> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/discovering/importing-manifests.md). # Importing manifests & SBOMs One-shot uploads of dependency manifests, SBOMs, and Snyk CSV exports. The Seal Platform accepts three kinds of one-shot uploads: * [Uploading a dependency manifest](/discovering/importing-manifests/dependency-manifest.md): `package-lock.json`, `requirements.txt`, `pom.xml`, and other ecosystem-specific lockfiles. * [Uploading an SBOM](/discovering/importing-manifests/sbom.md): CycloneDX or SPDX in JSON. * [Importing from a Snyk export](/discovering/importing-manifests/snyk-export.md): a CSV exported from Snyk. All three go through the same **Import from file** flow on the Projects page. Each upload creates or contributes to one Seal Project, and the project ends up in [imported manifest discovery mode](/discovering/package-discovery-mode/imported-manifest.md). The upload is a snapshot: the platform parses the file once and does not refresh it, so the picture ages from the moment of import. ## When file imports are the right choice File imports are the answer when the higher-reliability discovery modes are not available to you. Specifically, when for security or organizational reasons you cannot: * Connect Seal to your source control, * Run the Seal CLI in your CI/CD pipeline, **and** * Configure the Seal Artifact Server as your primary remote so it sees all your build's package pulls. When at least one of those is available, prefer it. Source code, CLI, and artifact-server-as-primary-remote all give Seal a refreshing picture; imports are a frozen snapshot. ## Before you start * You have the **Admin**, **Sealer**, or **Collaborator** [role](/getting-started/users-and-sso/user-roles.md) in Seal. * You know the file type and have the file accessible. The detector inspects filename and contents, so a file named correctly for its kind is the easiest path. * Your file is **100 MB or smaller**. This is the maximum supported upload size; a larger file is rejected before the upload starts. * You have decided where the entries should land: a new Seal Project, an existing Seal Project you have already imported into, or the [Default project](/getting-started/creating-a-seal-project.md#the-default-project). ## The shared flow 1. Open the **Projects** page. 2. Click **Import projects** and select **Import from file**. 3. Drag the file onto the upload area, or click to browse. The modal validates the file and shows the detected type. 4. Choose the destination: * **Add entries to a new project** and provide a project name. The platform creates a new Seal Project with that name and assigns its [Project ID](/getting-started/creating-a-seal-project.md#project-id-and-project-name). * **Add entries to an existing project** and pick a Seal Project from the dropdown. The entries are added to that project; see [Adding entries to an existing project](#adding-entries-to-an-existing-project) for which projects the dropdown offers. * **Add entries to the default project** to land the entries in the catch-all instead. 5. Confirm the upload. A progress bar tracks the upload while it runs; large files may take a little longer to finish.
The Import from file modal with a selected file and the destination radio options

The unified Import from file modal

The Seal Platform parses the file asynchronously after the modal closes; the resulting Seal Project (or new entries in an existing project or in Default) appears on the Projects page within a minute. ## Adding entries to an existing project Pointing an upload at a Seal Project you have already imported into lets one project reflect several manifests, for example a repository whose build resolves a `package-lock.json` and a `requirements.txt`. Nothing new is created: the entries land in the project you pick, under the same Project ID. The dropdown searches by project name from the start of the name, so a term taken from the middle of a name does not match. Only the projects that can actually receive imported entries are offered: * The project is in **Imported manifest** or **Unknown** [package discovery mode](/discovering/package-discovery-mode.md). [Package discovery mode is one-way](/getting-started/creating-a-seal-project.md#package-discovery-mode): a project already on a more reliable signal source discards imported entries, so projects in source code, CLI, or artifact server mode are not offered. An **Unknown** project qualifies because the import itself puts it into imported manifest mode. * The project is not connected to source control. A source-control connection promotes the project to source-code mode, which would supersede whatever you imported. * The [Default project](/getting-started/creating-a-seal-project.md#the-default-project) is not in the dropdown. Use the **Add entries to the default project** option for that. A Seal Project you create through the **Add entries to a new project** option is available in the dropdown right away, with no page reload. ### Entries are added, not replaced A second import into the same Seal Project adds its entries alongside the ones already there. Nothing is removed. If the same package appears at two different versions across two imports, both stay listed on the Protection page. An import is never a replacement, so an existing-project import cannot be used to prune a project. To get a clean picture of a manifest, import it into a new Seal Project instead. ## What each upload produces | Upload | Result | | ------------------- | ------------------------------------------------------------------------------------- | | Dependency manifest | One Seal Project (or Default) populated with the packages declared in the manifest. | | SBOM | One Seal Project (or Default) populated with the components listed in the SBOM. | | Snyk CSV export | One Seal Project (or Default) populated with the vulnerable packages from the export. | ## Related * [Imported manifest mode](/discovering/package-discovery-mode/imported-manifest.md): the discovery mode an upload puts a Seal Project into. * [Creating a Seal Project](/getting-started/creating-a-seal-project.md): the rest of the project-creation paths.