
6. Select which repositories will be scanned:
* **Permit all existing repositories**
* **Permit all existing and future repositories**. This is the recommended option to ensure complete coverage and successful operation of all features.
* **Choose from repository list** > Select repositories
The selected repositories associated with the app password will be scanned.
7. Select **Next** to confirm the repository selection and save the changes > **Done**.
8. Verify integration.
1. In **Application Security**, select **Home** > **Settings** > **Code & Build Providers**.
2. Confirm that the status of the integrated **Bitbucket** repositories displays **Connected** under **Status**.
3. After successfully completing integration, a new webhook is displayed in Bitbucket under **Settings** > **Workflow** > **Webhooks**.
It may take up to 3 minutes for the integration status to be updated.
9. Next step: Monitor and manage scan results.
* View your selected Bitbucket repositories on the **Repositories** page. The next Bitbucket scan will include these repositories
* To view scan results and resolve issues, in **Application Security** select **Home** > **Projects**. See [Monitor and Manage Code Build Issues](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-and-manage-code-build.md) for more information
## Manage integrations
On **Code & Build Providers**, you can also manage the integration by reselection of repositories and deletion of the repository and the integration.
* **Reselect repositories**: Enables you to access the list of repositories for a scan.
* **Delete repository**: Enables you to delete repositories for a scan from the account.
* **Delete entire integration**: Enables you to remove a Bitbucket integration from Prisma Cloud console.
## User Permissions
Authorize the user integrating Prisma Cloud with your Bitbucket instance with the following permissions.
* **Organization owner** permissions
* **project**: Provides access to view the project or projects. This scope implies the `repository` scope, giving read access to all the repositories in a project or projects.
* **Repository Administrator permissions**: In order to scan pull requests (PRs), the user performing the integration must have administrative privileges for the repositories. This enables Prisma Cloud to set up subscription webhooks for the selected repositories. Additionally, these permissions allow the user to retrieve a comprehensive list of all available repositories
* **repository**: Provides read access to a repository or repositories. Note that this scope does not give access to a repository’s pull requests. Includes 'access to the repo’s source code', 'clone over HTTPS', 'access the file browsing API', 'download zip archives of the repo’s contents', 'the ability to view and use the issue tracker on any repo (created issues, comment, vote, etc)', 'the ability to view and use the wiki on any repo (create/edit pages)'
* **repository:write**: Provides write (not admin) access to a repository or repositories. No distinction is made between public and private repositories. This scope implicitly grants the `repository` scope, which does not need to be requested separately. This scope alone does not give access to the pull requests API. Includes 'push access over HTTPS' and 'fork repos'
* **pullrequest**: Provides read access to pull requests. This scope implies the `repository` scope, giving read access to the pull request’s destination repository. Includes 'see and list pull requests', 'create and resolve tasks' and 'comment on pull requests'
* **pullrequest:write**: Implicitly grants the `pullrequest` scope and adds the ability to create, merge and decline pull requests. This scope also implicitly grants the `repository:write scope`, giving write access to the pull request’s destination repository. This is necessary to allow merging. Includes 'merge pull requests', 'decline pull requests', 'create pull requests' and 'approve pull requests'
* **issue**: The ability to interact with issue trackers the way non-repo members can. This scope doesn’t implicitly grant any other scopes and doesn’t give implicit access to the repository. Includes 'view, list and search issues', 'create new issues', 'comment on issues', 'watch issues' and 'vote for issues'
* **issue:write**: This scope implicitly grants the issue scope and adds the ability to transition and delete issues. This scope doesn’t implicitly grant any other scopes and doesn’t give implicit access to the repository. Includes 'transition issues' and 'delete issues'
* **webhook**: Gives access to webhooks. This scope is required for any webhook-related operation.
This scope gives read access to existing webhook subscriptions on all resources the authorization mechanism can access, without needing further scopes. For example:
A client can list all existing webhook subscriptions on a repository. The repository scope is not required. Existing webhook subscriptions for the issue tracker on a repo can be retrieved without the issue scope. All that is required is the webhook scope.
To create webhooks, the client will need read access to the resource. Such as: for `issue:created`, the client will need to have both the webhook and the issue scope. Includes 'list webhook subscriptions on any accessible repository, user, team, or snippet' and 'create/update/delete webhook subscriptions'
* **snippet**: Provides read access to snippets. No distinction is made between public and private snippets (public snippets are accessible without any form of authentication). Includes 'view any snippet' and 'create snippet comments'
* **email**: Ability to see the user’s primary email address. This should make it easier to use Bitbucket Cloud as a login provider for apps or external applications
* **account**: When used for:
* **user-related APIs**: Gives read-only access to the user’s account information. Note that this doesn’t include any ability to change any of the data. This scope allows you to view the user’s: email addresses,language, location, website, full name, SSH keys, user groups
* **workspace-related APIs**: Grants access to view the workspace’s: users, user permissions, projects
* **pipeline**: Gives read-only access to pipelines, steps, deployment environments and variables
* **pipeline:write**: Gives write access to pipelines. This scope allows a user to: stop pipelines, rerun failed pipelines, resume halted pipelines and trigger manual pipelines
For more information on Bitbucket permissions refer to the Bitbucket [Authentication methods](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication) documentation.
### Permissions for CI/CD Modules
The CI/CD module now includes a non-mandatory phase for creating a PAT (Personal Access Token). This token contains specific permissions relevant to the CI/CD module, providing **read** access and **administrative** capabilities
## Subscribed Events
Below is a comprehensive list of events to which Prisma Cloud is subscribed. These events encompass various actions and changes occurring within your Bitbucket environment that trigger notifications and integrations with Prisma Cloud.
* **repo:push**: This event is triggered whenever a push operation occurs within a repository, indicating that new commits have been added or existing commits have been updated
* **repo:fork**: This event occurs when a repository is forked, creating a copy of the original repository within the same or a different workspace
* **repo:updated**: This event is triggered when there are updates or changes made to the repository settings or configuration
* **repo:commit\_comment\_created**: This event occurs when a new comment is created on a commit within the repository
* **repo:commit\_status\_created**: This event is triggered when a new status or check is created for a commit within the repository
* **repo:commit\_status\_updated**: This event occurs when the status or check of a commit within the repository is updated
* **issue:created**: This event is triggered when a new issue is created within the repository
* **issue:comment\_created**: This event occurs when a new comment is added to an existing issue within the repository
* **issue:updated**: This event is triggered when an existing issue within the repository is updated or modified
* **pullrequest:created**: This event occurs when a new pull request is created within the repository
* **pullrequest:updated**: This event is triggered when an existing pull request within the repository is updated or modified
* **pullrequest:fulfilled**: This event occurs when a pull request is fulfilled or merged into the target branch
* **pullrequest:rejected**: This event is triggered when a pull request is rejected or closed without being merged
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-bitbucket.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.