Has_2fa_enabled is null instead of True or False

[victorferreirait]

Hello everyone,

I’m using the API to get a list of team members and whether they enabled the Two Factor Authentication.

I only get a Boolean value for the has_2fa_enabled property in my own object in the response. All the other team members are Null

What am I missing?

Extra info

• The URL of our Bitbucket is in the form www.bitbucket.org/COMPANY_NAME
• The endpoint I am using to get a list of users and their information is https://api.bitbucket.org/2.0/teams/COMPANY_NAME/members

[Theodora Boudale · Accepted solution]

Hi @victorferreirait,

• has_2fa_enabled = Null indicates that 2FA was never enabled on the account.
• has_2fa_enabled = False indicates that 2FA was previously enabled on the account, but it is now disabled.

I hope this helps to clarify.

As a side note, I would suggest using the workspaces resource instead of the teams one, as the teams one is deprecated:

• https://developer.atlassian.com/bitbucket/api/2/reference/resource/workspaces/%7Bworkspace%7D/members

The field has_2fa_enabled is not visible by default with the workspaces resource, but you can get it the following way:

https://api.bitbucket.org/2.0/workspaces/COMPANY_NAME/members/{member_uuid}?fields=user.has_2fa_enabled

If you have any questions, please feel free to let me know.

Kind regards,
Theodora

[victorferreirait]

Hi Theodora, this helped.
But I still see a lot of null values. To test this implementation I asked a friend that had this feature disabled, to turn it on.

He said he did it, but it still returns null for his account. He did it 3 days ago.

Does it take some time until I can see updated values? Or is it a matter of permission? Which members I am able to see this info of?

Thanks in advance!

[Theodora Boudale]

Hi Victor!

I don't believe this is a matter of permissions or time, you just need to be a member of a workspace that you are running this API call for and the team member must also be a member of the workspace.

Could you please confirm if you're seeing this issue with 2.0/workspaces instead of 2.0/teams?

If your friend is a member of the workspace that you're testing this implementation for, I can think of two possible reasons why this may be occurring:

(1) Your friend has enabled 2FA for the Atlassian account (https://id.atlassian.com/manage-profile/security/two-step-verification) instead of the Bitbucket account (https://bitbucket.org/account/settings/two-step-verification/manage).

Bitbucket Cloud now uses Atlassian accounts for authentication, and it is possible to set up 2FA for both the Atlassian account and the Bitbucket account. Bitbucket Cloud had already a 2FA feature before we integrated with Atlassian accounts and we have a feature request to unify them https://jira.atlassian.com/browse/BCLOUD-19471

The value of has_2fa_enabled for the endpoint we're discussing will show as true only if 2FA is enabled for the Bitbucket account, it doesn't check Atlassian account 2FA.

You can ask your friend to check the links I mentioned above for Atlassian and Bitbucket 2FA and confirm which one he has enabled.

(2) Another possibility is that he may have enabled 2FA for a different Bitbucket account (in case he is using multiple Bitbucket accounts).

Please feel free to let me know if (1) is the case when you check with your friend and if you have any questions.

Kind regards,
Theodora

[victorferreirait]

You earned the Best Collaborator Badge
See all badges

Hahaha it was 1.
They had enabled the 2FA for their Atlassian account.