Bitbucket Cloud

Overview

FOSSA integrates with Bitbucket Cloud (bitbucket.org) so your team can import repositories directly and trigger rescans on every push. The integration uses OAuth 2.0, so users authorize FOSSA once and can then browse and import any repo they have access to.

Connecting your account

Individual users connect their Bitbucket Cloud account from the FOSSA project import flow; no admin configuration is required.

1. 1

   Start a new project import

   In FOSSA, click Add Project and select Bitbucket Cloud as the source.

2. 2

   Authorize FOSSA

   FOSSA redirects you to Bitbucket.org. Log in if prompted, then click Grant Access to allow FOSSA to read your repositories. You are redirected back to FOSSA.

3. 3

   Select a repository

   Browse or search your Bitbucket Cloud workspaces and repositories. Click a repository to import it as a FOSSA project.

Importing repositories from a workspace

After connecting, FOSSA shows all repositories across every Bitbucket Cloud workspace your account belongs to. Use the workspace selector to filter by workspace, and the search bar to find a specific repo.

Setting up automatic updates (webhooks)

By default, FOSSA scans when you trigger it manually or on a schedule. To have FOSSA rescan automatically on every push, configure a webhook in Bitbucket Cloud.

1. 1

   Get the webhook URL from FOSSA

   Open the project in FOSSA, go to Settings → Update Hooks, set the update method to Webhook, and copy the Webhook Update URL.

2. 2

   Add the webhook in Bitbucket Cloud

   In your Bitbucket Cloud repository, go to Repository settings → Webhooks → Add webhook.

   Fill in:

   Field	Value
   Title	FOSSA (or any label)
   URL	The Webhook Update URL from FOSSA
   Triggers	Repository push (at minimum)

   Click Save.

After saving, every push to the repository triggers FOSSA to re-analyze the project.

Revoking access

To disconnect FOSSA from your Bitbucket Cloud account, go to your Bitbucket Cloud account's app authorizations and revoke the FOSSA OAuth application. Existing FOSSA projects are not deleted, but FOSSA can no longer fetch new code from Bitbucket until you reconnect.

FAQ

Why don't I see a workspace's repositories after connecting? FOSSA only shows repos you have read access to in Bitbucket Cloud. If a workspace is missing, verify that your Bitbucket Cloud account is a member of that workspace.

Can I import private repositories? Yes. The OAuth authorization grants FOSSA read access to your private repos. FOSSA only reads code to perform analysis and does not store source files.

What if my organization requires OAuth app approval? Some Bitbucket Cloud workspaces require workspace admin approval before OAuth apps can be used. If you see an access error, ask your Bitbucket Cloud workspace admin to approve the FOSSA app under Workspace settings → OAuth consumers.

Does FOSSA support Bitbucket Cloud App Passwords? No. FOSSA uses OAuth 2.0 for Bitbucket Cloud authentication. App Passwords are not supported for this integration.