--- title: "List a project's pass windows" method: GET path: "/v1/projects/{project}/pass-windows" tags: ["Pass Windows"] --- # List a project's pass windows `GET /v1/projects/{project}/pass-windows` ## Request - Base URL: `https://api.subscriby.net` - URL: `https://api.subscriby.net/v1/projects/{project}/pass-windows` - Auth: HTTP bearer ```bash curl "https://api.subscriby.net/v1/projects/$PROJECT_ID/pass-windows?status=scheduled&sellable_only=true" \ -H "Authorization: Bearer $SUBSCRIBY_TOKEN" ``` The project's windows across every pass plan, **soonest first**, 50 per page (`per_page` 1 to 100; `limit` is accepted as an alias). Filters are validated before they reach the query: an unknown status or a malformed date is a `422 VALIDATION_FAILED` naming the field, not an empty page. > **The list also opens to `project-subscription-plan:view-any`.** The list shipped under the plan ability before the `pass-window:*` family had any surface, and it is what the n8n node and the MCP tool docs named. A token holding only `project-subscription-plan:view-any` therefore still satisfies the `pass-window:view-any` gate. Mint new tokens with the precise ability; the alias exists so old ones keep working. ## Path parameters - `project` string, uuid, required ## Query parameters - `plan_id` string, uuid, nullable - `status` 'scheduled' | 'open' | 'closed' | 'canceled' - `from` string, date-time, nullable - `to` string, date-time, nullable - `sellable_only` boolean - `page` integer - `per_page` integer - `sort_by` string - `sort_direction` 'asc' | 'desc' - `limit` integer ## Response `200` The page, soonest first. - object - `data` PassWindowResource[], required: The items on this page. - `id` string, required: The window's id, what a pass series points at. - `plan_id` string, required: The pass plan the window belongs to. - `plan_name` string, required: That plan's name, so a list reads without a plan lookup. - `starts_at` string, required: When access opens, ISO 8601 in UTC. Store and compare this. - `ends_at` string, required: When access closes, ISO 8601 in UTC. - `timezone` string, nullable, required: The IANA zone the plan's schedule was authored in. Render window times in this, never in UTC. - `local_range` string, required: The same window as a person reads it, already in `timezone`; what the dashboard, the portal and the bot all print. - `duration_minutes` integer, required: The length in minutes, derived from the two instants. - `status` string, required: `scheduled`, `open`, `closed` or `canceled`. Set by the scheduler as the window's start and end pass; `canceled` only by an explicit cancel. - `source` string, required: `generated` from the plan's slots, or `manual` when placed by hand. Manual windows survive a schedule rebuild; generated ones are regenerated. - `sellable` boolean, required: Whether a buyer could purchase this window right now: the plan's sales cutoff, resolved for the whole page in one query rather than per row. - `holders` integer, required: How many purchases currently hold the window. - `links` object, required: Links to the first, last, previous and next pages. - `first` string, nullable, required: The first page's URL. - `last` string, nullable, required: The last page's URL. - `prev` string, nullable, required: The previous page's URL; null on the first page. - `next` string, nullable, required: The next page's URL; null on the last page. - `meta` object, required: The paging counters for this page. - `current_page` integer, required: The page returned, 1-indexed. - `from` integer, nullable, required: The 1-indexed position of this page's first item across every page; null when the page is empty. - `last_page` integer, required: How many pages there are. - `links` object[], required: Generated paginator links. - `url` string, nullable, required: The page's URL; null for the ellipsis and the disabled arrows. - `label` string, required: The link's label: a page number, the previous or next arrow, or an ellipsis. - `active` boolean, required: Whether this link is the current page. - `path` string, nullable, required: Base path for paginator generated URLs. - `per_page` integer, required: Number of items shown per page. - `to` integer, nullable, required: Number of the last item in the slice. - `total` integer, required: Total number of items being paginated. ## Other responses - `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production). - `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description. - `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred. - `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: when `status` is not one of the four states, `plan_id` is not a UUID, or `from` or `to` is not a date. - `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted. --- [API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)