Just in case anyone else finds themselves wrestling with this:  I was recently attempting to create Bitbucket Pipeline Variables via BitBuckets API using curl:

curl -X POST --data '{"key":"TEST_KEY", "value": "TEST_VALUE"}' -H "Content-Type: application/json" "https://api.bitbucket.org/2.0/repositories/user/repo/pipelines_config/variables/"

Running this gives the rather unhelpful message:

{
   "error":{
      "message":"Bad request",
      "detail":"The request body contains invalid properties",
      "data":{
         "key":"variable-service.request.validation-error",
         "arguments":{

         }
      }
   }
}

It turns out that the problem isn't that the body contains invalid properties like the returned message says. Rather, it's missing a property: the secured attribute, which is required. Why the docs don't mention this I don't know but changing the request to look like this is all that's needed to make it work:

curl -X POST --data '{"key":"TEST_KEY","value":"TEST_VALUE","secured":"true"}' -H "Content-Type: application/json" "https://api.bitbucket.org/2.0/repositories/user/repo/pipelines_config/variables/"