How to audit Sonarcloud members using Bitbucket identity

SonarQube Cloud
,
1

We’ve got a list of members in our Sonarcloud organisation that are linked from Bitbucket. I want to be able audit these to see if they are all still members of our Bitbucket workspace. Unfortunately the Bitbucket API doesn’t allow an export of members’ usernames any more, because GDPR.
https://developer.atlassian.com/cloud/bitbucket/bitbucket-api-changes-gdpr/

I cannot retrieve members ‘username’ from anywhere in Bitbucket that I can find, so how is the integration with Sonarcloud still using ‘username’?
Can Sonarcloud show me the email address of the Bitbucket user or even their unique identifier?

Many thanks,
Andy

8

Hi Andy,

Welcome to the community support!

Sorry for the long delay, we discussed your case in the last days.

So best we have today is an internal API /api/organizations/search_members.

You can expect to get this type of response:

{
“users”: [
{
“login”: “ada.lovelace”,
“name”: “Ada Lovelace”,
“avatar”: “680b0001b4952664631511a81a4edc59”
},
{
“login”: “grace.hopper”,
“name”: “Grace Hopper”,
“avatar”: “36d90b0b8cc8639e4960e46116dce02c”
}
],
“paging”: {
“pageIndex”: 1,
“pageSize”: 50,
“total”: 2
}
}

The doc of the endpoint is not accessible to you but here is a screenshot:

image
image861×718 47.2 KB

Thanks for your request.

Best.

9

Hi Oliver,

Thanks for getting back to me, but unfortunately this doesn’t tell me any more than what I see in the page itself. My problem is that I’ve got no way of correlating this information with what I can extract from Bitbucket.

I guess this is really more of a Bitbucket issue since they seem have stopped using ‘username’ to identify users
See Change notice: Deprecating /2.0/teams/ API endpoints
I’ve got no way of getting a list of usernames for members of our Bitbucket workspace which is why I was suprised that Sonarcloud is using them for linking rather than the account id or uuid.

Does Sonarcloud know the email addresses for members and can I access that information? Sonarcloud does email me for certain notifications so you clearly know mine. I appreciate there are probably privacy issues involved here but email gives me a better idea of who the person is rather than whatever obscure Bitbucket username they’ve used!

Many thanks,
Andy