diff --git a/docs/reference/api/openapi-v1.yaml b/docs/reference/api/openapi-v1.yaml
index b208edca..36167bc5 100644
--- a/docs/reference/api/openapi-v1.yaml
+++ b/docs/reference/api/openapi-v1.yaml
@@ -248,7 +248,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the team to retrieve mappings for
         in: path
         name: uuid
@@ -509,7 +510,9 @@ paths:
           When creating projects, <code>parentUUID</code> or <code>parentName</code> and
           <code>parentVersion</code> can place the new project under a parent,
           <code>projectTags</code> can apply tags, and <code>isLatest</code> can mark it as
-          the latest version. The <code>isActive</code> parameter sets the project's active
+          the latest version. <code>accessTeams</code> can grant teams access to the new project,
+          following the same rules as <code>accessTeams</code> when creating a project via
+          <code>PUT /api/v1/project</code>. The <code>isActive</code> parameter sets the project's active
           state whenever it is provided, including when the target project already exists, so
           clients should send it only when they intend to change that state.
         </p>
@@ -521,6 +524,11 @@ paths:
             schema:
               type: object
               properties:
+                accessTeams:
+                  type: string
+                  description: "JSON array of teams to grant access to the project\
+                    \ when it is created via autoCreate, e.g. <code>[{\"name\": \"\
+                    Team A\"}, {\"uuid\": \"...\"}]</code>."
                 autoCreate:
                   type: boolean
                   default: false
@@ -596,7 +604,9 @@ paths:
           When creating projects, <code>parentUUID</code> or <code>parentName</code> and
           <code>parentVersion</code> can place the new project under a parent,
           <code>projectTags</code> can apply tags, and <code>isLatest</code> can mark it as
-          the latest version. The <code>isActive</code> parameter sets the project's active
+          the latest version. <code>accessTeams</code> can grant teams access to the new project,
+          following the same rules as <code>accessTeams</code> when creating a project via
+          <code>PUT /api/v1/project</code>. The <code>isActive</code> parameter sets the project's active
           state whenever it is provided, including when the target project already exists, so
           clients should send it only when they intend to change that state.
         </p>
@@ -931,7 +941,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: "The MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-384,\
           \ SHA3-512, BLAKE2b-256, BLAKE2b-384, BLAKE2b-512, BLAKE3, Streebog-256,\
           \ or Streebog-512 hash of the component to retrieve"
@@ -1007,7 +1018,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The group of the component
         in: query
         name: group
@@ -1104,7 +1116,13 @@ paths:
       - component
   /v1/component/project/{projectUuid}/dependencyGraph/{componentUuids}:
     get:
-      description: <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+      deprecated: true
+      description: |-
+        <p>Requires permission <strong>VIEW_PORTFOLIO</strong>.</p>
+        <p>
+          <strong>Deprecated</strong>! Use <code>/api/v2/projects/{uuid}/dependency-graph</code>
+          for the graph structure, and <code>/api/v2/projects/{uuid}/components</code> for component details.
+        </p>
       operationId: getDependencyGraphForComponent
       parameters:
       - description: The UUID of the project to get the expanded dependency graph
@@ -1192,7 +1210,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the project to retrieve components for
         in: path
         name: uuid
@@ -1399,7 +1418,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - in: path
         name: uuid
         required: true
@@ -1465,7 +1485,11 @@ paths:
                 $ref: "#/components/schemas/ProblemDetails"
           description: Access to the requested project is forbidden
         "404":
-          description: The project could not be found
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
+          description: The component could not be found
       security:
       - ApiKeyAuth: []
       - BearerAuth: []
@@ -1505,6 +1529,10 @@ paths:
                 $ref: "#/components/schemas/ProblemDetails"
           description: Access to the requested project is forbidden
         "404":
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
           description: The component could not be found
         "409":
           description: A property with the specified component/group/name combination
@@ -1547,6 +1575,10 @@ paths:
                 $ref: "#/components/schemas/ProblemDetails"
           description: Access to the requested project is forbidden
         "404":
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
           description: The component or component property could not be found
       security:
       - ApiKeyAuth: []
@@ -1758,7 +1790,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -1811,7 +1844,14 @@ paths:
       - cwe
   /v1/dependencyGraph/component/{uuid}/directDependencies:
     get:
-      description: <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+      deprecated: true
+      description: |-
+        <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+        <p>
+          <strong>Deprecated</strong>! Use <code>/api/v2/projects/{uuid}/dependency-graph</code>
+          of the component's project for the graph structure,
+          and <code>/api/v2/projects/{uuid}/components</code> for component details.
