The integration with Bitbucket will allow all repositories and pull requests to be collected automatically for auditing purposes. Performing this task manually can be quite tedious. Henceforth the integration will streamline the testing related to source control and change management. For example, the code review control will now automatically be collected as evidence.
Permissions for Bitbucket Integration
Scytale collects evidence automatically for audit purposes. Below you will find a list of appropriate permissions. All the permissions Scytale asks for the integration with Bitbucket are read-only and do not allow us to perform any actions within your Bitbucket account.
repository:adminaccountpullrequest
How to Connect Scytale and Bitbucket
1. In Scytale, go to 'Integrations'.
2. Search for Bitbucket and select 'Connect'.
3. Add a connection name - this will be used to differentiate between your connections - and then select 'Next'
4. Next select "Connect" to continue.
5. You will now be redirected to Bitbucket to approve the authorization with Scytale.
You can read through the permissions and then select "Grant access".
6. Back in Scytale select the Bitbucket workspaces that are relevant to the audit. The data will be collected automatically by Scytale.
Note: if you don't select workspaces, the connection will not be completed and we cannot collect evidence.
You have now successfully connected to Bitbucket!
Troubleshooting
Workspace IP Allowlist Setup
Bitbucket Premium workspaces can restrict access to an IP allowlist. The check applies to both API and web requests and is not bypassed by a valid OAuth token. Use the steps below to enable it on a workspace you administer (e.g. a dev workspace for testing).
Requirements: Bitbucket Premium plan, workspace admin access.
Sign in to Bitbucket as a workspace admin.
Navigate to Workspace settings β Security β IP allowlist (may appear under "Authentication policies" depending on UI version).
Add your own public IP first (curl ifconfig.me) as 1.2.3.4/32 β skipping this locks you out of the workspace UI and API.
Add any additional IPs/CIDRs that should be permitted.
Enable the policy.
To remove the restriction, disable the policy or delete entries. Changes take effect immediately.




