User Interface, Search, Browse, Components, Assets, Tags, Uploads, and Repository Navigation: Concepts, Architecture, and Mental Model

1. The practical problem: one artifact, several views

A build engineer says “the package is in Nexus.” That sentence is too imprecise for operations. It might mean a client can download bytes from a repository URL, the Browse tree contains a path, Search returns a component, the Components API has a component record, the Assets API lists one or more files, or a Pro deployment associates a tag with the component. Those views overlap, but they are not interchangeable.

Chapter 01 defined a component as the logical package/version object and an asset as an individual stored file or metadata object. Chapter 02 showed that Nexus keeps application configuration and metadata in database-backed state while artifact payloads live in blob storage. This chapter teaches how the operator-facing views project that underlying state.

2. Mental model: request → authorization → view → persistent state

flowchart TD
  U[Browser or API client] --> A[Authentication and privileges]
  A --> V{Requested view}
  V --> B[Browse tree]
  V --> S[SQL search]
  V --> C[Component or asset API]
  V --> D[Direct repository URL]
  B --> M[Database metadata]
  S --> M
  C --> M
  D --> M
  D --> X[Blob content]
  C --> X
  M --> R[Repository config: name format type]
  X --> R

The first arrow is the human or automation request. Authorization decides whether the caller may search, browse, read, upload, edit or administer the selected repository. Browse organizes repository content into a navigable path tree. Search queries indexed database metadata; since Nexus Repository 3.88.0, Sonatype documents SQL-backed search rather than Elasticsearch. Component and asset APIs expose structured metadata. A direct repository URL asks Nexus to serve a specific asset and therefore crosses from metadata to blob content.

The diagram deliberately separates view from truth. The UI is a client of Nexus state, not a second repository. When two views disagree, preserve both observations and diagnose permissions, query semantics, indexing and repository type before attempting repair.

3. Define the objects before using the controls

4. Browse is navigation; Search is a query

Browse answers “what paths can this identity navigate in this repository?” Search answers “which components/assets match these indexed fields?” The current UI shows only the first 300 component-search results, while the REST APIs use continuation tokens for pagination. Browse itself has a documented 10,000-component-per-level UI limit. Neither limit means the repository contains only that many records.

SQL search introduced stricter semantics. Hyphenated keywords are tokenized, fuzzy/stemmed matching is not implied, exact phrases can be quoted, and wildcard behavior differs from older Elasticsearch-era instructions. If a familiar old wildcard stops matching after an upgrade, first reproduce the query against current SQL-search rules; do not rebuild the database or delete blobs.

5. Visibility is privilege-specific

This separation explains a common observation: a user may be able to search metadata without being allowed to download the asset, or may have read access for a package manager while the Browse navigation is absent. Later security chapters will design roles in depth; here the goal is to interpret the behavior correctly.

6. Read-only inspection first

Reuse a disposable loopback instance from Chapter 02. The following commands do not create or delete repository content. Store credentials only in a permission-restricted temporary netrc file so the password is not placed directly in the curl argument list.

LAB="$HOME/nexus-ch03-lab"
NX_URL="http://127.0.0.1:8081"
mkdir -p "$LAB/evidence" "$LAB/payload"
umask 077
read -rsp "Disposable Nexus admin password: " NX_PASS; printf "\n"
printf 'machine 127.0.0.1 login admin password %s\n' "$NX_PASS" > "$LAB/nexus.netrc"
unset NX_PASS
NETRC="$LAB/nexus.netrc"

# Never commit or print $NETRC. Delete it when the lab ends.

curl --fail-with-body --silent --show-error --netrc-file "$NETRC" \
  "$NX_URL/service/rest/v1/repositories" \
  | tee "$LAB/evidence/01-repositories.json"

curl --fail-with-body --silent --show-error --netrc-file "$NETRC" \
  "$NX_URL/service/rest/v1/search?repository=maven-releases" \
  | tee "$LAB/evidence/02-search-example.json"

curl --fail-with-body --silent --show-error --netrc-file "$NETRC" \
  "$NX_URL/service/rest/v1/assets?repository=maven-releases" \
  | tee "$LAB/evidence/03-assets-example.json"

The exact default repository names can vary with onboarding/version choices. If maven-releases does not exist, select a repository name from 01-repositories.json rather than creating one merely to make this read-only exercise pass. A correct operator adapts the query to observed state.

7. Why this matters in DevOps

CI/CD pipelines, developers and release automation all need a shared answer to “which artifact?” A repository UI can help a human investigate, but a production workflow should be able to prove the same identity through stable coordinates, structured API evidence and immutable checksums/digests. Searchability improves discoverability; it does not replace publication policy, authorization, provenance or recovery.

Knowledge check

8. Summary

Nexus navigation is a set of views over repository configuration, database metadata and blob content. Browse, Search, Components, Assets and direct repository URLs answer different questions under different privileges. Treat those differences as diagnostic signals, not inconsistencies to erase.

Official references and version notes

• Download Nexus Repository — the official download page used to pin the same 3.94.1-06 self-hosted lab baseline as Chapter 02 while current indexes are rechecked before execution.
• Browsing Repositories — browse-tree behavior, 10,000-component-per-level UI limit, HTML view, and browse/read privilege distinctions.
• Searching for Components — current UI search behavior, first-300-result display, SQL-search semantics, tokenization, exact phrases, and wildcard rules.
• Search API — component/asset search endpoints and continuation-token pagination.
• Viewing Component Information — component identifiers and the relationship to associated assets.
• Viewing Asset Information — asset path, content type, size, blob timestamps/reference, checksums, uploader metadata, and format-specific attributes.
• Uploading Components — hosted-only UI upload boundary and required upload/browse/read privileges.
• Components API — list/get/delete components and format-specific multipart component upload.
• Assets API — paginated asset listing, asset details, paths, download URLs and checksums.
• Repositories API — repository inventory and format/type-specific repository configuration endpoints.
• Privileges — current browse, read, add, edit, delete and search privilege semantics.
• Tagging and Self-Hosted Feature Matrix — component tagging is currently a Pro feature; mandatory Chapter 03 work does not require it.

Version-sensitive statements were rechecked against Sonatype primary documentation on 2026-08-26. The mandatory path remains self-hosted, Community/free-compatible and disposable. The chapter keeps the Chapter 02 lab baseline at Nexus Repository 3.94.1-06 because Sonatype's current download and versions-status pages still present 3.94.1 as the current downloadable/GA line; learners are told to re-check those pages before running the lab.