+        </p>
       operationId: getComponentsAndServicesByComponentUuid
       parameters:
       - description: The UUID of the component
@@ -1848,7 +1888,13 @@ paths:
       - dependencyGraph
   /v1/dependencyGraph/project/{uuid}/directDependencies:
     get:
-      description: <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+      deprecated: true
+      description: |-
+        <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+        <p>
+          <strong>Deprecated</strong>! Use <code>/api/v2/projects/{uuid}/dependency-graph</code>
+          for the graph structure, and <code>/api/v2/projects/{uuid}/components</code> for component details.
+        </p>
       operationId: getComponentsAndServicesByProjectUuid
       parameters:
       - description: The UUID of the project
@@ -1962,7 +2008,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Show inactive projects
         in: query
         name: showInactive
@@ -2162,7 +2209,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Show inactive projects
         in: query
         name: showInactive
@@ -2355,7 +2403,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the project
         in: path
         name: uuid
@@ -2696,7 +2745,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -2866,7 +2916,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -3733,7 +3784,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The notification trigger type to filter on
         in: query
         name: triggerType
@@ -3813,6 +3865,13 @@ paths:
               schema:
                 $ref: "#/components/schemas/NotificationRule"
           description: The created notification rule
+        "400":
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/InvalidNotificationFilterExpressionProblemDetails"
+          description: "Invalid filter expression, publisher configuration, or notification\
+            \ groups"
         "401":
           description: Unauthorized
         "404":
@@ -3840,6 +3899,13 @@ paths:
               schema:
                 $ref: "#/components/schemas/NotificationRule"
           description: The created scheduled notification rule
+        "400":
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/InvalidNotificationFilterExpressionProblemDetails"
+          description: "Invalid filter expression, publisher configuration, schedule,\
+            \ or notification groups"
         "401":
           description: Unauthorized
         "404":
@@ -4547,7 +4613,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -4899,7 +4966,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The optional name of the project to query on
         in: query
         name: name
@@ -5113,7 +5181,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The classifier to query on
         in: path
         name: classifier
@@ -5205,7 +5274,10 @@ paths:
       - project
   /v1/project/concise:
     get:
-      description: <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+      deprecated: true
+      description: |-
+        <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+        <p><strong>Deprecated</strong>! Use <code>/api/v2/projects</code> instead.</p>
       operationId: getProjectsConcise
       parameters:
       - description: The page to return. To be used in conjunction with <code>pageSize</code>.
@@ -5244,7 +5316,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Name to filter on. Must be exact match.
         in: query
         name: name
@@ -5310,7 +5383,10 @@ paths:
       - project
   /v1/project/concise/{uuid}/children:
     get:
-      description: <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+      deprecated: true
+      description: |-
+        <p>Requires permission <strong>VIEW_PORTFOLIO</strong></p>
+        <p><strong>Deprecated</strong>! Use <code>/api/v2/projects?parent_uuid={uuid}</code> instead.</p>
       operationId: getProjectChildrenConcise
       parameters:
       - description: The page to return. To be used in conjunction with <code>pageSize</code>.
