How can I audit that GPG keys are required on a Bitbucket repository?

[Neil Hunt]

Our security team is interested in verifying that we are requiring a GPG key on our repositories. To produce this report, I wanted to query the repository, however I do not see a property returned related to this. Is there any way to query the state of this configuration setting?

[Theodora Boudale]

Hi Neil and welcome to the community!

The API endpoint you provided (https://developer.atlassian.com/cloud/bitbucket/rest/api-group-repositories/#api-repositories-workspace-repo-slug-get) returns this property, its name is enforced_signed_commits. Its value can be true, false, or null if it has never been enabled.

You can also use the following API endpoint to get this info for all repositories of a workspace (the result can be narrowed down based on the authenticated user's role.):

• https://developer.atlassian.com/cloud/bitbucket/rest/api-group-repositories/#api-repositories-workspace-get

You can also request a partial response so that the call returns only repo names and this property. An example with curl is the following:

curl -u username:app-password --request GET \
--url 'https://api.bitbucket.org/2.0/repositories/workspace-id?fields=values.name,values.enforced_signed_commits' \
--header 'Accept: application/json'

In bold are the values that you need to replace with your own.

Please feel free to reach out if you have any questions!

Kind regards,
Theodora

[Sahir Maharaj]

Hello @Neil Hunt

To verify if GPG keys are required for your Bitbucket repositories, you can use Bitbucket's API to query repository settings.

However, the specific setting for GPG key enforcement may not be exposed in the current API schema.

Instead, you might need to manually check the repository's security settings through the Bitbucket UI under Repository settings > Security.