> ## Documentation Index > Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt > Use this file to discover all available pages before exploring further. # Deploy Endor Labs Bitbucket App in Bitbucket Cloud > Learn how to continuously monitor your environment with the Endor Labs Bitbucket App. export const Diagram = ({children}) => { const [svg, setSvg] = useState(''); const [error, setError] = useState(null); const [mounted, setMounted] = useState(false); const [id] = useState(() => `diagram-${Math.random().toString(36).slice(2)}`); const DEFAULTS = { theme: 'base', fontSize: '14px', fontFamily: 'inherit', primaryColor: '#26D07C', primaryTextColor: '#000000', primaryBorderColor: '#059669', secondaryColor: '#e5e7eb', secondaryTextColor: '#000000', secondaryBorderColor: '#9ca3af', tertiaryColor: '#e5e7eb', tertiaryTextColor: '#000000', tertiaryBorderColor: '#9ca3af', lineColor: '#6b7280', background: '#ffffff', edgeLabelBackground: '#f9fafb', clusterBkg: '#f0fdf4', clusterBorder: '#059669', nodeTextColor: '#000000', endorColor: '#26D07C', endorBorder: '#059669', managedColor: '#A7F3D0', managedBorder: '#059669', externalColor: '#e5e7eb', externalBorder: '#9ca3af' }; const VAR_LINE_RE = /^(\w+):\s*(.+)$/; const TOKEN_RE = /\{\{(\w+)\}\}/g; const parseVarsBlock = raw => { const vars = {}; const lines = raw.trim().split('\n'); const diagramLines = []; let inVars = false; for (const line of lines) { const trimmed = line.trim(); if (trimmed === '%%vars') { inVars = true; continue; } if (inVars && trimmed === '%%') { inVars = false; continue; } if (inVars) { const m = VAR_LINE_RE.exec(trimmed); if (m) vars[m[1]] = m[2]; } else { diagramLines.push(line); } } return { vars, diagramLines }; }; const buildInitConfig = merged => ({ theme: merged.theme, themeVariables: { fontSize: merged.fontSize, fontFamily: merged.fontFamily, primaryColor: merged.primaryColor, primaryTextColor: merged.primaryTextColor, primaryBorderColor: merged.primaryBorderColor, secondaryColor: merged.secondaryColor, secondaryTextColor: merged.secondaryTextColor, secondaryBorderColor: merged.secondaryBorderColor, tertiaryColor: merged.tertiaryColor, tertiaryTextColor: merged.tertiaryTextColor, tertiaryBorderColor: merged.tertiaryBorderColor, lineColor: merged.lineColor, background: merged.background, edgeLabelBackground: merged.edgeLabelBackground, clusterBkg: merged.clusterBkg, clusterBorder: merged.clusterBorder, nodeTextColor: merged.nodeTextColor } }); const renderWithMermaid = (mermaid, fullDiagram) => { mermaid.initialize({ startOnLoad: false, zoom: { enabled: false } }); mermaid.render(id, fullDiagram).then(({svg: rendered}) => { setSvg(rendered); setError(null); }).catch(err => setError(err.message)); }; useEffect(() => { setMounted(true); }, []); useEffect(() => { if (!mounted || !children) return; const raw = typeof children === 'string' ? children : String(children); const {vars, diagramLines} = parseVarsBlock(raw); const merged = { ...DEFAULTS, ...vars }; const diagram = diagramLines.join('\n').trim().replaceAll(TOKEN_RE, (_, key) => merged[key] || ''); const fullDiagram = `%%{init: ${JSON.stringify(buildInitConfig(merged))}}%%\n${diagram}`; const existing = document.getElementById(id); if (existing) existing.remove(); if (globalThis.mermaid) { renderWithMermaid(globalThis.mermaid, fullDiagram); } else { const script = document.createElement('script'); script.src = 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.min.js'; script.onload = () => renderWithMermaid(globalThis.mermaid, fullDiagram); script.onerror = () => setError('Failed to load Mermaid'); document.head.appendChild(script); } }, [mounted, children, id]); if (!mounted) return null; if (error) { return 
        Diagram error: {error}
; } if (!svg) { return
Loading diagram...
