> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset.md).

# Repository as an asset

Cortex Cloud Application Security discovers and inventories every repository connected through a Version Control System (VCS) integration; GitHub, GitLab, Bitbucket, or Azure DevOps. Each onboarded repository appears in the unified asset inventory as the source-of-truth for the software supply chain, carrying its identity metadata, ownership context, business criticality, security health, and downstream deployment lineage.

The repository asset enables security teams to answer three questions about every codebase: **What is it? Where does it sit in the organization? What is its security health?**

## What repository assets deliver

The repository asset is the central unit of governance in the Cortex Cloud Application Security posture. The repository inventory provides the identity, context, and health telemetry needed to manage every codebase as a governed asset, from discovery through remediation via both the UI console and public APIs.

## Repository management workflows

Manage repository assets through the following workflows:

* [Manage repositories through the tenant (UI)](/application-security/application-security-posture-management-aspm/repository-as-an-asset/understanding-repository-assets-via-the-ui.md)
* [Manage repositories via API](/application-security/application-security-posture-management-aspm/repository-as-an-asset/manage-repositories-via-api.md)

## Core achievements and use cases

* **Asset discovery and identity:** Every repository connected through a VCS integration is automatically discovered and registered in the unified asset inventory with a unique asset identifier, VCS provider, organization, default branch, and onboarding timestamp to serve as the persistent identity record for the codebase
* **Asset metadata enrichment:** The repository asset is continuously enriched with metadata synchronized from the VCS provider.Retrieving repository asset details through the API enables synchronization with external asset management systems, CMDB platforms, and compliance reporting tools
* **Code to cloud lineage:** The repository asset is the origin node in the code to cloud graph, establishing a traceable lineage from source code through software packages, IaC resources, and CI/CD pipelines to deployed container images and cloud resources
* **Asset health monitoring:** The repository asset provides a continuous health profile by aggregating security signals from all scanner types
* **Coverage measurement:** The repository inventory quantifies the ratio of discovered repositories to actively scanned repositories, enabling AppSec managers to identify and close coverage gaps manually or programmatically
* **Branch governance automation**: Managing scanned branches through the API ensures that release, feature, and hotfix branches are automatically included in scan cycles as part of the release management workflow
* **Compliance evidence:** SBOM export (CycloneDX) at the repository level provides auditable evidence of software composition

## Relationship model

The Cortex Cloud platform models the following relationships between the repository asset and other asset categories.

| Related asset category           | Inherited metadata and description                                                                               |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| **VCS organization (Parent)**    | The VCS organization that contains the repository, propagating organization-level policies and compliance scopes |
| **Software package (Child)**     | Open-source and third-party packages declared in dependency manifest files within the repository                 |
| **IaC resource (Child)**         | Infrastructure-as-Code resources defined within the repository                                                   |
| **CI/CD pipeline (Child)**       | CI/CD pipeline definitions associated with the repository for deployment lineage tracking                        |
| **Container image (Downstream)** | Container images built from the repository through CI/CD pipelines                                               |
| **Cloud resource (Downstream)**  | Cloud infrastructure provisioned from IaC resources defined in the repository                                    |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.