@@ -5349,7 +5425,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: UUID of the project
         in: path
         name: uuid
@@ -5529,7 +5606,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The tag to query on
         in: path
         name: tag
@@ -5610,7 +5688,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the project which descendants will be excluded
         in: path
         name: uuid
@@ -5831,7 +5910,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the project to get the children from
         in: path
         name: uuid
@@ -5916,7 +5996,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The classifier to query on
         in: path
         name: classifier
@@ -6021,7 +6102,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The tag to query on
         in: path
         name: tag
@@ -6101,6 +6183,10 @@ paths:
                 $ref: "#/components/schemas/ProblemDetails"
           description: Access to the requested project is forbidden
         "404":
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
           description: The project or project property could not be found
       security:
       - ApiKeyAuth: []
@@ -6138,6 +6224,10 @@ paths:
                 $ref: "#/components/schemas/ProblemDetails"
           description: Access to the requested project is forbidden
         "404":
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
           description: The project could not be found
       security:
       - ApiKeyAuth: []
@@ -6178,7 +6268,11 @@ paths:
                 $ref: "#/components/schemas/ProblemDetails"
           description: Access to the requested project is forbidden
         "404":
-          description: The project could not be found
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
+          description: The project or project property could not be found
       security:
       - ApiKeyAuth: []
       - BearerAuth: []
@@ -6218,6 +6312,10 @@ paths:
                 $ref: "#/components/schemas/ProblemDetails"
           description: Access to the requested project is forbidden
         "404":
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
           description: The project could not be found
         "409":
           description: A property with the specified project/group/name combination
@@ -6270,7 +6368,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -6424,7 +6523,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The type of repositories to retrieve
         in: path
         name: type
@@ -6569,7 +6669,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the project
         in: path
         name: uuid
@@ -6795,7 +6896,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -6917,7 +7019,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Name of the tag to get collection projects for
         in: path
         name: name
@@ -7029,7 +7132,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Name of the tag to get notification rules for
         in: path
         name: name
@@ -7177,7 +7281,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Name of the tag to get policies for.
         in: path
         name: name
@@ -7325,7 +7430,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Name of the tag to get projects for.
         in: path
         name: name
@@ -7475,7 +7581,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Name of the tag to get vulnerabilities for.
         in: path
         name: name
@@ -7565,7 +7672,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -7802,7 +7910,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -8638,7 +8747,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Optionally includes suppressed violations
         in: query
         name: suppressed
@@ -8826,7 +8936,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the component
         in: path
         name: uuid
@@ -8911,7 +9022,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the project
         in: path
         name: uuid
@@ -8996,7 +9108,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       responses:
         "200":
           content:
@@ -9114,7 +9227,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: The UUID of the component to retrieve vulnerabilities for
         in: path
         name: uuid
@@ -9372,7 +9486,8 @@ paths:
         schema:
           type: string
           enum:
-          - "asc, desc"
+          - asc
+          - desc
       - description: Optional case-insensitive substring match on project name.
         in: query
         name: searchText
@@ -9949,6 +10064,15 @@ components:
     BomSubmitRequest:
       type: object
       properties:
+        accessTeams:
+          type: array
+          description: Teams to grant access to the project when it is created via
+            autoCreate. Either uuid or name of a team must be specified. Only teams
+            which the authenticated principal is a member of can be assigned. Principals
+            with ACCESS_MANAGEMENT permission can assign any team. Ignored when the
+            project already exists.
