---
title: "Map an SD Elements project to a repository"
method: POST
path: "/api/v2/securityCompass/addProjectMapping"
tags: ["Security Compass"]
---

# Map an SD Elements project to a repository

`POST /api/v2/securityCompass/addProjectMapping`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/securityCompass/addProjectMapping`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Link one SD Elements project to one ZeroPath repository and automatically enqueue the first rule sync. If the integration is enabled and the repository already has a finished full scan, a findings push of that scan is enqueued too (it runs once the rule sync succeeds), so the mapping does not wait for the next scan. Multiple repositories can map to the same project and vice versa; adding a duplicate (project, repository) pair fails with 409. Requires the integration to exist (404 otherwise). Optionally set a per-project task status mapping; omitted means inherit the integration's default.

## Request body

- SecurityCompassAddProjectMappingRequest
  - `organizationId` string, required: Organization that owns the integration.
  - `sdeProjectId` string, required: SD Elements project id to link.
  - `repositoryId` string, required: cuid of the ZeroPath repository to link. Obtainable via repositories.list.
  - `taskStatusMapping` SecurityCompassTaskStatusMapping: Which SD Elements task status each ZeroPath verification outcome sets, keyed by outcome. Values are task-status slugs (e.g. DONE, TODO, or a custom status such as ZeroPath-Verified) from securityCompass.listTaskStatuses; a slug whose meaning is NA is never accepted. A missing key leaves the task status unchanged, so {} means "verification note only". Countermeasures a human marked Not Applicable are never changed regardless of this mapping.
    - `pass` string: Status slug to set when ZeroPath finds no violation of the countermeasure.
    - `partial` string: Status slug to set when ZeroPath could not fully verify the countermeasure (some candidate findings failed analysis, or only secondary matches exist).
    - `fail` string: Status slug to set when ZeroPath found at least one violation.

## Response `200`

The created mapping with its (running) rule-sync state

- SecurityCompassAddProjectMappingResponse: The created mapping. A rule sync is enqueued automatically, so `ruleSync.state` is `running` on return.
  - `id` string, required
  - `sdeProjectId` string, required
  - `repositoryId` string, required
  - `repository` object, required
    - `name` string, required
  - `supportedTaskIds` string[], required
  - `ruleSync` union, required: Sync lifecycle for one project mapping, as a discriminated union on `state` (and `status` within `completed`). Poll securityCompass.getIntegration until `state` leaves `running`, then read the audit.
    - object
      - `state` 'never_run', required
    - object
      - `state` 'running', required
      - `startedAt` string, date-time, required
    - object
      - `state` 'completed', required
      - `status` 'success', required
      - `startedAt` string, date-time, required
      - `completedAt` string, date-time, required
    - object
      - `state` 'completed', required
      - `status` 'failed', required
      - `startedAt` string, date-time, required
      - `completedAt` string, date-time, required
      - `error` string, required
  - `taskStatusMapping` SecurityCompassTaskStatusMapping, required: Which SD Elements task status each ZeroPath verification outcome sets, keyed by outcome. Values are task-status slugs (e.g. DONE, TODO, or a custom status such as ZeroPath-Verified) from securityCompass.listTaskStatuses; a slug whose meaning is NA is never accepted. A missing key leaves the task status unchanged, so {} means "verification note only". Countermeasures a human marked Not Applicable are never changed regardless of this mapping.
    - `pass` string: Status slug to set when ZeroPath finds no violation of the countermeasure.
    - `partial` string: Status slug to set when ZeroPath could not fully verify the countermeasure (some candidate findings failed analysis, or only secondary matches exist).
    - `fail` string: Status slug to set when ZeroPath found at least one violation.
  - `effectiveTaskStatusMapping` SecurityCompassTaskStatusMapping, required: Which SD Elements task status each ZeroPath verification outcome sets, keyed by outcome. Values are task-status slugs (e.g. DONE, TODO, or a custom status such as ZeroPath-Verified) from securityCompass.listTaskStatuses; a slug whose meaning is NA is never accepted. A missing key leaves the task status unchanged, so {} means "verification note only". Countermeasures a human marked Not Applicable are never changed regardless of this mapping.
    - `pass` string: Status slug to set when ZeroPath finds no violation of the countermeasure.
    - `partial` string: Status slug to set when ZeroPath could not fully verify the countermeasure (some candidate findings failed analysis, or only secondary matches exist).
    - `fail` string: Status slug to set when ZeroPath found at least one violation.
  - `lastPushAt` string, date-time, nullable
  - `lastPushStatus` string, nullable
  - `createdAt` string, date-time, required

## Other responses

- `400`: Error Response
- `401`: Error Response
- `404`: Error Response
- `409`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)