diff --git a/crates/dtrack-core/src/lib.rs b/crates/dtrack-core/src/lib.rs
index 3bf7338..23855cf 100644
--- a/crates/dtrack-core/src/lib.rs
+++ b/crates/dtrack-core/src/lib.rs
@@ -42,11 +42,18 @@ impl DtrackClient {
     }
 
     async fn get(&self, path: &str) -> Result<String> {
+        self.get_query(path, &[]).await
+    }
+
+    /// Wie `get`, aber mit Query-Parametern, die reqwest sauber URL-encodet
+    /// (z.B. fuer Namen mit Leerzeichen in `lookup_project`).
+    async fn get_query(&self, path: &str, params: &[(&str, &str)]) -> Result<String> {
         let url = format!("{}{}", self.base_url, path);
         let resp = self
             .http
             .get(&url)
             .header("X-Api-Key", &self.api_key)
+            .query(params)
             .send()
             .await
             .with_context(|| format!("Request an {url} fehlgeschlagen"))?;
@@ -64,6 +71,22 @@ impl DtrackClient {
         self.get("/project?pageSize=100&excludeInactive=true").await
     }
 
+    /// GET /project/lookup -- Projekt per Name (+optional Version) finden;
+    /// liefert u.a. dessen UUID.
+    pub async fn lookup_project(&self, name: &str, version: Option<&str>) -> Result<String> {
+        let mut params: Vec<(&str, &str)> = vec![("name", name)];
+        if let Some(v) = version {
+            params.push(("version", v));
+        }
+        self.get_query("/project/lookup", &params).await
+    }
+
+    /// GET /component/project/{uuid} -- Komponenten/Abhaengigkeiten eines Projekts.
+    pub async fn project_components(&self, uuid: &str) -> Result<String> {
+        self.get(&format!("/component/project/{uuid}?pageSize=100"))
+            .await
+    }
+
     /// GET /finding/project/{uuid} -- Findings (Schwachstellen) eines Projekts.
     pub async fn project_findings(&self, uuid: &str) -> Result<String> {
         self.get(&format!("/finding/project/{uuid}")).await
@@ -73,6 +96,24 @@ impl DtrackClient {
     pub async fn project_metrics(&self, uuid: &str) -> Result<String> {
         self.get(&format!("/metrics/project/{uuid}/current")).await
     }
+
+    /// GET /violation/project/{uuid} -- Policy-Verstoesse eines Projekts.
+    /// Braucht das DT-Recht VIEW_POLICY_VIOLATION.
+    pub async fn project_violations(&self, uuid: &str) -> Result<String> {
+        self.get(&format!("/violation/project/{uuid}")).await
+    }
+
+    /// GET /vex/cyclonedx/project/{uuid} -- VEX (CycloneDX) eines Projekts:
+    /// Exploitability-/Analyse-Status der Schwachstellen.
+    pub async fn project_vex(&self, uuid: &str) -> Result<String> {
+        self.get(&format!("/vex/cyclonedx/project/{uuid}")).await
+    }
+
+    /// GET /bom/cyclonedx/project/{uuid} -- SBOM (CycloneDX, JSON) eines Projekts.
+    pub async fn project_bom(&self, uuid: &str) -> Result<String> {
+        self.get(&format!("/bom/cyclonedx/project/{uuid}?format=json"))
+            .await
+    }
 }
 
 #[cfg(test)]