+          items:
+            $ref: "#/components/schemas/Team"
         autoCreate:
           type: boolean
         bom:
@@ -10727,22 +10851,67 @@ components:
     CreateNotificationRuleRequest:
       type: object
       properties:
+        enabled:
+          type: boolean
+        filterExpression:
+          type: string
+          maxLength: 2048
+          minLength: 0
         level:
           type: string
           enum:
           - INFORMATIONAL
           - WARNING
           - ERROR
+        logSuccessfulPublish:
+          type: boolean
         name:
           type: string
           minLength: 1
+        notifyChildren:
+          type: boolean
+        notifyOn:
+          type: array
+          items:
+            type: string
+            enum:
+            - CONFIGURATION
+            - DATASOURCE_MIRRORING
+            - REPOSITORY
+            - INTEGRATION
+            - FILE_SYSTEM
+            - ANALYZER
+            - NEW_VULNERABILITY
+            - NEW_VULNERABLE_DEPENDENCY
+            - VULNERABILITY_RETRACTED
+            - PROJECT_AUDIT_CHANGE
+            - BOM_CONSUMED
+            - BOM_PROCESSED
+            - BOM_PROCESSING_FAILED
+            - BOM_VALIDATION_FAILED
+            - VEX_CONSUMED
+            - VEX_PROCESSED
+            - POLICY_VIOLATION
+            - PROJECT_CREATED
+            - USER_CREATED
+            - USER_DELETED
+            - NEW_VULNERABILITIES_SUMMARY
+            - NEW_POLICY_VIOLATIONS_SUMMARY
+          uniqueItems: true
         publisher:
           $ref: "#/components/schemas/Publisher"
+        publisherConfig:
+          type: string
         scope:
           type: string
           enum:
           - SYSTEM
           - PORTFOLIO
+        tags:
+          type: array
+          items:
+            $ref: "#/components/schemas/Tag"
+          uniqueItems: true
       required:
       - level
       - name
@@ -10912,24 +11081,73 @@ components:
     CreateScheduledNotificationRuleRequest:
       type: object
       properties:
+        enabled:
+          type: boolean
+        filterExpression:
+          type: string
+          maxLength: 2048
+          minLength: 0
         level:
           type: string
           enum:
           - INFORMATIONAL
           - WARNING
           - ERROR
+        logSuccessfulPublish:
+          type: boolean
         name:
           type: string
           maxLength: 255
           minLength: 1
           pattern: "^[\\p{IsWhite_Space}\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]*$"
+        notifyChildren:
+          type: boolean
+        notifyOn:
+          type: array
+          items:
+            type: string
+            enum:
+            - CONFIGURATION
+            - DATASOURCE_MIRRORING
+            - REPOSITORY
+            - INTEGRATION
+            - FILE_SYSTEM
+            - ANALYZER
+            - NEW_VULNERABILITY
+            - NEW_VULNERABLE_DEPENDENCY
+            - VULNERABILITY_RETRACTED
+            - PROJECT_AUDIT_CHANGE
+            - BOM_CONSUMED
+            - BOM_PROCESSED
+            - BOM_PROCESSING_FAILED
+            - BOM_VALIDATION_FAILED
+            - VEX_CONSUMED
+            - VEX_PROCESSED
+            - POLICY_VIOLATION
+            - PROJECT_CREATED
+            - USER_CREATED
+            - USER_DELETED
+            - NEW_VULNERABILITIES_SUMMARY
+            - NEW_POLICY_VIOLATIONS_SUMMARY
+          uniqueItems: true
         publisher:
           $ref: "#/components/schemas/Publisher"
+        publisherConfig:
+          type: string
+        scheduleCron:
+          type: string
+        scheduleSkipUnchanged:
+          type: boolean
         scope:
           type: string
           enum:
           - SYSTEM
           - PORTFOLIO
+        tags:
+          type: array
+          items:
+            $ref: "#/components/schemas/Tag"
+          uniqueItems: true
       required:
       - level
       - name
diff --git a/docs/reference/api/openapi-v2.yaml b/docs/reference/api/openapi-v2.yaml
index 11ef70ea..797b7327 100644
--- a/docs/reference/api/openapi-v2.yaml
+++ b/docs/reference/api/openapi-v2.yaml
@@ -41,6 +41,25 @@ info:
     instead of exact counts (type `EXACT`). Which type to expect is usually
     documented in the operation's description.
 
+    ## Filtering
+
+    Items in a collection can be filtered using query parameters.
+    When multiple filter parameters are given, an item must match all of them.
+
+    Filters that accept multiple values take them as repeated parameters,
+    e.g. `?<field>=a&<field>=b`. How the values are combined depends on the field:
+
+    - If the field holds a single value, an item matches when it has *any* of the given values.
