---
title: "List a project's members"
method: GET
path: "/v1/projects/{project}/members"
tags: ["Members"]
---

# List a project's members

`GET /v1/projects/{project}/members`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/projects/{project}/members`
- Auth: HTTP bearer

```bash
curl "https://api.subscriby.net/v1/projects/$PROJECT_ID/members?status=customer" \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN"
```

Newest first, paged with `page` and `per_page` (default 25; `limit` is accepted as an alias). `status` narrows to one lifecycle state. `identity` looks one member up by the account they connected, `connector:external_id`, for a workflow that starts from a platform event and needs the member behind an account id; the page then holds that one member with their `identities` embedded, or no rows.

## Path parameters

- `project` string, uuid, required

## Query parameters

- `status` 'lead' | 'trialing' | 'customer' | 'churned' | 'banned'
- `identity` string, nullable
- `page` integer
- `per_page` integer
- `sort_by` string
- `sort_direction` 'asc' | 'desc'
- `limit` integer

## Response `200`

The page, newest first; one row or none when narrowed to an account, with its connected accounts embedded.

- object
  - `data` MemberResource[], required: The items on this page.
    - `id` string, required: The member's id within the project; the same person in another project is another member.
    - `project_id` string, required: The project the member belongs to.
    - `username` string, required: The member's handle on the connector they joined through, when the platform has one.
    - `first_name` string, required: The member's first name as the connector reported it.
    - `last_name` string, required: The member's last name as the connector reported it; null when the platform gave none.
    - `email` string, nullable: The address the member chose and verified themselves, their portal sign-in credential; null for most members, who join through a bot and are never asked. Present only for a token holding `project-user:view`; a roster-only token never sees the key.
    - `billing_email` string, nullable: Whatever address the member gave a payment provider at checkout, captured automatically on every new payment. Never verified and never used for authentication: treat it as identification only. Null for members who last paid before the capture existed or who joined by access code. Present only for a token holding `project-user:view`.
    - `identities` MemberIdentityResource[]: The member's connected connector accounts, embedded on the detail read and on a list narrowed with `identity`; absent elsewhere.
      - `id` string, required: The link's id, the value the disconnect endpoint takes.
      - `connector` string, required: The connector the account is on, by key.
      - `source` string, required: How the account was connected: `bot` (through the project's bot), `portal` (from the portal's Account & Recovery screen), `handshake`, `adopted` or `backfill`.
      - `preferred` boolean, required: Whether the project reaches the member through this account first.
      - `notify` boolean, required: Whether the member receives the project's messages on this account.
      - `external_id` string, required: The platform's own id for the account.
      - `display_name` string, nullable, required: What the platform calls the person.
      - `username` string, nullable, required: The account's handle when the platform has one; null otherwise.
      - `linked_at` string, required: When the account was connected, ISO 8601.
    - `source` unknown[], nullable: Where the member came from: the Smart Link credited with them, the door and the campaign tags. Null for a member who arrived with no link and no tags; see the member source object.
      - unknown
    - `status` union, required: Where the member stands: `lead` (met the bot, never paid), `trialing`, `customer`, `churned` (no active access) or `banned`.
      - string
      - 'lead' | 'trialing' | 'customer' | 'churned' | 'banned'
    - `joined_at` string, nullable, required: When the member first joined the project, ISO 8601.
    - `created_at` string, nullable, required: When the member row was created, ISO 8601.
    - `updated_at` string, nullable, required: When the member row last changed, ISO 8601.
  - `links` object, required: Links to the first, last, previous and next pages.
    - `first` string, nullable, required: The first page's URL.
    - `last` string, nullable, required: The last page's URL.
    - `prev` string, nullable, required: The previous page's URL; null on the first page.
    - `next` string, nullable, required: The next page's URL; null on the last page.
  - `meta` object, required: The paging counters for this page.
    - `current_page` integer, required: The page returned, 1-indexed.
    - `from` integer, nullable, required: The 1-indexed position of this page's first item across every page; null when the page is empty.
    - `last_page` integer, required: How many pages there are.
    - `links` object[], required: Generated paginator links.
      - `url` string, nullable, required: The page's URL; null for the ellipsis and the disabled arrows.
      - `label` string, required: The link's label: a page number, the previous or next arrow, or an ellipsis.
      - `active` boolean, required: Whether this link is the current page.
    - `path` string, nullable, required: Base path for paginator generated URLs.
    - `per_page` integer, required: Number of items shown per page.
    - `to` integer, nullable, required: Number of the last item in the slice.
    - `total` integer, required: Total number of items being paginated.

## Other responses

- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
- `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: when `status` is not one of the five states, or `identity` has no connector before the colon.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)