Seeing the request for all permissions instead request for few via scope in authorize endpoint
Asked by saanjh jain:

When I am calling Bitbucket's authorize API :  
[https://bitbucket.org/site/oauth2/authorize?response_type=code\&client_id=cjsdknkcndksdnan\&scope=pullrequest:write](https://bitbucket.org/site/oauth2/authorize?response_type=code&client_id=cjsdknkcndksdnan&scope=pullrequest:write)

scope passed is pullrequest:write

I am seeing the below thing in the UI:  

Confirm access to your account {#toc-hId--442002738}
----------------------------------------------------

**saanh_007**is requesting access to the following:

* Read and modify your account information
* Read and modify your repositories' issues
* Access your repositories' build pipelines and configure their variables
* Read and modify settings for projects in your workspace
* Read and modify your workspace's project settings, and read and transfer repositories within your workspace's projects
* Read and modify your repositories and their pull requests
* Administer your repositories
* Delete your repositories
* Access and edit your workspaces/repositories' runners
* Read and modify your snippets
* Read and modify your team membership information
* Read and modify your repositories' webhooks
* Read and modify your repositories' wikis

This 3rd party vendor has not provided a privacy policy or terms of use. Atlassian's Privacy Policy is not applicable to the use of this App.  

Why UI is showing all the permissions here inspite of sending just one scope?

Is it expected behavior?


Answers:
author: Theodora Boudale
body: Hi [@saanjh jain](/t5/user/viewprofilepage/user-id/5265327) and welcome to the community!

The permissions you see on this page are the permissions you have granted to the OAuth consumer.

If you want to change them, you can edit the OAuth consumer and change its permissions.

Kind regards,  
Theodora

comments: author: saanjh jain
body: ohh got it and the scope we pass in the /authorize call will decide what is the scope of the access Token.  

Am i right?


author: Theodora Boudale
body: Hi [@saanjh jain](/t5/user/viewprofilepage/user-id/5265327),

The scope of the access token is also determined by the permissions you have selected for the OAuth consumer, I don't believe it's possible to override them by adding scope in the URL [https://bitbucket.org/site/oauth2/authorize?client_id={client_id}\&response_type=token](https://bitbucket.org/site/oauth2/authorize?client_id={client_id}&response_type=token)

Kind regards,  
Theodora


author: saanjh jain
body: Then what is the role of scope?

When it will be used?


author: Theodora Boudale
body: Hi [@saanjh jain](/t5/user/viewprofilepage/user-id/5265327),

I don't see **scope** documented as a query parameter with [https://bitbucket.org/site/oauth2/authorize?client_id={client_id}\&response_type=token](https://bitbucket.org/site/oauth2/authorize?client_id={client_id}&response_type=token) in our docs. Where did you see it used this way? Perhaps I am missing something.

The scopes documented here <https://developer.atlassian.com/cloud/bitbucket/rest/intro/#scopes> are referring to the permissions you set up for an OAuth consumer, an App password, Repository/Workspace/Project Access Tokens, or in an app descriptor if you are building an Atlassian Connect app.

Kind regards,  
Theodora


author: saanjh jain
body: With such URL:  
[https://bitbucket.org/site/oauth2/authorize?response_type=code\&client_id=cjsdknkcndksdnan\&scope=pullrequest:write](https://bitbucket.org/site/oauth2/authorize?response_type=code&client_id=cjsdknkcndksdnan&scope=pullrequest:write)  

if I am passing incorrect scope. ex - [scope=pullrequest:writ,](https://bitbucket.org/site/oauth2/authorize?response_type=code&client_id=cjsdknkcndksdnan&scope=pullrequest:write)

Getting error.  
[https://ids.ics.dev/ma/proxy/oauthcallback?error=invalid_scope\&error_description=Unknown+scope%3A+pullrequest%3Awrit](https://ids.ics.dev/ma/proxy/oauthcallback?error=invalid_scope&error_description=Unknown+scope%3A+pullrequest%3Awrit)  

<br />

Can you please recheck and confirm?  
What is the difference between passing the scope in authorize call and setting the scope while we create an oAuth consumer?


author: Theodora Boudale
body: Hi [@saanjh jain](/t5/user/viewprofilepage/user-id/5265327),

The scope you pass in the authorize call is not taken into account. The access token will have the permissions you have selected in the OAuth consumer.

Kind regards,  
Theodora


Tags: bitbucket-cloud

cloud