; } return
; }; Endor Labs provides a Bitbucket App that continuously monitors users' projects for security and operational risks in Bitbucket Cloud. You can use the Bitbucket App to selectively scan your repositories for SCA, secrets, and SAST. When you use the Endor Labs Bitbucket App, it creates namespaces based on your workspace and projects in Bitbucket Cloud. The namespaces created by the Endor Labs Bitbucket App are not like regular namespaces and are called managed namespaces. You can either configure the URL to Bitbucket Cloud to import all the projects or configure the project key to import a specific project in Endor Labs. You can use the following characters in Endor Labs namespaces: lowercase letters (a–z), digits (0–9), hyphens (-), and underscores (\_). Additionally, the namespace can have a maximum of 64 characters. If the Bitbucket host or your projects have a different naming convention, Endor Labs converts the corresponding namespaces to comply with the naming convention. See [Manage Bitbucket Cloud App](/setup-deployment/scm-integrations/bitbucket-cloud/manage-bitbucket-cloud) to learn how to manage your Bitbucket Cloud App integration in Endor Labs. ## Managed namespaces for Bitbucket Cloud You need to add the Bitbucket Cloud workspace or a project to an Endor Labs namespace. Endor Labs maps Bitbucket Cloud workspace and projects as managed namespaces. Managed namespaces have the following restrictions: * You cannot delete managed namespaces. * You cannot delete repositories within managed namespaces. * You cannot add projects or create namespaces within managed namespaces. * You cannot create new Endor Labs App installations within managed namespaces. ### Namespace structure when you add a Bitbucket Cloud workspace When you add a Bitbucket Cloud workspace to an Endor Labs namespace, Endor Labs creates a child namespace for the workspace and creates child namespaces for each project in the workspace under the workspace namespace. The namespaces of the workspace and projects are managed namespaces. You can add multiple Bitbucket Cloud workspaces to the same Endor Labs namespace. Each workspace will have its own managed namespace. If your workspace name is `deerinc` and you have three projects, `buck`, `doe`, and `fawn`, Endor Labs creates four managed namespaces: `deerinc`, `buck`, `doe`, and `fawn`. The namespaces `buck`, `doe`, and `fawn` are child namespaces of the `deerinc` namespace. The following image shows the namespace structure in Endor Labs. {` graph TD %% Endor Labs namespace EN[endor-bitbucket] %% Bitbucket projects O1[deerinc] P1[buck] P2[doe] P3[fawn] %% connections EN --> O1 O1 --> P1 O1 --> P2 O1 --> P3 class EN,EN2 endor class O1,P1,P2,P3 managed classDef managed fill:#5EEAD4 `} ### Namespace structure when you add a Bitbucket Cloud project When you add a Bitbucket Cloud project to an Endor Labs namespace, Endor Labs creates a child namespace for the Bitbucket Cloud project and maps all repositories in that project to this namespace. The child namespace that maps to the Bitbucket Cloud project is a managed namespace. The managed namespace has the name, `_`. For example, if your Bitbucket Cloud workspace name is `deerinc` and project name is `doe`, the managed namespace will have the name, `deerinc_doe`. You can add multiple projects to the same Endor Labs namespace. Each project will have its own managed namespace. For example, your workspace name is `deerinc`, which has three projects, `buck`,`doe`, and`fawn`. You add each project to the Endor Labs namespace, `endor-bitbucket`. The following image shows the namespace structure in Endor Labs. {` graph TD %% Endor Labs namespace EN[endor-bitbucket] %% Bitbucket projects A1[deerinc_buck] A2[deerinc_doe] A3[deerinc_fawn] %% connections EN --> A1 EN --> A2 EN --> A3 class EN,EN2 endor class A1,A2,A3 managed classDef managed fill:#5EEAD4 `} ## Default branch detection When Endor Labs scans a repository for the first time, it detects the default branch of the repository. The findings that are created in the scan are associated with the default branch. ### Changing the default branch When you change the default branch in your source control system (for example, from `main` to `dev`): * Endor Labs automatically detects the new default branch and sets that as the default reference * The previous default branch becomes a reference branch * Scans continue on the new default branch and the reference branch The findings associated with the previous default branch are no longer associated with the default context reference. You can view them in the reference context. ### Renaming the default branch When you rename the default branch in your source control system: * Endor Labs automatically switches to the renamed branch * Scans continue without disruption ### Adding repository versions When you add a new repository version (for example, a `dev` branch), both the default branch and the new version are scanned by the Endor Labs App. ### Control default branch