diff --git a/api/types/provisioning_test.go b/api/types/provisioning_test.go
index be43fe756a9a0..da66258c9e4c7 100644
--- a/api/types/provisioning_test.go
+++ b/api/types/provisioning_test.go
@@ -1169,6 +1169,114 @@ func TestProvisionTokenV2_CheckAndSetDefaults(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			desc: "bitbucket only workspace",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodBitbucket,
+					Bitbucket: &ProvisionTokenSpecV2Bitbucket{
+						Audience:            "foo",
+						IdentityProviderURL: "https://example.com",
+						Allow: []*ProvisionTokenSpecV2Bitbucket_Rule{
+							{
+								WorkspaceUUID: "{foo}",
+							},
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			desc: "bitbucket only repository",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodBitbucket,
+					Bitbucket: &ProvisionTokenSpecV2Bitbucket{
+						Audience:            "foo",
+						IdentityProviderURL: "https://example.com",
+						Allow: []*ProvisionTokenSpecV2Bitbucket_Rule{
+							{
+								RepositoryUUID: "{foo}",
+							},
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			desc: "bitbucket missing audience",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodBitbucket,
+					Bitbucket: &ProvisionTokenSpecV2Bitbucket{
+						IdentityProviderURL: "https://example.com",
+						Allow: []*ProvisionTokenSpecV2Bitbucket_Rule{
+							{
+								WorkspaceUUID: "{foo}",
+							},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			desc: "bitbucket missing identity provider",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodBitbucket,
+					Bitbucket: &ProvisionTokenSpecV2Bitbucket{
+						Audience: "foo",
+						Allow: []*ProvisionTokenSpecV2Bitbucket_Rule{
+							{
+								WorkspaceUUID: "{foo}",
+							},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			desc: "bitbucket missing workspace or repository",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodBitbucket,
+					Bitbucket: &ProvisionTokenSpecV2Bitbucket{
+						Audience:            "foo",
+						IdentityProviderURL: "https://example.com",
+						Allow: []*ProvisionTokenSpecV2Bitbucket_Rule{
+							{
+								StepUUID: "{foo}",
+							},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
 	}
 
 	for _, tc := range testcases {