Thanks for the explanation - I've voted on BAM-19874.

I haven't found the above wiki link when searching for "bitbucket cloud webhook" on Google. Would it be possible to expand the documentation on https://confluence.atlassian.com/bitbucket/tutorial-create-and-trigger-a-webhook-747606432.html to make it clear that Bitbucket Cloud sends webhooks by POST?

Re XSRF, I can confirm that I get the insufficient read permissions error as raised in BAM-19874 too.

curl -k -H "Content-Type: application/json" -X POST https://<BAMBOO_URL>/rest/api/latest/repository/scan?repositoryId=30539782

{"message":"You do not have sufficient read permissions","status-code":401}

miroslav.sommer818754237, thanks for your feedback,

Bitbucket Cloud sends webhooks by POST method as it described in article about triggering builds by webhook: https://confluence.atlassian.com/bamboo0602/triggering-a-bamboo-build-from-bitbucket-cloud-using-webhooks-938866584.html

Issue with inability to trigger Specs detection if Anonymous user access is disabled was raised by our customers and we're going to address it soon, please watch and vote for BAM-19874

XSRF check is happened when you don't specify content type of your call, try to use "Content-Type: application/json" header in webhook call

... to expand on the authorization bit - the documentation of the /scan method says this:

This resource does not require authorisation.

However if I don't supply valid credentials in the request header, the reply from the server is:

XSRF check failed

XSRF is enabled on our Bamboo server and we don't want to disable it.

Hi,

Does it actually work for Bitbucket Cloud?

Unless I'm missing something it won't work, because the Specs are loaded only after a webhook is called, but the webhook call will always fail because:

• Bitbucket Cloud only supports GET webhooks, and there is no support for POST webhooks
  https://confluence.atlassian.com/bitbucket/manage-webhooks-735643732.html#Managewebhooks-create_webhook 

• Bamboo REST API used to trigger the Specs has only POST method. 
  See https://docs.atlassian.com/atlassian-bamboo/REST/6.5.0/#d2e4511
  /repository/scan?id&repositoryId&name&repositoryName
  Methods: POST

• Since our Bamboo server is secure and Anonymous access is disabled there, any Bamboo REST API calls require valid credentials in the request header which cannot be configured in Bitbucket Cloud webhook settings. 

I was able to make it work by manually triggering the /repository/scan Bamboo REST API webhook URL with POST method and valid credentials in the request header... but of course I would expect that I would not have to do that, because if it's how it works, it feels like an unfinished feature.

torsten.stach1722743047 according to our analytics Mercurial repositories usage is really small among our customers so we decided to create BAM-19836 and measure interest in this feature