---
title: "List the company's projects"
method: GET
path: "/projects"
tags: ["Projects"]
---

# List the company's projects

`GET /projects`

## Request

- Base URL: `https://app.fareeqy.com/api/v1`
- URL: `https://app.fareeqy.com/api/v1/projects`
- Auth: HTTP bearer

Every project in the key's company, private ones included, newest first.
The one exception is an onboarding demo project, which stays private to the
person it was created for. Excludes archived unless `include_archived`.
Requires operation `projects:read`.

## Query parameters

- `include_archived` boolean
- `limit` integer
- `offset` integer

## Response `200`

A page of projects.

- object
  - `meta` object
    - `total` integer: The full unfiltered count.
    - `limit` integer
    - `offset` integer
    - `count` integer: Records in the returned page.
  - `data` Project[]
    - `id` string: The project ref: the stable public id. A slug is still accepted anywhere this is passed back.
    - `url` string, nullable: Absolute address of the page a person opens in فريقي.
    - `name` string
    - `description` string, nullable
    - `is_public` boolean
    - `archived` boolean
    - `start_date` string, date, nullable
    - `end_date` string, date, nullable
    - `task_lists_count` integer: Number of task lists (counter cache).
    - `tasks_count` integer: Number of tasks across the project's lists.
    - `created_at` string, date-time
    - `updated_at` string, date-time

## Other responses

- `401`: Missing or invalid API key.
- `403`: Two different refusals share this status, and a client must tell them apart by `error.code`. `forbidden` means the key's scope or allowlist does not permit this operation, or Pundit denied the action. `plan_upgrade_required` means the company's plan carries no API access at all, so no key on it can ever succeed and there is nothing to retry.
- `404`: Resource not found or not accessible — also returned for EVERY endpoint when the company's `rest_api` feature flag is disabled (the surface is hidden). Lookups drill through the URL hierarchy, so another company's record is a 404 and never a leak. A path that matches no route at all answers 404 with the distinct code `unknown_endpoint` and echoes the path back, so a mistyped or half-built URL is told apart from a record that is missing or out of reach.
- `429`: Either the company's daily API allowance is spent (`rate_limit_exceeded`), or the per-key / per-IP burst throttle of 300 requests per minute fired. Both come back after a wait, so `Retry-After` is honest here. **The two bodies are not the same shape.** The daily-quota refusal uses the standard error envelope. The burst throttle is served by Rack::Attack ahead of the application, so its body is a flat `{"error": "<string>"}` with no `code`. A client that reads `error.code` has to tolerate `error` being a plain string.

---

[API](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api.md) · [All operations](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api/revisions/dc964e05e3d2?raw)