Connect Bitbucket Cloud

Connect Bitbucket Cloud from an existing BattleTest workspace. You need permission to connect integrations in that workspace and repository Admin access in Bitbucket. This integration supports Bitbucket Cloud.

Connect your account

1. Select the intended workspace and open Settings → Integrations.
2. Choose Connect Bitbucket Cloud.
3. Authorize BattleTest in Bitbucket and return to Settings.
4. Choose Install BattleTest and install the app in the Bitbucket workspace that owns your repositories.
5. Return to Settings and open Repositories beside the connected account.
6. Enable the repositories you want reviewed.

App authorization can take a few minutes to arrive after installation. If enabling a repository asks you to install the app, wait briefly and retry. Bitbucket Forge apps require a shared workspace; personal workspaces are not supported.

Enabling a repository creates a webhook with a verification secret. Only explicitly enabled repositories can start reviews through this connection. Password users must verify their email before connecting.

If Settings says administrator setup is required, ask the instance administrator to configure the OAuth consumer. Managed users do not need to create their own consumer.

Posting identity and permissions

Comments, inline findings and build statuses use the BattleTest app’s bot identity. You do not create or manage a bot account. Your OAuth authorization is used for repository selection and webhook setup; publishing uses a separate app system token.

The setup OAuth consumer needs account read, email, repository read, pull request read and webhook permissions. Email permission also supports BattleTest sign-in with a verified address. The installed Forge app separately needs repository and pull request read, user identity read and pull request write. Forge’s write scope includes comment publishing and broader pull request actions; BattleTest uses it for review comments and does not approve or merge changes. Repository code-write permission is not requested.

Only enabled repositories in the app’s verified workspace can use its system token. Missing, expired or revoked app authorization stops reviews; BattleTest never falls back to posting as the authorizing user.

Verify a review

Open a non-draft pull request targeting the repository’s default branch. Check for the BattleTest summary, inline comments and the BattleTest Security Review build status. Open the review in BattleTest’s PR Reviews page. Push a new commit to verify another review starts for the new revision.

A skipped, cancelled or inconclusive review uses Bitbucket’s Stopped status. It is not a successful security review. Comments include findings that could not be placed inline. BattleTest does not rewrite the pull request description or approve or merge it.

Bitbucket’s code search is unavailable through this review adapter. File reads, directory listings and diff analysis still use the repository API.

Reconnect or disable

Use Reconnect after revoking provider access. Authorize the same Bitbucket account to preserve its selections.

If the BattleTest app was uninstalled, install it again in the same workspace. Its scheduled authorization refresh also supports manual reviews when no recent webhook was received.

Turn off a repository in Repositories to stop reviews, or choose Disconnect to disable the entire connection. If remote webhook cleanup fails, reviews remain disabled locally. Restore provider access and retry disconnect to finish cleanup.