> ## Documentation Index
> Fetch the complete documentation index at: https://docs.borghq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Bitbucket Integration

> Give Mjolnir access to your Bitbucket Cloud repositories for pentests, PR reviews and retests

Connect Odin to Bitbucket Cloud to give Mjolnir access to your repositories. Mjolnir reads your source code to map routes, authentication flows and business logic for whitebox pentesting. When you enable [PR Reviews](/mjolnir/pr-reviews), it also posts review feedback on your pull requests and can retest linked findings when a fix is merged.

<Info>
  Odin reads your repository contents for pentesting. For PR Reviews it also posts **review comments** and a single **build status** on the pull requests in repositories you enable, and adds a **webhook** to those repositories. It never pushes code, creates or merges pull requests, or changes your branches.
</Info>

<Note>
  Bitbucket Cloud (bitbucket.org) is supported. Bitbucket Data Center and Server are not.
</Note>

## Connect Bitbucket

Bitbucket authenticates through OAuth 2.0. You authorise Odin with your Bitbucket account, and Odin can then reach the repositories that account can reach, across every workspace it belongs to.

<Steps>
  <Step title="Open Integrations">
    Go to **Management > Integrations** in the sidebar.
  </Step>

  <Step title="Connect Bitbucket">
    Click **Connect** next to Bitbucket. You're sent to Atlassian to review the requested access and click **Accept**.
  </Step>

  <Step title="Pick repositories when you need them">
    There is nothing else to configure on the integration. You choose repositories when you set up a pentest or switch on PR reviews.
  </Step>
</Steps>

<Tip>
  Connect with an account that can see the repositories you want to test. To switch on PR reviews for a repository, that account also needs **admin** access to it, because Odin adds a repository webhook. A dedicated service account in your workspace works well for this.
</Tip>

You can revoke access at any time from **Bitbucket > Personal settings > App authorisations**, or by disconnecting the integration in Odin. Disconnecting also removes the webhooks Odin added.

## Using Bitbucket with Mjolnir

Once Bitbucket is connected, it becomes a source option when you set up a Mjolnir run. On the source step of the [Mjolnir setup wizard](/mjolnir/overview), pick a repository (grouped by workspace) and the branch Mjolnir reads.

When more than one source-control provider is connected, the wizard shows a provider toggle so you can choose which one this run uses. With only Bitbucket connected, the wizard goes straight to the Bitbucket repository picker.

## PR Reviews

Switch PR reviews on per repository from the **PR Reviews** page, under **PR Reviews · Bitbucket**. Odin then:

1. Adds a signed webhook to the repository for pull request events.
2. Reviews each new commit on an open pull request and posts findings as **inline comments**. Findings outside the changed lines are posted as general comments that name the file and line.
3. Posts an **Odin security review** build status on the head commit, which fails when findings at or above your blocking severity are found. Add it as a required build in your branch restrictions to block merges.
4. Keeps one summary comment on the pull request up to date.

Switching PR reviews off for a repository removes the webhook. Pull requests from forks are not reviewed.

## Linking pull requests to findings and retests

Mention a finding's identifier (for example `ACME-42`) in a pull request's source branch name, title or description, and Odin links the pull request to that finding. A reported finding moves to **Fixing** when it is linked.

Turn on **Automatic retests** on the Bitbucket integration to have Odin retest linked findings when the pull request is merged. Linking needs the repository webhook, so it works in repositories with PR reviews switched on.

## Permissions

Odin requests these Bitbucket scopes:

| Scope | Used for |
| - | - |
| Account (read, email) | Identify the account that connected |
| Workspace membership (read) | List the workspaces you belong to |
| Projects (read) | List repositories by project |
| Repositories (read, write) | Clone repositories; post build statuses |
| Pull requests (read, write) | Read pull requests; post review comments |
| Webhooks (read and write) | Add and remove the PR review webhook |

Odin never uses repository write access to push code. Access tokens are stored encrypted in Google Secret Manager, last two hours, and are refreshed automatically.

## Notes

* Bitbucket is a source-code connection for whitebox pentests, PR reviews and retests. It does not track findings as issues. To sync findings into a tracker, connect [Jira](/platform/integrations/jira), [Linear](/platform/integrations/linear) or another tracker alongside Bitbucket.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.