detection You can control the default branch detection by setting the `ENDOR_SCAN_TRACK_DEFAULT_BRANCH` environment variable in a scan profile. You need to configure the project to use the scan profile. See [Configure scan profiles](/scan/scan-profiles) for more information. By default, the environment variable is set to `true`. When set to `true`, the default branch detection is enabled, and the first branch you scan is automatically considered as the default branch. ## Prerequisites for Bitbucket App for Bitbucket Cloud Ensure the following prerequisites are in place before you install the Endor Labs Bitbucket App. * Bitbucket Cloud instance with workspace and projects * A Bitbucket access token either at the [workspace level](https://support.atlassian.com/bitbucket-cloud/docs/create-a-workspace-access-token/) to import a workspace, or the [project level](https://support.atlassian.com/bitbucket-cloud/docs/create-a-project-access-token/) to import a project. The token must have at least `Project read` permission. ## Install the Bitbucket Cloud App 1. Select **Projects** from the left sidebar. 2. Click **Add Project**. 3. Under **Namespace**, select the Endor Labs namespace for this installation. We recommend you use a [child namespace](/platform-administration/namespaces) for better organization of your projects. 4. Select **Bitbucket** on the **Scan your repositories** page. 5. Select **Bitbucket Cloud**. Bitbucket Cloud App 6. In **Enter credentials**, select the authentication method you want to use to connect to Bitbucket Cloud. Select the **ACCESS TOKEN** to connect using an access token. Enter the following details: * **Host URL**: Enter the Bitbucket Cloud workspace URL. * To import all projects in a workspace, enter a URL in the form `https://bitbucket.org/{workspace}`. * To import a single project, enter a URL in the form `https://bitbucket.org/{workspace}/projects/{project-key}`. For example, `https://bitbucket.org/endor-labs/projects/lab`. * **Access token**: Enter a [workspace](https://support.atlassian.com/bitbucket-cloud/docs/create-a-workspace-access-token/) or [project](https://support.atlassian.com/bitbucket-cloud/docs/create-a-project-access-token/) access token. **Permissions for the access token** The access token must have at least the `Project:read` permission. If you want to scan pull requests, provide an access token with read and write permissions for webhooks and pull requests, and read access for projects. For more information, see [Create an access token](/setup-deployment/scm-integrations/bitbucket-cloud/bitbucket-cloud-pr-scans#create-an-access-token). Select **EMAIL and API TOKEN** to connect using an Atlassian account email address and API token. Enter the following details: * **Host URL**: Enter the Bitbucket Cloud workspace URL. * To import all projects in a workspace, enter a URL in the form `https://bitbucket.org/{workspace}`. * To import a single project, enter a URL in the form `https://bitbucket.org/{workspace}/projects/{project-key}`. For example, `https://bitbucket.org/endor-labs/projects/lab`. * **Email**: Enter the Atlassian account email for a user who has access to the Bitbucket workspace or project. * **API token with scopes**: Enter an [Atlassian API token](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/) with access that allows Endor Labs to read the Bitbucket projects you are importing. **Permissions for the API token** The API token must have at least `Project:read` and `Repository:read` permissions. If you want to scan pull requests, provide an API token that includes read access for projects and repositories, along with read and write access for pull requests and read, write, and delete for webhooks. For more information, see [Create an API token](/setup-deployment/scm-integrations/bitbucket-cloud/bitbucket-cloud-pr-scans/#create-an-api-token). 7. Click **Create Bitbucket Cloud Installation**. 8. Select the scan types to enable in **Scanners**. * **SCA**: Perform software composition analysis and discover AI models used in your repository. * **Secret**: Scan Bitbucket projects for exposed secrets. * **SAST**: Scan Bitbucket projects to generate SAST findings. The available scan types depend upon your license. Bitbucket scanner types 9. Optionally, you can continue to [Configure Bitbucket Cloud App PR scans](/setup-deployment/scm-integrations/bitbucket-cloud/bitbucket-cloud-pr-scans) to scan your pull requests. You can also choose to apply PR scans to specific projects rather than for all the projects in the workspace through a scan profile. See [Scan profiles](/scan/scan-profiles) for more information. You can also enable PR scans later in the [Bitbucket Cloud App integration](/setup-deployment/scm-integrations/bitbucket-cloud/manage-bitbucket-cloud#edit-bitbucket-cloud-app-integration). 10. Click **Start Scanning Repositories**. Endor Labs Bitbucket Cloud App scans your Bitbucket projects every 24 hours and reports any new findings or changes to release versions of your code.