---
title: "List projects"
method: GET
path: "/projects"
tags: ["project"]
---

# List projects

`GET /projects`

This endpoint returns projects created by Harbor.

## Query parameters

- `q` string
- `page` integer
- `page_size` integer
- `sort` string
- `name` string
- `public` boolean
- `owner` string
- `with_detail` boolean

## Headers

- `X-Request-Id` string

## Response `200`

Return all matched projects.

- Project[]
  - `project_id` integer — Project ID
  - `owner_id` integer — The owner ID of the project always means the creator of the project.
  - `name` string — The name of the project.
  - `registry_id` integer — The ID of referenced registry when the project is a proxy cache project.
  - `creation_time` string, date-time — The creation time of the project.
  - `update_time` string, date-time — The update time of the project.
  - `deleted` boolean — A deletion mark of the project.
  - `owner_name` string — The owner name of the project.
  - `togglable` boolean — Correspond to the UI about whether the project's publicity is updatable (for UI)
  - `current_user_role_id` integer — The role ID with highest permission of the current user who triggered the API (for UI). This attribute is deprecated and will be removed in future versions.
  - `current_user_role_ids` integer[] — The list of role ID of the current user who triggered the API (for UI)
  - `repo_count` integer — The number of the repositories under this project.
  - `metadata` ProjectMetadata
    - `public` string — The public status of the project. The valid values are "true", "false".
    - `enable_content_trust` string, nullable — Whether content trust is enabled or not. If it is enabled, user can't pull unsigned images from this project. The valid values are "true", "false".
    - `enable_content_trust_cosign` string, nullable — Whether cosign content trust is enabled or not. If it is enabled, user can't pull images without cosign signature from this project. The valid values are "true", "false".
    - `prevent_vul` string, nullable — Whether prevent the vulnerable images from running. The valid values are "true", "false".
    - `severity` string, nullable — If the vulnerability is high than severity defined here, the images can't be pulled. The valid values are "none", "low", "medium", "high", "critical".
    - `auto_scan` string, nullable — Whether scan images automatically when pushing. The valid values are "true", "false".
    - `auto_sbom_generation` string, nullable — Whether generating SBOM automatically when pushing a subject artifact. The valid values are "true", "false".
    - `reuse_sys_cve_allowlist` string, nullable — Whether this project reuse the system level CVE allowlist as the allowlist of its own. The valid values are "true", "false". If it is set to "true" the actual allowlist associate with this project, if any, will be ignored.
    - `retention_id` string, nullable — The ID of the tag retention policy for the project
    - `proxy_speed_kb` string, nullable — The bandwidth limit of proxy cache, in Kbps (kilobits per second). It limits the communication between Harbor and the upstream registry, not the client and the Harbor.
    - `max_upstream_conn` string, nullable — The max connection per artifact to the upstream registry in current proxy cache project, if it is -1, no limit to upstream registry connections
    - `proxy_cache_local_on_not_found` string, nullable — Whether to serve images from local cache when they are removed from the upstream registry. The valid values are "true", "false".
  - `cve_allowlist` CVEAllowlist — The CVE Allowlist for system or project
    - `id` integer — ID of the allowlist
    - `project_id` integer — ID of the project which the allowlist belongs to. For system level allowlist this attribute is zero.
    - `expires_at` integer, nullable — the time for expiration of the allowlist, in the form of seconds since epoch. This is an optional attribute, if it's not set the CVE allowlist does not expire.
    - `items` CVEAllowlistItem[]
      - `cve_id` string — The ID of the CVE, such as "CVE-2019-10164"
    - `creation_time` string, date-time — The creation time of the allowlist.
    - `update_time` string, date-time — The update time of the allowlist.

## Other responses

- `401` — Unauthorized
- `500` — Internal server error

---

[API](https://skmtc.dev/cerit/apis/harbor-api.md) · [All operations](https://skmtc.dev/cerit/apis/harbor-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cerit/harbor-api/revisions/62d78801f8df/schema)