As promised, a little more context is in this thread:
including guidance from folks at Sonar that this is the only API available today that fulfils this requirement, and hence the correct one to use.
The problem appears to be exactly this, acknowledged as a bug over three years ago!
Any updates on addressing this? I’m going to try the workaround suggested there, but whether it works for us will depend on if the error response for a project that’s already bound returns the project key.