+    - If the field holds multiple values, the parameter name states how they are combined:
+      `<field>_all` requires every given value, `<field>_any` at least one.
+
+    Time range filters are named `<field>_since` and `<field>_before`.
+    `_since` is inclusive and `_before` is exclusive, so adjacent ranges neither overlap nor leave gaps.
+
+    Text filters state how they match with a suffix: `<field>_contains` matches a substring,
+    `<field>_prefix` the start of the value. A filter without a suffix matches the exact value.
+    Which filter types are available depends on the operation.
+
     ## Sorting
 
     Items in a collection can be sorted using the `sort_by` and `sort_direction`
@@ -354,6 +373,7 @@ paths:
           type: string
       - name: sort_direction
         in: query
+        description: Direction to sort in.
         schema:
           $ref: "#/components/schemas/sort-direction"
       - name: sort_by
@@ -823,6 +843,219 @@ paths:
         default:
           $ref: "#/components/responses/generic-error"
       security: []
+  /projects:
+    get:
+      tags:
+      - Projects
+      summary: List all projects
+      description: |-
+        Retrieves a paginated list of projects matching the provided filter criteria.
+
+        Text filters are case-insensitive. When portfolio access control is enabled,
+        only projects accessible to the caller are returned.
+
+        Results are sorted by `name` ascending when `sort_by` is omitted.
+
+        Reports `EXACT` total counts for up to 500 items, and `AT_LEAST` past that.
+
+        ### Sortable fields
+
+        Sorting is supported for the following fields:
+
+        * `name`
+        * `group`
+        * `version`
+        * `classifier`
+        * `last_bom_import`
+        * `last_inherited_risk_score`
+
+        ### Expandable fields
+
+        The following fields can be included via `expand`:
+
+        * `metrics`
+        * `parent`
+        * `teams`
+
+        Requires permission `VIEW_PORTFOLIO`.
+      operationId: listProjects
+      parameters:
+      - name: name_contains
+        in: query
+        description: |-
+          Filter by name (substring match).
+
+          Leading and trailing whitespace is ignored. Values that are empty or
+          whitespace-only are treated as if the parameter was omitted.
+        schema:
+          type: string
+      - name: version_contains
+        in: query
+        description: |-
+          Filter by version (substring match).
+
+          Leading and trailing whitespace is ignored. Values that are empty or
+          whitespace-only are treated as if the parameter was omitted.
+        schema:
+          type: string
+      - name: tags_all
+        in: query
+        description: |-
+          Filter by tag names (exact match, case-insensitive).
+          When multiple values are provided, only projects matching **all** tags are returned.
+        style: form
+        explode: true
+        schema:
+          type: array
+          items:
+            type: string
+      - name: teams_any
+        in: query
+        description: |-
+          Filter by team names (exact match, case-insensitive).
+          When multiple values are provided, projects matching **any** of the teams are returned.
+        style: form
+        explode: true
+        schema:
+          type: array
+          items:
+            type: string
+      - name: parent_uuid
+        in: query
+        description: |-
+          Filter by parent project UUID.
+
+          Returns only direct children of the given parent (one hierarchy level).
+
+          When portfolio access control is enabled and the caller does not have
+          access to the parent project, an empty result set is returned.
+
+          For all descendants at any depth under a root or other ancestor,
+          use `ancestor_uuid` instead.
+        schema:
+          type: string
+          format: uuid
+      - name: ancestor_uuid
+        in: query
+        description: |-
+          Filter by ancestor project UUID.
+
+          Returns all descendants of the given project at any depth
+          (excluding the ancestor itself).
+
+          When portfolio access control is enabled and the caller does not have
+          access to the ancestor project, an empty result set is returned.
+          Individual descendants remain subject to the caller's project ACL.
+        schema:
+          type: string
+          format: uuid
+      - name: only_root
+        in: query
+        description: "When `true`, return only root projects (those without a parent)."
+        schema:
+          type: boolean
+      - name: state
+        in: query
+        description: |-
+          Filter by project active state.
