docs: Asset Connectors concept + Azure DevOps, Bitbucket, GitLab, JSM Assets setup

Documents the new Asset Connector type (inventory reconciliation
instead of findings import, NEW/MISSING lifecycle, auto-created
Products and Product Types) and adds tool-specific setup sections for
the four new asset connectors, including the auth requirements
verified against the live vendor APIs: GitLab read_api PAT and
pending-deletion handling; JSM Premium plan + agent-seat requirement;
Bitbucket scoped-token requirement and mandatory workspace slugs;
Azure DevOps PAT read scopes and org URL normalization.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

docs/content/import_data/pro/connectors/connectors_tool_reference.md

@@ -19,6 +19,15 @@ Each tool has a different API configuration, and this guide is intended to help
 
 Whenever possible, we recommend creating a new 'DefectDojo Bot' account within your Security Tool which will only be used by the Connector. This will help you better differentiate between actions manually taken by your team, and automated actions taken by the Connector.
 
+# **Asset Connectors**
+
+Most Connectors import **findings** from a security tool. **Asset Connectors** work differently: they import your **asset inventory** instead. An Asset Connector enumerates the assets that exist in an external platform (for example, the repositories in a GitLab group) and automatically creates and maintains the matching **Products** (Assets) and **Product Types** (Organizations) in DefectDojo. No findings are imported by an Asset Connector.
+
+* **Discover** and **Sync** both reconcile the asset list. New assets appear as `NEW` Records; once mapped (automatically, if auto-mapping is enabled), DefectDojo creates the Product and groups it under a Product Type derived from the tool — for example, the GitLab namespace or the Azure DevOps project.
+* If an asset is later removed upstream (for example, a repository is deleted), its mapped Record is flagged `MISSING` on the next Sync so your team can triage it. DefectDojo never silently deletes a Product.
+
+Azure DevOps, Bitbucket, GitHub, GitLab, and Jira Service Management Assets are Asset Connectors. All other Connectors listed below import findings.
+
 # **Supported Connectors**
 
 ## **Akamai API Security**
@@ -87,6 +96,48 @@ A working policy definition might look like the following:
 
 Once you have created your IAM user and assigned it the necessary permissions using an appropriate policy/role, you will need to generate an access key, which you can then use to create a Connector.
 
+## **Azure DevOps**
+
+The Azure DevOps connector is an **Asset Connector**: it enumerates the git repositories in every project of your Azure DevOps organization and creates a DefectDojo Asset for each repository, grouped into Organizations by Azure DevOps project. No findings are imported.
+
+#### Prerequisites
+
+You will need a Personal Access Token (PAT) for the organization. We recommend creating the token from a dedicated service account. Only read scopes are required:
+
+1. In Azure DevOps, open **User settings \> Personal access tokens \> New Token**.
+2. Click **Show all scopes**, then select **Code: Read** and **Project and Team: Read**.
+
+Only Azure DevOps Services (dev.azure.com) is supported; on-premise Azure DevOps Server is not supported at this time.
+
+#### Connector Mappings
+
+1. Enter your organization URL in the **Location** field: `https://dev.azure.com/{your-organization}`. Legacy `https://{your-organization}.visualstudio.com` URLs are also accepted, and any extra path segments (for example, a link to a specific project) are ignored.
+2. Enter the PAT in the **Secret** field.
+
+Each repository becomes a Record named after the repository, grouped by its Azure DevOps **project**. Disabled repositories are skipped, so disabling or deleting a repository flags its Record as `MISSING` on the next Sync.
+
+## **Bitbucket**
+
+The Bitbucket connector is an **Asset Connector**: it enumerates the repositories in the Bitbucket Cloud workspaces you name and creates a DefectDojo Asset for each repository, grouped into Organizations by Bitbucket project. No findings are imported.
+
+#### Prerequisites
+
+Bitbucket Cloud requires a **scoped** Atlassian API token — classic (unscoped) Atlassian API tokens are rejected by Bitbucket with an "API Token provided has no Bitbucket scopes" error.
+
+1. Go to [id.atlassian.com/manage-profile/security/api-tokens](https://id.atlassian.com/manage-profile/security/api-tokens) and choose **Create API token with scopes**.
+2. Select the **Bitbucket** app, then grant the read scopes: `read:account:bitbucket`, `read:workspace:bitbucket`, `read:repository:bitbucket`, and `read:project:bitbucket`.
+
+Only Bitbucket Cloud (bitbucket.org) is supported. Bitbucket Server reached end of life in 2024, and Bitbucket Data Center is not supported.
+
+#### Connector Mappings
+
+1. Enter `https://bitbucket.org` in the **Location** field.
+2. Enter the Atlassian account email the token belongs to in the **Email** field.
+3. Enter the scoped API token in the **Secret** field.
+4. Enter one or more workspace slugs (comma-separated) in the **Workspace Slugs** field. This field is required: Bitbucket's scoped API tokens cannot list workspaces automatically, so DefectDojo needs to be told which workspaces to read.
+
+Each repository becomes a Record named after the repository, grouped by its Bitbucket **project**.
+
 #### Connector Mappings
 
