--- title: "Retrieve a list of projects" method: GET path: "/v10/projects" tags: ["projects"] --- # Retrieve a list of projects `GET /v10/projects` ## Request - Base URL: `https://api.vercel.com` - URL: `https://api.vercel.com/v10/projects` - Auth: HTTP bearer Allows to retrieve the list of projects of the authenticated user or team. The list will be paginated and the provided query parameters allow filtering the returned projects. ## Query parameters - `from` string: Query only projects updated after the given timestamp or continuation token. - `since` number: Query only projects updated after this JavaScript timestamp. - `until` number: Query only projects updated before this JavaScript timestamp. - `gitForkProtection` '1' | '0': Specifies whether PRs from Git forks should require a team member's authorization before it can be deployed - `limit` string: Limit the number of projects returned - `search` string: Search projects by the name field - `repo` string: Filter results by repo. Also used for project count - `repoId` string: Filter results by Repository ID. - `repoUrl` string: Filter results by Repository URL. - `excludeRepos` string: Filter results by excluding those projects that belong to a repo - `edgeConfigId` string: Filter results by connected Global Config ID - `edgeConfigTokenId` string: Filter results by connected Global Config Token ID - `deprecated` boolean - `elasticConcurrencyEnabled` '1' | '0': Filter results by projects with elastic concurrency enabled - `staticIpsEnabled` '0' | '1': Filter results by projects with Static IPs enabled - `buildMachineTypes` string: Filter results by effective build machine types. Accepts comma-separated values. Use \"elastic\" for projects with elastic selection and \"default\" for projects without a build machine type set. - `buildQueueConfiguration` 'SKIP_NAMESPACE_QUEUE' | 'WAIT_FOR_NAMESPACE_QUEUE': Filter results by build queue configuration. SKIP_NAMESPACE_QUEUE includes projects without a configuration set. - `teamId` string - `slug` string ## Response `200` - union - object[] - `accountId` string, required - `alias` object[], required - `configuredBy` 'A' | 'CNAME' | 'dns-01' | 'http' | 'null', nullable - `configuredChangedAt` number, nullable - `createdAt` number, nullable - `deployment` object, nullable, required - `alias` string[] - `aliasAssigned` union - number - false | true - `aliasError` object, nullable - `code` string, required - `message` string, required - `aliasFinal` string, nullable - `automaticAliases` string[] - `branchMatcher` object - `pattern` string, required: The pattern to match against branch names - `type` 'endsWith' | 'equals' | 'startsWith', required: The type of matching to perform - `buildingAt` number - `builds` object[] - `dest` string - `src` string - `use` string, required - `checksConclusion` 'canceled' | 'failed' | 'skipped' | 'succeeded' - `checksState` 'completed' | 'registered' | 'running' - `connectBuildsEnabled` false | true - `connectConfigurationId` string - `createdAt` number, required - `createdIn` string, required - `creator` object, nullable, required - `email` string, required - `githubLogin` string - `gitlabLogin` string - `uid` string, required - `username` string, required - `deletedAt` number - `deploymentHostname` string, required - `forced` false | true - `id` string, required - `meta` object - `monorepoManager` string, nullable - `name` string, required - `oidcTokenClaims` object - `aud` string, required - `custom_environment_id` string - `deployment_id` string - `environment` string, required - `iss` string, required - `mfe_group_ids` string[] - `owner` string, required - `owner_id` string, required - `plan` string - `project` string, required - `project_id` string, required - `scope` string, required - `sub` string, required - `plan` 'enterprise' | 'hobby' | 'pro', required - `previewCommentsEnabled` false | true: Whether or not preview comments are enabled for the deployment - `private` false | true, required - `readyAt` number - `readyState` 'BLOCKED' | 'BUILDING' | 'CANCELED' | 'ERROR' | 'INITIALIZING' | 'QUEUED' | 'READY', required - `readySubstate` 'PROMOTED' | 'ROLLING' | 'STAGED' - `requestedAt` number - `target` string, nullable - `teamId` string, nullable - `type` 'LAMBDAS', required - `url` string, required - `userId` string: Present for user creators; omitted for app/integration/system creators. - `withCache` false | true - `domain` string, required - `environment` 'preview' | 'production', required - `gitBranch` string, nullable - `redirect` string, nullable - `redirectStatusCode` 301 | 302 | 