I posted this in the Bitbucket Cloud forums too.

I see this article on how to update variables, but none of them refer to workspace variables. Is there a way to create/update Bitbucket Cloud workspace variables via the API? I tried

curl -v https://api.bitbucket.org/{workspace_slug} -u $BB_USER:$BB_TOKEN  --request POST --header 'Content-Type: application/json' 
--data '{
  "key": "STAGING_BRANCH",
  "value": "my-staging-branch",
  "secured": false
}'

But I got

Note: Unnecessary use of -X or --request, POST is already inferred.
* Host api.bitbucket.org:443 was resolved.
* IPv6: 2401:1d80:321c::bbc:1:df7c, 2401:1d80:321c:1:0:bbc:1:df7c, 2401:1d80:321c:2:0:bbc:1:df7c
* IPv4: 104.192.142.26, 104.192.142.24, 104.192.142.25
*   Trying 104.192.142.26:443...
* Connected to api.bitbucket.org (104.192.142.26) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=Atlassian US, Inc.; CN=*.bitbucket.org
*  start date: Jul 30 00:00:00 2024 GMT
*  expire date: Aug 30 23:59:59 2025 GMT
*  subjectAltName: host "api.bitbucket.org" matched cert's "*.bitbucket.org"
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA
*  SSL certificate verify ok.
* using HTTP/2

* Server auth using Basic with user 'user'
* [HTTP/2] [1] OPENED stream for https://api.bitbucket.org/{workspace_slug}
* [HTTP/2] [1] [:method: POST]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: api.bitbucket.org]
* [HTTP/2] [1] [:path: /{workspace_slug}]
* [HTTP/2] [1] [authorization: Basic Y2hyaXNmb3V0czpBVEJCcFk3dFgyUXYzWllRcEFHS3haaDl0M2J1MDY3MjY4NTk=]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
* [HTTP/2] [1] [content-type: application/json]
* [HTTP/2] [1] [content-length: 80]
> POST /{workspace_slug} HTTP/2
> Host: api.bitbucket.org
> Authorization: Basic Y2hyaXNmb3V0czpBVEJCcFk3dFgyUXYzWllRcEFHS3haaDl0M2J1MDY3MjY4NTk=
> User-Agent: curl/8.7.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 80
* upload completely sent off: 80 bytes
< HTTP/2 404
< date: Fri, 30 Aug 2024 14:23:46 GMT
< content-type: application/json; charset=utf-8
< content-length: 243
< server: AtlassianEdge
< vary: Authorization, Origin, cookie, user-context
< x-used-mesh: False
< x-usage-throttled: True
< x-credential-type: apppassword
< x-token-id: 3883795
< x-oauth-scopes: pullrequest:write
< x-view-name: bitbucket.apps.bb.api.v20.handlers.NotFoundHandler
< x-dc-location: Micros-3
< x-served-by: 41116b6e1d57
< x-version: 2c1ad607484e
< x-static-version: 2c1ad607484e
< x-request-count: 552
< x-render-time: 0.06117391586303711
< x-b3-traceid: 01fe951ec7db47c8b5de8bfe418f74f5
< x-b3-spanid: 9f523c026b847a8a
< x-frame-options: SAMEORIGIN
< expires: Fri, 30 Aug 2024 14:23:46 GMT
< cache-control: max-age=0, no-cache, no-store, must-revalidate, private
< x-usage-user-time: 0.018353
< x-usage-system-time: 0.009922
< x-usage-input-ops: 0
< x-usage-output-ops: 0
< x-trace-id: 01fe951ec7db47c8b5de8bfe418f74f5
< strict-transport-security: max-age=31536000; includeSubDomains; preload
< x-content-type-options: nosniff
< x-xss-protection: 1; mode=block
< atl-traceid: 01fe951ec7db47c8b5de8bfe418f74f5
< report-to: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}
< nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}
<
* Connection #0 to host api.bitbucket.org left intact
{"type": "error", "error": {"message": "Resource not found", "detail": "There is no API hosted at this URL.nnFor information about our API's, please refer to the documentation at: https://developer.atlassian.com/bitbucket/api/2/reference/"}}                                                                                                                                   

