Skip to main content
Integrations · Bitbucket
Guild agents read, create, approve, and merge Bitbucket pull requests, manage issues, and act on repository events without storing credentials in agent code. Guild’s credential proxy injects the OAuth token server-side and enforces credential policies before any request reaches Bitbucket. Every action is captured in Guild’s audit trail.

Book a demo

See how teams govern agents that use Bitbucket.

Start free

Connect Bitbucket and scope your first agent.

What the Bitbucket integration exposes

The tools cover repositories, branches, commits, pull requests, issues, webhooks, and workspaces on Bitbucket Cloud. Agents can list and inspect resources, create and update them, approve or merge pull requests, manage branch restrictions and default reviewers, and read file contents and diffs. Three webhook events let triggers fire agents when a pull request, issue, or repository push occurs.

How it works

1

Open Credentials in Guild

Go to Credentials in Guild. The page lists connected services and a gallery of available integrations.
2

Authorize Bitbucket via OAuth

Click Bitbucket and complete the OAuth 2.0 flow. Select the workspaces and repositories to authorize. Tokens expire after one hour and are refreshed automatically.
3

Add tools to your agent

Import bitbucketTools from @guildai-services/guildai~bitbucket and spread it into your agent’s tools object. Use pick() to include only the tools your agent needs, since agents perform better with fewer tools.

Why Bitbucket access needs governing

Bitbucket tools can create repositories, delete branches, merge pull requests, and modify branch restriction rules. A credential without policies grants an agent everything the connected Bitbucket account can reach. Guild’s credential policies let you write ALLOW and DENY rules that the credential proxy enforces before any request leaves Guild, limiting agents by operation, resource, workspace, or agent identity. Guild stores OAuth tokens server-side and injects them into requests through the credential proxy; agent code never sees the token. You can scope a credential to one workspace, one member, or one agent, and restrict a workspace so it ignores account-level credentials entirely. See credentials for scoping options and credential policies for rule syntax. Without policies, every agent that resolves the credential can use it without restriction.

About the Bitbucket integration

The @guildai-services/guildai~bitbucket package provides agents with access to the Bitbucket Cloud REST API through Guild’s OAuth 2.0 integration.

Authentication

  • Type: OAuth 2.0
  • Token expiration: 1 hour (auto-refreshed)
  • Note: Only Bitbucket Cloud is supported — not Bitbucket Server or Data Center

Setup

1

Open Credentials

Go to Credentials in Guild.
2

Connect Bitbucket

Click Bitbucket and authorize Guild to access your account.
3

Grant access

Select the workspaces and repositories to authorize.
To connect with a Bitbucket workspace access token instead of OAuth, use the guildai~bitbucket-token integration. Create the token in Bitbucket under Workspace settings > Security > Access tokens, and paste it into API Key. Give the token the webhook read and write scope so triggers can register their webhooks. It supports the same trigger events; the package and tools on this page are for the OAuth integration.

Usage

Selecting specific tools

Agents perform better with fewer tools. Use pick() to include only what your agent needs. Tools are named with the bitbucket_ prefix.

Tools

Tools in the latest published version of guildai~bitbucket:

Webhook events

Bitbucket uses a trigger-scoped webhook model — each trigger gets its own webhook with a unique secret, subscribed to the trigger’s event and action, or to every event when the trigger names none. Guild checks each delivery’s X-Hub-Signature. A trigger can narrow an event to one action, such as --event pullrequest --action created. Without an action it fires on every action of that event. Every trigger needs a workspace_slug in its service config. Add a repo_slug to install the webhook on one repository; without it, the webhook is installed on the workspace, where Bitbucket supports the event.
Each event starts a new session. Guild doesn’t filter out changes the agent makes itself, so an agent that comments on a pull request from a pullrequest comment_created trigger fires that trigger again. Have the agent skip comments by the connected account.

Package version

The @guildai-services/guildai~bitbucket package is on the 2.x release line. The 2.x package is a code-generated client built directly from Bitbucket’s OpenAPI specification, replacing the hand-maintained 1.x package. If you are migrating an agent that was written against the 1.x package, review your tool names — some operation identifiers changed between versions. All operations follow the same bitbucket_<method>_<path> naming convention as before, but paths may have been normalized.

Limitations

  • Only Bitbucket Cloud is supported (not Bitbucket Server or Data Center)
  • Each trigger creates a separate webhook on the repository or workspace

Frequently asked questions

No. Only Bitbucket Cloud is supported. Bitbucket Server and Data Center are not supported by this integration.
Yes. A trigger can narrow the pullrequest event to one action, such as --event pullrequest --action created. Without an action specified, the trigger fires on every action of that event, including approved, merged, declined, and commented.
Write a credential policy with ALLOW or DENY rules scoped to specific operations and agents. Guild’s credential proxy enforces the policy before any request reaches Bitbucket, so an agent cannot reach repositories the policy does not permit. See credential policies for rule syntax.
Yes. Use the guildai~bitbucket-token integration instead. Create a token in Bitbucket under Workspace settings > Security > Access tokens, give it webhook read and write scope, and paste it into the API Key field. It supports the same trigger events as the OAuth integration.

Put a governed agent on Bitbucket this week

Book a demo

See how teams govern agents that use Bitbucket.

Start free

Connect Bitbucket and scope your first agent.
Also runs on Guild: Azure DevOps · GitHub · Google Compute · Linear Read: Docs: Credential policies · Credentials · Tools in agents
Last modified on October 16, 2026