> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/manage-repositories-via-api.md). # Manage repositories via API The Cortex Cloud public API for repositories enables programmatic management of the repository asset inventory. It automates workflows that would otherwise require manual interaction with the console, enabling security teams to integrate repository governance into CI/CD pipelines, infrastructure-as-code provisioning, and scanner configuration automation. {% hint style="info" %} ### Note The public API base path is `/public_api/appsec/v1/repositories`. {% endhint %} ## API prerequisites * **API Key**: A valid Cortex Cloud API key with sufficient permissions (AppSec Admin or custom repository management roles) * **Authentication**: All requests require the `x-redlock-auth` header with a valid JWT token or the `Authorization` header containing the API key. Refer to the [Cortex Cloud APIs authentication documentation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/) for token generation * **Base URL**: Use the base URL corresponding to your Cortex Cloud tenant region * **Content-type**: All payload-bearing requests (PUT and POST) in the Cortex AppSec API require `application/json` * **VCS integration**: VCS integration (GitHub, GitLab, and so on) must already be active to populate the `assetId` values required by the endpoints ## Retrieve the repository inventory Retrieve the repository inventory programmatically to identify coverage gaps and synchronize with external systems. * **List repositories**: Use the `GET /public_api/appsec/v1/repositories` endpoint to retrieve all repository assets with optional filtering by source, search term, URL, and pagination * **Get repository by ID**: Use the G`ET /public_api/appsec/v1/repositories/{assetId}` endpoint to retrieve a specific repository asset by the unique asset identifier ## Manage scan configuration Automate scanner enablement and configure exclusion rules. * **Retrieve configuration**: Use `GET /public_api/appsec/v1/repositories/{assetId}/scan-configuration` to retrieve the current scan configuration for a specific repository * **Update configuration**: Use `PUT /public_api/appsec/v1/repositories/{assetId}/scan-configuration` to update scanners, excluded file paths, PR scanning, and tagging bot activity programmatically {% hint style="info" %} ### Note * The `excludedPaths` field replaces the entire excluded paths list; to add a new path, retrieve the current configuration first, append the new path, and send the complete array * **SAST**: SAST scanner configuration is not available through the public API and must be managed through the console UI {% endhint %} ## Manage scanned branches Automate branch governance to ensure release and feature branches are scanned. * **Retrieve branches**: Use `GET /public_api/appsec/v1/repositories/{assetId}/branches` to retrieve all branches currently configured for scanning * **Update branches**: Use `PUT /public_api/appsec/v1/repositories/{assetId}/branches` to update the primary branch and selected branches for scanning.

Warning

Always retrieve the current branch list before updating. The PUT operation replaces the entire branch selection, meaning any omitted branches will be unintentionally removed from scanning.

## Export compliance evidence (SBOM) To automate the compliance generation process within CI/CD pipelines, you can export Software Bill of Materials programmatically using the dedicated SBOM API. ## API reference For the complete repository API reference guide, including payload examples, schemas, and status code, refer to the [Repositories API](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/sites/site_gHT7E/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/repositories) documentation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/manage-repositories-via-api.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.