---
title: "Lists feature flags in the resolved project, cursor-paginated."
method: GET
path: "/api/v1/orgs/{org}/projects/{project}/flags"
tags: ["Feature Flags"]
---

# Lists feature flags in the resolved project, cursor-paginated.

`GET /api/v1/orgs/{org}/projects/{project}/flags`

## Request

- Base URL: `https://api.featureflip.io`
- URL: `https://api.featureflip.io/api/v1/orgs/{org}/projects/{project}/flags`
- Auth: API key in header `Authorization`

Unlike
List, ListFeatureFlagsQuery IS
`Skip`/`Take`-based and returns a precise `Total`, so the next cursor is
computed from the query result rather than an in-memory count. `type` is parsed
leniently — an unrecognized value degrades to "no type filter" (matching
Decode's "garbage input degrades gracefully" precedent)
rather than a 400, since it's a non-critical list filter, not a mutation. `owner` filters
by owner: an email (an active member, case-insensitive) or `none` for unowned flags.
`permanent` filters to permanent (`true`) or temporary (`false`) flags.

## Path parameters

- `org` string, required
- `project` string, required

## Query parameters

- `search` string
- `tag` string
- `type` string
- `archived` boolean
- `limit` integer
- `cursor` string
- `owner` string
- `permanent` boolean

## Response `200`

OK

- PublicFlagListItemPagedResult: A page of results plus an opaque cursor for the next page, or null when this is the last page. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and `next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).
  - `items` PublicFlagListItem[], nullable, required
    - `id` string, uuid, required
    - `key` string, nullable, required
    - `name` string, nullable, required
    - `type` 'Boolean' | 'String' | 'Number' | 'Json', nullable, required: Allowed values: Boolean, String, Number, Json.
    - `isArchived` boolean, required
    - `clientSideVisible` boolean, required
    - `tags` string[], nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `expiresAtUtc` string, date-time, nullable
    - `owner` PublicFlagOwner: A flag's owner as returned on flag reads. Null means the flag is unowned.
      - `id` string, uuid, required
      - `email` string, nullable, required
      - `name` string, nullable, required
    - `removalPrUrl` string, nullable
    - `isPermanent` boolean, required
    - `effectiveExpiresAtUtc` string, date-time, nullable
    - `expirySource` string, nullable
  - `next_cursor` string, nullable
  - `_actions` object: Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.

## Other responses

- `401`: Authentication is required, or the supplied API token is invalid or expired.
- `404`: Not Found
- `429`: Rate limit exceeded. Retry after the interval indicated by the Retry-After header.

---

[API](https://skmtc.dev/featureflip/apis/management-api.md) · [All operations](https://skmtc.dev/featureflip/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/featureflip/apis/management-api/revisions/8a77e8581a45?raw)