+
+          Omit to include projects regardless of active state.
+        schema:
+          $ref: "#/components/schemas/project-state"
+      - name: is_latest
+        in: query
+        description: |-
+          When `true`, return only latest-version projects.
+          When `false`, return only non-latest projects.
+          Omit to include projects regardless of the flag.
+        schema:
+          type: boolean
+      - name: last_bom_import_since
+        in: query
+        description: |-
+          Filter by last BOM import time (inclusive lower bound).
+
+          Projects that have never imported a BOM are excluded whenever
+          `last_bom_import_since` or `last_bom_import_before` is set.
+        schema:
+          $ref: "#/components/schemas/timestamp"
+      - name: last_bom_import_before
+        in: query
+        description: Filter by last BOM import time (exclusive upper bound).
+        schema:
+          $ref: "#/components/schemas/timestamp"
+      - name: classifier
+        in: query
+        description: |-
+          Filter by project classifier (exact match).
+          When multiple values are provided, projects matching **any** of the classifiers are returned.
+
+          Values must match the shared classifier schema. Unknown values result in `400 Bad Request`.
+        style: form
+        explode: true
+        schema:
+          type: array
+          items:
+            $ref: "#/components/schemas/classifier"
+      - name: expand
+        in: query
+        description: Optional fields to include in each project response item. Unknown
+          values are silently ignored.
+        style: form
+        explode: true
+        schema:
+          type: array
+          items:
+            type: string
+      - name: limit
+        in: query
+        description: Maximum number of items to retrieve from the collection
+        schema:
+          maximum: 1000
+          minimum: 1
+          type: integer
+          format: int32
+          default: 100
+      - name: page_token
+        in: query
+        description: Opaque token pointing to a specific position in a collection
+        schema:
+          type: string
+      - name: sort_direction
+        in: query
+        description: Direction to sort in.
+        schema:
+          $ref: "#/components/schemas/sort-direction"
+      - name: sort_by
+        in: query
+        description: Field to sort by. Refer to the operation description for information
+          about which fields are sortable.
+        schema:
+          maxLength: 255
+          minLength: 1
+          type: string
+      responses:
+        "200":
+          description: A list of projects matching the provided filters
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/list-projects-response"
+        "400":
+          description: Bad Request
+          content:
+            application/problem+json:
+              schema:
+                anyOf:
+                - $ref: "#/components/schemas/invalid-sort-field-problem-details"
+                - $ref: "#/components/schemas/invalid-request-problem-details"
+                - $ref: "#/components/schemas/problem-details"
+        "401":
+          $ref: "#/components/responses/generic-unauthorized-error"
+        "403":
+          $ref: "#/components/responses/generic-forbidden-error"
+        default:
+          $ref: "#/components/responses/generic-error"
   /projects/{uuid}/clone:
     post:
       tags:
@@ -948,6 +1181,7 @@ paths:
           type: string
       - name: sort_direction
         in: query
+        description: Direction to sort in.
         schema:
           $ref: "#/components/schemas/sort-direction"
       - name: sort_by
@@ -981,6 +1215,46 @@ paths:
           $ref: "#/components/responses/generic-not-found-error"
         default:
           $ref: "#/components/responses/generic-error"
+  /projects/{uuid}/dependency-graph:
+    get:
+      tags:
+      - Projects
+      summary: Get project dependency graph
+      description: |-
+        Retrieves the entire dependency graph of a given project.
+
+        `nodes` contains the project itself, and all of its components and services,
+        including those that are not reachable from the project.
+
+        Exactly one node has the type `PROJECT`. Its UUID is the UUID of the requested project.
+        Every UUID in a `direct_dependencies` array refers to an item in `nodes`.
+        Note that the graph may contain cycles.
+
+        Requires permission `VIEW_PORTFOLIO`.
