> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-cloud.md).

# Bitbucket Cloud

Integrate Cortex Cloud Application Security with your Bitbucket Cloud version control system (VCS) to enable security scans for exposed secrets, infrastructure-as-code (IaC) misconfigurations, vulnerabilities, package operational risks, and license compliance issues in your repositories. This integration allows you to analyze, prioritize, and resolve detected issues efficiently.

## How to integrate Bitbucket Cloud

### Prerequisites

Before you begin, complete the Cortex Cloud and Bitbucket requirements.

#### Cortex Cloud requirements

* **User permissions**: Ensure you have **View/Edit** permissions for **Data Sources and Integrations**. Use the AppSec Admin or Instance Administrator role.
* **Egress path**: Establish an egress path for outbound data transmission from Cortex Cloud. For configuration details, refer to [Egress configurations](/gateway-guide/egress-configurations.md).

#### Bitbucket requirements

**Permissions**: In **Bitbucket**, grant the user authorizing Cortex Cloud the following permissions. The required level depends on the modules you use.

{% tabs %}
{% tab title="Code scanning" %}
The user must have `Write` access:

* **Workspace group with default repository access**: Add the user to a workspace group whose default repository access is set to `Write`
* **Repository permissions**: Go to **Repository Settings**. Grant the user `Write` access to each repository Cortex must access
  {% endtab %}

{% tab title="CI/CD security" %}
The user requires **Administrator** permissions for both **Projects** and **Repositories**.

{% hint style="info" %}
Grant Administrator access now to prevent integration errors later.
{% endhint %}
{% endtab %}
{% endtabs %}

For more information on Bitbucket Cloud permissions, refer to the [Bitbucket Authentication](https://developer.atlassian.com/cloud/bitbucket/rest/intro/?branch=code-editor-not-limitation#authentication) documentation.

* **Authentication (OAuth 2.0)**: Cortex Cloud exclusively uses OAuth for Bitbucket Cloud integrations.

  * **Automated token refresh**: There is no need to manually rotate tokens, as the OAuth integration automatically refreshes tokens in the background

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Personal Access Tokens (PATs) are not supported as an authentication method.</p></div>
* **OAuth scopes and events**: Review [Reference A: Authorization scopes and subscribed events](/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-cloud/authorization-scopes-and-event-architecture.md) to understand the requested OAuth permissions and events.

### Onboarding steps

1. On the Cortex Cloud tenant.
   1. Select **Settings** → **Data Sources & Integrations** → **+ Add New**.
   2. Search for **Bitbucket Cloud**, hover over it, and click **Add**, or **Add Another Instance** if an instance is already onboarded.
   3. **Authenticate**: Click Authorize on the **Configure account** step of the Bitbucket Cloud wizard.

      You are redirected to Bitbucket Cloud.
2. Authorize Cortex Cloud Application Security on Bitbucket Cloud: Review the requested permissions and then select **Grant access**.

   You are redirected to the **Select Repositories** step of the integration wizard.
3. **Configure repositories**: Select the repositories to be connected to the instance:
   * Permit all existing repositories
   * Permit all existing and future repositories
   * Select **Choose from repository list** and select repositories from the list
4. Select **Save** to confirm the repository selection and then **Close** on the final step of the wizard.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Ensure that you receive the <strong>Instance Successfully Created</strong> message on this step, indicating successful instance creation.</p></div>

## Verify integration

1. On **Data Sources & Integrations**, search for Bitbucket Cloud.
2. Hover over and select the resulting entry.
3. Locate your instance and verify that the status is **Connected**.

## Next steps

View repository assets and mitigate detected issues.

## Manage the integration

#### Instance-level actions

1. Navigate to **Settings** → **Data Sources & Integrations** and search for **Bitbucket Cloud**.
2. Select the matching result.
3. Locate your instance from the displayed list, right-click it, then select an option:
   * **Edit instance**: Opens the onboarding wizard, where you can change the instance configuration.
   * **Delete instance**: Deletes the instance and previous scan data.
   * **Copy entire row**: Copies all row values to the clipboard.

#### Repository-level actions

Right-click a connected repository to **Set Scanned Branches**, run a manual scan through **Scan Repository**, modify the **Scan Configuration**, or **Remove Repository** entirely. You can toggle specific scanners and manage PR behavior in **Scan Configuration**.

1. Locate your instance. See [Verify integration](#verify-integration) above.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then click **Save**.

## Troubleshooting VCS instance path errors

If your VCS instance shows an error with the message **Path was not approved in the egress**, you must ensure that your VCS organization's path is approved in the Cortex Gateway. For more information, refer to [Egress Configurations](/gateway-guide/egress-configurations.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-cloud.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.