Bitbucket Data Center: "You are not permitted to access this resource"
Bitbucket Data Center (formerly Bitbucket Server) answers this when it does not allow the request. With an HTTP access token, Bitbucket holds the token to the permission it was made with, whatever its owner may do in the web interface: in public reports, a token with Repository read reads fine and gets this message, with HTTP 401, on any change. Since 401 is also the answer to an expired or revoked token, tools often report it as a sign-in problem, and the token is replaced when only its permission was short.
The answer
HTTP/1.1 401 Unauthorized
Content-Type: application/json
{"errors": [{"message": "You are not permitted to access this resource",
"exceptionName": "com.atlassian.bitbucket.AuthorisationException", ...}]}
- A command-line tool reproduced it on Bitbucket 10.4.3 in September 2026, with an admin account and tokens of each permission: a Repository read token was refused on any write (creating a branch, adding a label), a Repository write token on repository settings and project permissions. The same tokens read fine.
- An MCP server reported it from a Bitbucket Data Center 9.x server in August 2026: creating a branch with a read-only token got HTTP 401 with
com.atlassian.bitbucket.AuthorisationException. - Not reproduced here: we have no Data Center server. The body above shows the parts the reports quote, in Bitbucket's error format.
What each action needs
From Atlassian's page HTTP access tokens:
- Repository read: pull and clone (through the REST API, it also reads pull requests).
- Repository write: pull request actions (approving, commenting, creating, declining) and pushing.
- Repository admin: also the repository's settings and permissions.
- Merging: the table marks each write and admin permission "(except merge)", and the page says a token cannot be used to merge a pull request, because the merge creates a commit and only a user with a valid e-mail address can make one. Project and repository tokens have no user, so they never can. With a personal token, a public report on Bitbucket 9.4.11 (October 2026) saw Repository write refused with 401 and Repository admin merge.
- A personal token starts at your own level of access, and cannot do more than your account. A token's repository permission must be at least its project permission.
What to check
- Does the same token read? If reading fails too, the token expired or was revoked, or, in HTTP Basic, the user name is not its owner's. Project and repository tokens work only as
Authorization: Bearer <token>; Atlassian says not to send them with a user name in Basic authentication. - See the token's permission. Personal tokens are under Manage account → HTTP access tokens; project and repository tokens under the project's or repository's settings, HTTP access tokens. Atlassian says a token's permission can be changed, or the token revoked, from that list.
- For approving, commenting and opening pull requests, give it Repository write, or make a new token with it.
- For merging, if you are an admin of the repository, try a personal token with Repository admin; otherwise merge on the pull request's page in Bitbucket.
- If the token's permission is enough, your account may not have that permission on this repository, or a branch permission stops the change. A project admin can see which.
Bitbucket pull requests in IntelliJ IDEA
Pull Request Inbox for Bitbucket, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the pull requests that wait for your review in an IDE tool window, from Bitbucket Cloud and, in beta, from Bitbucket Data Center 8.9 or later with a personal HTTP access token, sent only to that server. From version 1.0.26, when Data Center refuses a change because of the token's permission, it says that approving and commenting need Repository write instead of saying that the token expired, and a refused merge says what Atlassian documents and what the report saw. The review inbox, diffs and discussions are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).
Get it on JetBrains Marketplace
Bitbucket and Atlassian are trademarks of Atlassian; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by Atlassian or JetBrains.
More: Token is invalid, expired, or not supported for this endpoint (Bitbucket Cloud) · pre-receive hook declined · modify a pull request based on out-of-date information · Bitbucket pull request plugins for IntelliJ IDEA, compared · Data Center "PKIX path building failed" and "SSL certificate problem" · Data Center "CAPTCHA required" · 日本語