+      operationId: getProjectDependencyGraph
+      parameters:
+      - name: uuid
+        in: path
+        description: The UUID of the project to retrieve the dependency graph for
+        required: true
+        schema:
+          type: string
+          format: uuid
+      responses:
+        "200":
+          description: The dependency graph of the project
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/get-project-dependency-graph-response"
+        "401":
+          $ref: "#/components/responses/generic-unauthorized-error"
+        "403":
+          $ref: "#/components/responses/generic-forbidden-error"
+        "404":
+          $ref: "#/components/responses/generic-not-found-error"
+        default:
+          $ref: "#/components/responses/generic-error"
   /secrets:
     get:
       tags:
@@ -2581,6 +2855,7 @@ paths:
           type: string
       - name: sort_direction
         in: query
+        description: Direction to sort in.
         schema:
           $ref: "#/components/schemas/sort-direction"
       - name: sort_by
@@ -2692,6 +2967,7 @@ paths:
           type: string
       - name: sort_direction
         in: query
+        description: Direction to sort in.
         schema:
           $ref: "#/components/schemas/sort-direction"
       responses:
@@ -3043,6 +3319,33 @@ components:
           maxLength: 256
           type: string
           description: "A short, generic description of the error."
+    classifier:
+      type: string
+      enum:
+      - APPLICATION
+      - FRAMEWORK
+      - LIBRARY
+      - CONTAINER
+      - OPERATING_SYSTEM
+      - DEVICE
+      - FIRMWARE
+      - FILE
+      - PLATFORM
+      - DEVICE_DRIVER
+      - MACHINE_LEARNING_MODEL
+      - DATA
+      - CRYPTOGRAPHIC_ASSET
+    list-projects-response:
+      required:
+      - items
+      type: object
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/list-projects-response-item"
+      allOf:
+      - $ref: "#/components/schemas/paginated-response"
     clone-project-request:
       required:
       - version
@@ -3100,6 +3403,15 @@ components:
             $ref: "#/components/schemas/list-project-components-response-item"
       allOf:
       - $ref: "#/components/schemas/paginated-response"
+    get-project-dependency-graph-response:
+      required:
+      - nodes
+      type: object
+      properties:
+        nodes:
+          type: array
+          items:
+            $ref: "#/components/schemas/get-project-dependency-graph-response-node"
     list-secrets-response:
       required:
       - items
@@ -3850,22 +4162,6 @@ components:
           $ref: "#/components/schemas/package-metadata"
         package_artifact_metadata:
           $ref: "#/components/schemas/package-artifact-metadata"
-    classifier:
-      type: string
-      enum:
-      - APPLICATION
-      - FRAMEWORK
-      - LIBRARY
-      - CONTAINER
-      - OPERATING_SYSTEM
-      - DEVICE
-      - FIRMWARE
-      - FILE
-      - PLATFORM
-      - DEVICE_DRIVER
-      - MACHINE_LEARNING_MODEL
-      - DATA
-      - CRYPTOGRAPHIC_ASSET
     hashes:
       type: object
       properties:
@@ -4025,6 +4321,69 @@ components:
         message:
           type: string
           example: Connection failed
+    list-projects-response-item:
+      required:
+      - has_children
+      - is_latest
+      - name
+      - uuid
+      type: object
+      properties:
+        uuid:
+          type: string
+          format: uuid
+        name:
+          maxLength: 255
+          type: string
+        version:
+          maxLength: 255
+          type: string
+        group:
+          maxLength: 255
+          type: string
+        classifier:
+          $ref: "#/components/schemas/classifier"
+        is_latest:
+          type: boolean
+        state:
+          $ref: "#/components/schemas/project-state"
+        last_bom_import:
+          $ref: "#/components/schemas/timestamp"
+        last_bom_import_format:
+          maxLength: 255
+          type: string
+        last_inherited_risk_score:
+          type: number
+          format: double
+        tags:
+          type: array
+          description: Tag names assigned to the project. Empty when no tags are assigned.
