Creating a PR via API REST using App passwords - 401 Unauthorized error
Asked by Bernardo Garc?a:

I want to create a PR from curl command by sending a \`POST\` request to the \`<https://api.bitbucket.org/2.0/repositories/my-workspace/my-repository/pullrequests>\` endpoint  

<https://developer.atlassian.com/cloud/bitbucket/rest/api-group-pullrequests/#api-repositories-workspace-repo-slug-pullrequests-post>  

My pipeline step where the curl command is executed is:  

```
- step:
    name: Create a PR 
    script:
      # Checkout and update the release branch
      - git checkout $BITBUCKET_BRANCH
      - git pull origin $BITBUCKET_BRANCH


      # Create a pull request via Bitbucket's REST API
      - >
        curl -v -X POST -u "$BITBUCKET_PR_APP_USERNAME:$BITBUCKET_PR_APP_PASSWORD"
        --header 'Content-Type: application/json'
        --header 'Accept: application/json'
        https://api.bitbucket.org/2.0/repositories/energyworx/ewx-intelligence/pullrequests
        --data '{
          "title": "PR",
          "source": {
            "branch": {
              "name": "'"${BITBUCKET_BRANCH}"'"
            }
          },
          "destination": {
            "branch": {
              "name": "develop"
            }
          }
        }'
```

For this, I've created a bitbucket app password giving the following permissions:

![Untitled.png](/t5/image/serverpage/image-id/259248iB28B9E7A37BA7A6C/image-size/large?v=v2&px=999 "Untitled.png")  

And I have as a pipelines repository variables:  
\`BITBUCKET_PR_APP_USERNAME=create-pr\`

\`BITBUCKET_PR_APP_PASSWORD=\<password-value\>\`  

However I've been seeing when executing the curl command I got 401 error

THis is the verbosity output of the curl command

\`\`\`  
< HTTP/2 401  
80
< server: envoy  
81
* Authentication problem. Ignoring this.  
82
< www-authenticate: Basic realm="[Bitbucket.org](http://bitbucket.org/) HTTP"  
83
< vary: Origin  
84
< cache-control: max-age=0, no-cache, no-store, must-revalidate  
85
< content-type: text/plain  
86
< x-b3-traceid: def6c2c311ea3b29  
87
< x-usage-output-ops: 0  
88
< x-used-mesh: None  
89
< x-dc-location: Micros-3  
90
< strict-transport-security: max-age=31536000; includeSubDomains; preload  
91
< date: Wed, 24 May 2023 10:37:47 GMT  
92
< x-request-id: def6c2c311ea3b29  
93
< x-usage-user-time: 0.014742  
94
< x-usage-system-time: 0.000426  
95
< x-served-by: 872230c0fe40  
96
< expires: Wed, 24 May 2023 10:37:47 GMT  
97
< x-xss-protection: 1; mode=block  
98
< x-envoy-upstream-service-time: 24  
99
< x-static-version: 9999a04deee1  
100
< x-content-type-options: nosniff  
101
< x-render-time: 0.013472795486450195  
102
< x-trace-id: def6c2c311ea3b29  
103
< x-usage-input-ops: 0  
104
< x-frame-options: SAMEORIGIN  
105
< x-version: 9999a04deee1  
106
< x-request-count: 2670  
107
< content-length: 0  
108
<  
109
{ [0 bytes data]  
```````````  

````However when I use an oauth2 consumer with pull request write permissions and I create a token and I use that token as a bearer token in the header authorization to execute the above curl pull request command creation, I can create the PR, and everything goes well. ````

Why using an app password account with write pull request permissions did not create the PR and the Oauth consumer did it?


Answers:
author: Patrik S
body: Hey [@Bernardo Garc?a](/t5/user/viewprofilepage/user-id/4803078) , and thank you for reaching out to Community!

From the app password creation screenshot you have shared, you gave the app password a label named **create-pr**. The label of an app password is just a way so you can remember its purpose or describe what permissions it was configured to. However, the label itself will not be used in the authentication.

When using basic authentication for API calls, you will need to provide the following data as your credentials :

* **username** : your bitbucket account username, which you can find under your [account's personal settings](https://bitbucket.org/account/settings/)
* **AppPassword** : an app password created under your account with the required scopes of the endpoint you are doing the request.

So in this case, you will need to update the value of the pipelines environment variable BITBUCKET_PR_APP_USERNAME to be your bitbucket account username, instead of the app password label. Once the variable is updated, you can trigger your pipeline again and check if the request was successful.

Hope that helps! Let me know in case you have any questions.

Thank you, [@Bernardo Garc?a](/t5/user/viewprofilepage/user-id/4803078) !  
Patrik S

comments: author: Bernardo Garc?a
body: [@Patrik S](/t5/user/viewprofilepage/user-id/4603309)

Thanks so much for your clarification, it was a silly confusion from my side.  

I was doing this to make it work before:  

```
- >
  ACCESS_TOKEN=$(curl -X POST -u "$oauth_client_id:$oauth_client_secret" \
      https://bitbucket.org/site/oauth2/access_token \
      -d grant_type=client_credentials | jq -r '.access_token')

  SOURCE_PAYLOAD=$(jq -n \
    --arg bb_branch "$BITBUCKET_BRANCH" \
    --arg commit_hash "$COMMIT_HASH" \
    '{ "branch": { "name": $bb_branch }, "commit": { "hash": $commit_hash } }')

  REVIEWERS_PAYLOAD=$(jq -n \
    --arg uuid1 "$PR_REVIEWER_USER_UUID_1" \
    --arg uuid2 "$PR_REVIEWER_USER_UUID_2" \
    '[{ "uuid": $uuid1 }, { "uuid": $uuid2 }]')

  curl -X POST -H "Authorization: Bearer $ACCESS_TOKEN" \
      --header 'Content-Type: application/json' \
      --header 'Accept: application/json' \
      https://api.bitbucket.org/2.0/repositories/<workspace>/<my-repo>/pullrequests \
      --data-binary "$(echo -e '{
    "title": "Merge release branch onto develop",
    "description": "This Pull Request, generated by the release pipeline,",
    "close_source_branch": false,
    "source": '"$SOURCE_PAYLOAD"',
    "destination": {
      "branch": {
        "name": "develop"
      }
    },
    "reviewers": '"$REVIEWERS_PAYLOAD"'
  }')"
```

<br />

<br />

On the other hand, using bitbucket app password approach is better than using an oauth consumer credentials on my pipeline to create an access token for the culr request right?


author: Patrik S
body: Hello [@Bernardo Garc?a](/t5/user/viewprofilepage/user-id/4803078) ,

You're very welcome!

I would say basic authentication with username:AppPassword is simpler to implement as you don't need an extra API call to get the token, but both ways you have implemented it - app password or Oauth consumer - are valid ways for authenticating the request, so at the end it's up to your preference on which approach to use.

Thank you, [@Bernardo Garc?a](/t5/user/viewprofilepage/user-id/4803078) !

Patrik S


Tags: bitbucket-cloud

cloud