What permissions need to be given to Bitbucket Branch Source Plugin scan credentials?

The documentation for the Bitbucket Branch Source Plugin omits specifying the permissions that need to be granted to the configured scan credentials. We are apparently left to guess, with the uninformative message "Error while loading repositories from cache" when attempting to select a repository to scan.

What are the specific Bitbucket permissions that need to be granted to this credential?