+          items:
+            type: string
+        collection_logic:
+          type: string
+          enum:
+          - AGGREGATE_DIRECT_CHILDREN
+          - AGGREGATE_DIRECT_CHILDREN_WITH_TAG
+          - AGGREGATE_LATEST_VERSION_CHILDREN
+        collection_tag:
+          type: string
+          description: "Tag name used by collection logic, when applicable."
+        teams:
+          type: array
+          description: Team names with access to the project. Only present when `expand=teams`
+            is requested. Empty array when expanded and no teams are assigned.
+          items:
+            type: string
+        parent:
+          $ref: "#/components/schemas/component-project"
+        has_children:
+          type: boolean
+          description: "Whether the project has at least one direct child. When portfolio\
+            \ access control is disabled, this reflects all direct children in the\
+            \ database."
+        metrics:
+          $ref: "#/components/schemas/project-metrics"
     clone-project-include:
       type: string
       enum:
@@ -4100,6 +4459,40 @@ components:
           $ref: "#/components/schemas/package-metadata"
         package_artifact_metadata:
           $ref: "#/components/schemas/package-artifact-metadata"
+    get-project-dependency-graph-response-node:
+      required:
+      - direct_dependencies
+      - name
+      - type
+      - uuid
+      type: object
+      properties:
+        uuid:
+          type: string
+          format: uuid
+        type:
+          type: string
+          enum:
+          - PROJECT
+          - COMPONENT
+          - SERVICE
+        group:
+          maxLength: 255
+          type: string
+        name:
+          maxLength: 255
+          type: string
+        version:
+          maxLength: 255
+          type: string
+        direct_dependencies:
+          type: array
+          description: "UUIDs of the nodes this node directly depends on. An empty\
+            \ array does not mean the node has no dependencies, only that none are\
+            \ known."
+          items:
+            type: string
+            format: uuid
     service-account:
       required:
       - name
@@ -4610,6 +5003,96 @@ components:
       - PASSED
       - FAILED
       - SKIPPED
+    project-metrics:
+      type: object
+      properties:
+        components:
+          type: integer
+          format: int32
+        vulnerable_components:
+          type: integer
+          format: int32
+        critical:
+          type: integer
+          format: int32
+        high:
+          type: integer
+          format: int32
+        medium:
+          type: integer
+          format: int32
+        low:
+          type: integer
+          format: int32
+        unassigned:
+          type: integer
+          format: int32
+        kev:
+          type: integer
+          format: int32
+        vulnerabilities:
+          type: integer
+          format: int32
+        suppressed:
+          type: integer
+          format: int32
+        inherited_risk_score:
+          type: number
+          format: double
+        findings_total:
+          type: integer
+          format: int32
+        findings_audited:
+          type: integer
+          format: int32
+        findings_unaudited:
+          type: integer
+          format: int32
+        policy_violations_fail:
+          type: integer
+          format: int32
+        policy_violations_warn:
+          type: integer
+          format: int32
+        policy_violations_info:
+          type: integer
+          format: int32
+        policy_violations_total:
+          type: integer
+          format: int32
+        policy_violations_audited:
+          type: integer
+          format: int32
+        policy_violations_unaudited:
+          type: integer
+          format: int32
+        policy_violations_security_total:
+          type: integer
+          format: int32
+        policy_violations_security_audited:
+          type: integer
+          format: int32
+        policy_violations_security_unaudited:
+          type: integer
+          format: int32
+        policy_violations_license_total:
+          type: integer
+          format: int32
+        policy_violations_license_audited:
+          type: integer
+          format: int32
+        policy_violations_license_unaudited:
+          type: integer
+          format: int32
+        policy_violations_operational_total:
+          type: integer
+          format: int32
+        policy_violations_operational_audited:
+          type: integer
+          format: int32
+        policy_violations_operational_unaudited:
+          type: integer
+          format: int32
     total-count-type:
       type: string
       enum:
@@ -4701,6 +5184,7 @@ components:
     sort-direction:
       name: sort_direction
       in: query
+      description: Direction to sort in.
       schema:
         $ref: "#/components/schemas/sort-direction"
     sort-by: