From 08af5b95bace37728f3523165649cc079a591acc Mon Sep 17 00:00:00 2001 From: Valentijn Scholten Date: Sat, 31 Oct 2026 21:44:34 +0100 Subject: [PATCH] Document accessTeams for BOM upload BOM uploads with autoCreate accept accessTeams to grant teams access to the new project (DependencyTrack/dependency-track#7842). Signed-off-by: Valentijn Scholten --- docs/concepts/access-control.md | 4 +++- docs/guides/user/uploading-boms.md | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/concepts/access-control.md b/docs/concepts/access-control.md index e3481ad0..f86ad21a 100644 --- a/docs/concepts/access-control.md +++ b/docs/concepts/access-control.md @@ -211,7 +211,9 @@ the full portfolio. When a team API key or a service account creates a project (for example, via BOM upload with `PROJECT_CREATION_UPLOAD`), Dependency-Track adds its first team in alphabetical order to the new project's ACL. A service account that belongs -to no team adds no team to the ACL. +to no team adds no team to the ACL. To grant access to other teams as well, list +them in `accessTeams` when you create the project through the REST API or a +[BOM upload](../guides/user/uploading-boms.md#upload-via-rest-api). When a user creates a project, they must designate an owning team from those they belong to. The chosen team is added to the new project's ACL. A project diff --git a/docs/guides/user/uploading-boms.md b/docs/guides/user/uploading-boms.md index f6ae6450..07a796d6 100644 --- a/docs/guides/user/uploading-boms.md +++ b/docs/guides/user/uploading-boms.md @@ -54,6 +54,9 @@ When it creates one, it also applies these optional fields: * `parentUUID`, or `parentName` and `parentVersion`, to place the project in a [hierarchy](organizing-projects.md). * `projectTags`, a comma-separated list of tags. * `isLatest=true`, to mark the version as the [latest](managing-project-versions.md#mark-a-version-as-latest). +* `accessTeams`, a JSON array of teams to grant [access to the project](../../concepts/access-control.md#portfolio-access-control), + for example `[{"name": "Team A"}]`. Identify each team by `name` or `uuid`. + You can only assign teams you're a member of, unless you hold `ACCESS_MANAGEMENT`. Send `isActive` only when you intend to change the project's active state. It applies to existing projects too.