UPDATE

I tried to be smart and tried to do this, where I went to the Workspace variables page and use that URL.

curl -v https://bitbucket.org/{workspace_slug}/workspace/settings/pipelines/account-variables -u $BB_USER:$BB_TOKEN  --request POST --header 'Content-Type: application/json' 
--data '{
  "key": "STAGING_BRANCH",
  "value": "my-staging-branch",
  "secured": false
}'

…and got this

Note: Unnecessary use of -X or --request, POST is already inferred.
* Host bitbucket.org:443 was resolved.
* IPv6: 2401:1d80:321c::bbc:1:df7c, 2401:1d80:321c:1:0:bbc:1:df7c, 2401:1d80:321c:2:0:bbc:1:df7c
* IPv4: 104.192.142.25, 104.192.142.24, 104.192.142.26
*   Trying 104.192.142.25:443...
* Connected to bitbucket.org (104.192.142.25) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server accepted h2
*  subject: jurisdictionCountryName=US; jurisdictionStateOrProvinceName=Delaware; businessCategory=Private Organization; serialNumber=3928449; C=US; ST=California; L=San Francisco; O=Atlassian US, Inc.; CN=bitbucket.org
*  start date: Jul 30 00:00:00 2024 GMT
*  expire date: Aug 30 23:59:59 2025 GMT
*  subjectAltName: host "bitbucket.org" matched cert's "bitbucket.org"
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 Extended Validation Server CA
*  SSL certificate verify ok.
* using HTTP/2
* Server auth using Basic with user 'user'
* [HTTP/2] [1] OPENED stream for https://bitbucket.org/{workspace_slug}/workspace/settings/pipelines/account-variables
* [HTTP/2] [1] [:method: POST]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: bitbucket.org]
* [HTTP/2] [1] [:path: /{workspace_slug}/workspace/settings/pipelines/account-variables]
* [HTTP/2] [1] [authorization: Basic Y2hyaXNmb3V0czpBVEJCcFk3dFgyUXYzWllRcEFHS3haaDl0M2J1MDY3MjY4NTk=]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
* [HTTP/2] [1] [content-type: application/json]
* [HTTP/2] [1] [content-length: 80]
> POST /{workspace_slug}/workspace/settings/pipelines/account-variables HTTP/2
> Host: bitbucket.org
> Authorization: Basic Y2hyaXNmb3V0czpBVEJCcFk3dFgyUXYzWllRcEFHS3haaDl0M2J1MDY3MjY4NTk=
> User-Agent: curl/8.7.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 80
* upload completely sent off: 80 bytes
< HTTP/2 401
< date: Fri, 30 Aug 2024 14:47:56 GMT
< content-type: text/plain
< content-length: 0
< server: AtlassianEdge
< www-authenticate: BitbucketCustom realm=Bitbucket.org HTTP
< vary: Origin
< x-dc-location: Micros-3
< x-served-by: 511bccd4ef6c
< x-version: 2c1ad607484e
< x-static-version: 2c1ad607484e
< x-request-count: 1791
< x-render-time: 0.0017633438110351562
< x-b3-traceid: 80d4caadcdb148c4811126e3cb049b43
< x-b3-spanid: 84473df33ed473e1
< x-frame-options: SAMEORIGIN
< content-security-policy: connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; object-src 'none'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; base-uri 'self'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website
< expires: Fri, 30 Aug 2024 14:47:56 GMT
< cache-control: max-age=0, no-cache, no-store, must-revalidate, private
< x-usage-user-time: 0.006074
< x-usage-system-time: 0.000000
< x-usage-input-ops: 0
< x-usage-output-ops: 0
< age: 0
< x-cache: MISS
< x-content-type-options: nosniff
< x-xss-protection: 1; mode=block
< atl-traceid: 80d4caadcdb148c4811126e3cb049b43
< report-to: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}
< nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}
< strict-transport-security: max-age=63072000; includeSubDomains; preload
<
* Connection #0 to host bitbucket.org left intact