 1. Enter the appropriate [AWS API Endpoint for your region](https://docs.aws.amazon.com/general/latest/gr/sechub.html#sechub_region) in the **Location** field**:**  for example, to retrieve results from the `us-east-1` region, you would supply
@@ -148,6 +199,21 @@ To generate a Dependency\-Track API key:
 
 For more information, see **[Dependency\-Track Documentation](https://docs.dependencytrack.org/integrations/rest-api/)**.
 
+## **GitLab**
+
+The GitLab connector is an **Asset Connector**: it enumerates every project (repository) your token can access and creates a DefectDojo Asset for each one, grouped into Organizations by GitLab namespace (group or user). No findings are imported.
+
+#### Prerequisites
+
+You will need a Personal Access Token with the **read_api** scope. We recommend creating the token from a dedicated service account; the connector lists the projects that account is a member of.
+
+#### Connector Mappings
+
+1. Enter your GitLab URL in the **Location** field: `https://gitlab.com`, or the base URL of your self-hosted instance.
+2. Enter the Personal Access Token in the **Secret** field.
+
+Each project becomes a Record named after the project, grouped by its **namespace**. Projects that are pending deletion in GitLab (deleted by a user, but not yet purged by GitLab's background job) are excluded automatically, so deleting a project flags its Record as `MISSING` on the next Sync instead of leaving behind a renamed ghost asset.
+
 ## **IriusRisk**
 
 The IriusRisk connector uses an API token to pull threat modeling data from your IriusRisk instance.
@@ -196,6 +262,24 @@ DefectDojo maps each Artifactory **repository** as a separate Record. On first S
 
 See the [JFrog Xray REST API documentation](https://jfrog.com/help/r/jfrog-rest-apis/xray-rest-apis) for more information.
 
+## **Jira Service Management Assets**
+
+The JSM Assets connector is an **Asset Connector**: it enumerates the objects in your Jira Service Management Assets (formerly Insight) workspace and creates a DefectDojo Asset for each object, grouped into Organizations by object schema. No findings are imported.
+
+#### Prerequisites
+
+* Assets requires a **Jira Service Management Premium or Enterprise** plan. On Free or Standard plans the Assets API responds with `403 "Access to Assets API was denied"`, even though the rest of the site works.
+* The Atlassian account used must have **Jira Service Management product access** (an agent seat) on the site — site access alone is not enough.
+* Create a classic Atlassian API token at [id.atlassian.com/manage-profile/security/api-tokens](https://id.atlassian.com/manage-profile/security/api-tokens). We recommend a dedicated service account.
+
+#### Connector Mappings
+
+1. Enter your Atlassian site URL in the **Location** field: `https://{your-site}.atlassian.net`.
+2. Enter the Atlassian account email the token belongs to in the **Email** field.
+3. Enter the API token in the **Secret** field.
+
+Each Assets object becomes a Record named after the object's label, grouped by its **object schema**.
+
 ## Probely
 
 This connector uses the Probely REST API to fetch data.