Destructive. Overwrites live content of this project in place, through the same import core the dashboard uses (format-version check, preflight of every page before the first write, theme then pages, cache reset). Writes go live immediately, bypassing drafts, and override mode replaces existing pages. Back up first with POST /projects/{projectId}/backups.

Send multipart/form-data with:

• file: an export JSON from GET /projects/{projectId}/export (max 50 MB).
• options: a JSON string { "importTheme": boolean, "importPages": boolean, "pagesImportMode": "override" | "skip", "selectedPageIds"?: string[] }. override replaces pages whose assignment already exists; skip keeps them.
• confirm: must equal the projectId in the path.

Limits and errors:

• The whole multipart body is byte-capped while streaming (file cap plus 64 KiB of framing); a second file part is rejected.
• 400 for an invalid file, options or confirmation; the import core's reason is in details.importCode (for example INVALID_FILE, FILE_TOO_LARGE, PARSE_ERROR for options that are not JSON, INVALID_OPTIONS for options that fail validation).
• A 200 can still report per-part failures: check results.theme.success, results.pages.errors and results.pages.skippedInfo.

Every key issued since scopes exist (including a baseline-only key) must use this route. The legacy /api/projects/import admits only pre-scope keys and authenticated merchant sessions, never narrow agent or MCP bearers.

Required scopes: project:manage, content:publish and content:delete (all three)