---
title: "List projects"
method: GET
path: "/projects/v1"
tags: ["Projects"]
---

# List projects

`GET /projects/v1`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - API key in header `x-admin-key`

List the caller's owned projects from the server inventory — each with name, site_url, custom domains, the owning org (org_id), and status. A non-admin caller sees every project owned by an org on which their principal holds an active membership; admin credentials see all. Soft-deleted (tombstone) projects are NEVER listed; archived projects are hidden by default and opt back in with `include=archived`. Supports cursor-based pagination. Filter to one org with `org_id` (authorize-before-reveal: a non-member or guessed id gets the same 403 as a real-but-unauthorized org). Auth: SIWX wallet (SIGN-IN-WITH-X header), a control-plane session bearer (the console's signed-in human — membership-scoped exactly like a SIWX-resolved principal), or admin credentials. Unauthenticated calls return 402 with `auth: "SIWX"`. For tier pricing, use GET /tiers/v1.

## Query parameters

- `limit` integer
- `after` string
- `org_id` string, uuid
- `include` 'archived'

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

Project list

- object
  - `projects` object[]
    - `name` string, required
    - `tier` 'prototype' | 'hobby' | 'team', required
    - `status` string, required
    - `org_id` string, uuid, nullable, required: The owning org (organization). A wallet never owns a project; authority is org membership or a project grant.
    - `created_by` string, uuid, nullable: v1.77: the control-plane principal that provisioned the project (provenance, not authorization).
    - `creator` OperationActorSnapshot
      - `schema_version` 1, required
      - `principal` PrincipalSnapshot, required
        - `principal_id` string, required
        - `principal_type` string, required
        - `display_name_at_capture` string, nullable, required
        - `linked_identities_at_capture` LinkedIdentitySnapshot[], required
          - `identity_link_id` string, required
          - `kind` string, required
          - `public_subject` string, required
          - `display_subject` string, required
          - `verified_at` string, date-time, required
          - `status_at_capture` 'active', required
      - `authenticator` AuthenticatorSnapshot, required
        - `authenticator_id` string, required
        - `kind` string, required
        - `public_subject` string, required
      - `authority` AuthoritySnapshot, required: Discriminated immutable action-time authority: organization_membership, project_grant, grant_key, ci, system, legacy, or a preserved future kind. A link is never an authority kind.
        - `kind` string, required
        - `org_id` string, nullable
        - `project_id` string, nullable
        - `membership_id` string, nullable
        - `grant_id` string, nullable
        - `grant_key_id` string, nullable
        - `credential_id` string, nullable
        - `role` string, nullable
        - `scope` string[]
        - `reason_code` string, nullable
      - `captured_at` string, date-time, required
    - `created_at` string, date-time, required
    - `site_url` string, nullable: Primary public URL: the first claimed run402.com subdomain, else the first custom domain, else null.
    - `custom_domains` string[]: Every custom hostname mapped to this project (empty when none). The run402.com subdomain is not a custom domain.
    - `pinned` boolean, required
    - `project_id` string, required: Run402 project ID. Public IDs are not UUIDs.
  - `has_more` boolean
  - `next_cursor` string, nullable

## Other responses

- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)