---
title: "Create a new project with an initial scan, using the provided SBOM file as the manifest."
method: POST
path: "/v1/{org_name}/projects/import-sbom"
tags: ["Projects", "Attestations"]
---

# Create a new project with an initial scan, using the provided SBOM file as the manifest.

`POST /v1/{org_name}/projects/import-sbom`

## Path parameters

- `org_name` string, required

## Response `201`

Project that was created

- object
  - `name` string, required
  - `catalog` string
  - `groups` string[], nullable, required — List of group slugs associated with the project
  - `branching_behavior` 'specified_branch' | 'latest_aligned_branch', required — Controls how the project's default branch is determined. `specified_branch` uses the branch set in `default_branch`. `latest_aligned_branch` automatically updates to the most recently aligned branch.
  - `default_branch` string, required
  - `external_identifier` string, nullable, required — An optional custom identifier that can be set that corresponds to something outside of Tidelift
  - `using_catalog` string, nullable
  - `dot_tidelift` string
  - `attestation_report_url` string

## Other responses

- `400` — The project name, groups, catalog or SBOM file are invalid.
- `401` — Unauthorized
- `403` — The user is not an admin of the organization or doesn't belong to the organization.

---

[API](https://skmtc.net/tidelift/apis/tidelift-external-api.md) · [All operations](https://skmtc.net/tidelift/apis/tidelift-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tidelift/tidelift-external-api/revisions/5f36bed372bb/schema)