> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bitbucket Server Integration

> Connect Bitbucket Server (Data Center) repositories to CodeThreat

Connect self-hosted Bitbucket Server or Bitbucket Data Center to scan repositories for security vulnerabilities.

## Overview

Bitbucket Server integration supports:

* Bitbucket Server 7.0+
* Bitbucket Data Center 7.0+
* Personal Access Token authentication
* Webhook integration for automated scanning

***

## Connection Setup

<Steps>
  <Step title="Open Bitbucket Settings">
    In Bitbucket Server, click your profile → **Manage account** → **Personal access tokens**
  </Step>

  <Step title="Create Token">
    Click **Create token**

    **Token name**: `CodeThreat Security Scanner`
    **Permissions**: Select:

    * ✅ **Projects**: Read
    * ✅ **Repositories**: Read
    * ✅ **Admin**: (for webhook management)
  </Step>

  <Step title="Generate and Copy">
    Click **Create** and copy the token immediately
  </Step>

  <Step title="Add to CodeThreat">
    **Settings** → **Integrations** → **Bitbucket Server**

    Enter your Bitbucket Server base URL (e.g., `https://bitbucket.company.com`)
    Paste your Personal Access Token
    Click **Connect**
  </Step>

  <Step title="Import Repositories">
    Select repositories to scan from your Bitbucket Server instance
  </Step>
</Steps>

***

## Configuration

### Base URL Format

Enter your Bitbucket Server URL:

```
https://bitbucket.company.com
```

**Requirements**:

* Include protocol (https\://)
* No trailing slash
* No /scm or project paths

### SSL Certificate

If your Bitbucket Server uses a self-signed SSL certificate:

1. Provide the CA certificate to CodeThreat support
2. Or ensure a valid SSL certificate is configured

***

## Webhook Configuration

CodeThreat creates webhooks for automated scanning.

### Required Permissions

The Personal Access Token needs **Admin** permission to create webhooks.

### Webhook Events

* **Repository push**: Trigger scans on commits
* **Pull request opened**: Scan new PRs
* **Pull request updated**: Rescan on changes

### Verify Webhooks

1. In Bitbucket Server: Repository → **Settings** → **Webhooks**
2. Find webhook pointing to CodeThreat API endpoint
3. Webhook should show as **Enabled** with recent successful deliveries

***

## Pull Request Integration

Get security feedback in Bitbucket Server pull requests.

### PR Build Status

CodeThreat updates PR build status to show security scan results.

### PR Comments

Enable PR comments in repository settings to get:

* Inline security findings
* Overall security summary
* AI-generated suggestions

***

## Network Requirements

### Firewall Configuration

Ensure connectivity between CodeThreat and your Bitbucket Server:

**Outbound from Bitbucket Server**:

* Allow HTTPS to `app.codethreat.com` (webhooks)

**Inbound to Bitbucket Server**:

* Allow HTTPS from CodeThreat IP addresses (for repository access)

Contact support for CodeThreat IP addresses to whitelist.

### SSL/TLS

Bitbucket Server must use:

* TLS 1.2 or later
* Valid SSL certificate (or provide CA cert)

***

## Best Practices

* Use dedicated service account for CodeThreat integration
* Set token expiration per security policy
* Whitelist CodeThreat IP addresses in firewall
* Enable PR scanning
* Test webhook delivery

***

## Troubleshooting

**Connection failed**:

* Verify base URL is correct and reachable
* Check token permissions (Projects: Read, Repositories: Read, Admin)
* Ensure SSL certificate is valid
* Verify firewall allows outbound HTTPS from CodeThreat

**SSL certificate error**:

* Use a valid SSL certificate from a trusted CA
* Or provide your CA certificate to CodeThreat support
* Check certificate expiration

**Webhook delivery failing**:

* Verify firewall allows outbound HTTPS from Bitbucket Server
* Whitelist `app.codethreat.com` in firewall
* Check webhook delivery logs in Bitbucket Server
* Verify token has Admin permission

**Repositories not showing**:

* Verify token has Projects and Repositories read permissions
* Check service account has repository access
* Ensure repositories are not archived

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Run Your First Scan" icon="play" href="/scanning/running-scans">
    Start scanning Bitbucket Server repositories
  </Card>

  <Card title="PR Scanning" icon="code-pull-request" href="/scanning/pr-scanning">
    Get security feedback on pull requests
  </Card>
</CardGroup>