307 | 308 | null, nullable - `target` 'PREVIEW' | 'PRODUCTION' | 'STAGING', required - `analytics` object - `canceledAt` number, nullable - `disabledAt` number, required - `enabledAt` number, required - `id` string, required - `paidAt` number - `sampleRatePercent` number, nullable - `spendLimitInDollars` number, nullable - `appliedCve55182Migration` false | true - `autoAssignCustomDomains` false | true - `autoAssignCustomDomainsUpdatedBy` string - `autoExposeSystemEnvs` false | true - `buildCommand` string, nullable - `commandForIgnoringBuildStep` string, nullable - `createdAt` number - `creator` union - object - `type` 'user', required - `via` union, required - object: Set when a Vercel App or Integration acts on behalf of a {@link User}. Captures user-consented OAuth delegation that the ACL layer may inspect to evaluate scope restrictions. This is NOT for impersonation or token-exchange provenance — those live on `auth.token`, not on the principal. - `app` object, required - … - `type` 'app', required - object: Set when a Vercel App or Integration acts on behalf of a {@link User}. Captures user-consented OAuth delegation that the ACL layer may inspect to evaluate scope restrictions. This is NOT for impersonation or token-exchange provenance — those live on `auth.token`, not on the principal. - `integration` object, required - … - `type` 'integration', required - `user` object, required - `id` string, required - object - `project` object, required - `id` string, required - `type` 'project', required - object - `app` object, required - `clientId` string: The protocol-facing OAuth client ID. This may differ from {@link id} when Client ID Metadata Documents (CIMD) are used. - `id` string, required: The internal ID of the Vercel App backing this principal. - `type` 'app', required - object - `integration` object, required - `configurationId` string, required - `integrationId` string, required - `type` 'integration', required - object - `type` 'system', required - `customerSupportCodeVisibility` false | true - `deploymentExpiration` object, required: Retention policies for deployments. These are enforced at the project level, but we also maintain an instance of this at the team level as a default policy that gets applied to new projects. - `deploymentsToKeep` number: Minimum number of production deployments to keep for this project, even if they are over the production expiration limit. - `expirationDays` number: Number of days to keep non-production deployments (mostly preview deployments) before soft deletion. - `expirationDaysCanceled` number: Number of days to keep canceled deployments before soft deletion. - `expirationDaysErrored` number: Number of days to keep errored deployments before soft deletion. - `expirationDaysProduction` number: Number of days to keep production deployments before soft deletion. - `devCommand` string, nullable - `directoryListing` false | true, required - `env` object[] - `comment` string - `configurationId` string, nullable - `contentHint` union - object - `storeId` string, required - `type` 'redis-url', required - object - `storeId` string, required - `type` 'redis-rest-api-url', required - object - `storeId` string, required - `type` 'redis-rest-api-token', required - object - `storeId` string, required - `type` 'redis-rest-api-read-only-token', required - object - `storeId` string, required - `type` 'blob-read-write-token', required - object - `storeId` string, required - `type` 'blob-store-id', required - object - `storeId` string, required - `type` 'blob-webhook-public-key', required - object - `storeId` string, required - `type` 'postgres-url', required - object - `storeId` string, required - `type` 'postgres-url-non-pooling', required - object - `storeId` string, required - `type` 'postgres-prisma-url', required - object - `storeId` string, required - `type` 'postgres-user', required - object - `storeId` string, required - `type` 'postgres-host', required - object - `storeId` string, required - `type` 'postgres-password', required - object - `storeId` string, required - `type` 'postgres-database', required - object - `storeId` string, required - `type` 'postgres-url-no-ssl', required - object - `integrationConfigurationId` string, required - `integrationId` string, required - `integrationProductId` string, required - `storeId` string, required - `type` 'integration-store-secret', required - object - `projectId` string, required - `type` 'flags-connection-string', required - `createdAt` number - `createdBy` string, nullable - `customEnvironmentIds` string[] - `decrypted` false | true - `edgeConfigId` string, nullable - `edgeConfigTokenId` string, nullable - `gitBranch` string - `id` string - `internalContentHint` object, nullable: Similar to `contentHints`, but should not be exposed to the user. - `encryptedValue` string, required: Contains the `value` of the env variable, encrypted with a special key to make decryption possible in the subscriber Lambda. - `type` 'flags-secret', required - `key` string, required - `legacyValue` string: Legacy now-encryption ciphertext, present after migration swaps value/vsmValue - `sunsetSecretId` string: This is used to identify variables that have been migrated from type secret to sensitive. - `target` union - string[] - 'development' | 'development' | 'preview' | 'preview' | 'production' - `type` 'encrypted' | 'plain' | 'secret' | 'sensitive' | 'system', required - `updatedAt` number - `updatedBy` string, nullable - `value` string, required - `visibility` 'config' | 'secret': User-facing config/secret model. When set, authoritative for new code paths. Legacy rows omit this field and callers fall back to existing `type` behavior. - `vsmValue` string - `framework` 'actix-web' | 'angular' | 'ash' | 'astro' | 'axum' | 'blitzjs' | 'brunch' | 'bun' | 'container' | 'create-react-app' | 'django' | 'docusaurus' | 'docusaurus-2' | 'dojo' | 'eleventy' | 'elysia' | 'ember' | 'eve' | 'express' | 'factory-eve' | 'fastapi' | 'fasthtml' | 'fastify' | 'flask' | 'gatsby' | 'go' | 'gridsome' | 'h3' | 'hexo' | 'hono' | 'hugo' | 'hydrogen' | 'ionic-angular' | 'ionic-react' | 'jekyll' | 'koa' | 'mastra' | 'middleman' | 'nestjs' | 'nextjs' | 'nitro' | 'node' | 'nuxtjs' | 'parcel' | 'polymer' | 'preact' | 'python' | 'react-router' | 'redwoodjs' | 'remix' | 'ruby' | 'rust' | 'saber' | 'sanity' | 'sanity-v2' | 'sapper' | 'scully' | 'services' | 'solidstart' | 'solidstart-1' | 'stencil' | 'storybook' | 'svelte' | 'sveltekit' | 'sveltekit-1' | 'tanstack-start' | 'tanstack-start-lovable' | 'umijs' | 'vite' | 'vitepress' | 'vue' | 'vuepress' | 'xmcp' | 'zola' | 'null', nullable - `gitComments` object - `onCommit` false | true, required: Whether the Vercel bot should comment on commits - `onPullRequest` false | true, required: Whether the Vercel bot should comment on PRs - `gitForkProtection` false | true - `gitProviderOptions` object - `consolidatedGitCommitStatus` object: Configuration for consolidated git commit status reporting. When enabled, Vercel will post a single consolidated commit status instead of individual statuses for each deployment. - `enabled` false | true, required: Whether consolidated commit status is enabled. - `propagateFailures` false | true, required: Whether to propagate individual deployment failures to the consolidated status. - `createDeployments` 'disabled' | 'enabled', required: Whether the Vercel bot should automatically create GitHub deployments https://docs.github.com/en/rest/deployments/deployments#about-deployments NOTE: repository-dispatch events should be used instead - `disableRepositoryDispatchEvents` false | true: Whether the Vercel bot should not automatically create GitHub repository-dispatch events on deployment events. https://vercel.com/docs/git/vercel-for-github#repository-dispatch-events - `true`: disable repository-dispatch events for this project (explicit override of the team setting). - `false`: enable repository-dispatch events for this project (explicit override of the team setting). - absent: inherit from `team.disableRepositoryDispatchEvents`. - `gitCommitStatus` false | true: Whether Vercel should post commit statuses for this project. When omitted, commit statuses remain enabled. - `requireVerifiedCommits` false | true: Whether the project requires commits to be signed & verified before deployments will be created. - `true`: require verified commits for this project (explicit override of the team setting). - `false`: do not require verified commits (explicit override of the team setting). - absent: inherit from `team.requireVerifiedCommits`. - `hasActiveBranches` false | true - `id` string, required - `installCommand` string, nullable - `internalRoutes` union[] - union - object - `expiry` number - `src` string, required - `status` number, required - object - `has` union[], required - union - … - `mitigate` object, required - `action` 'block_legal_cwc', required - `src` string - `ipBuckets` object[] - `bucket` string, required - `default` false | true - `supportUntil` number - `latestDeployments` object[] - `alias` string[] - `aliasAssigned` union - number - false | true - `aliasError` object, nullable - `code` string, required - `message` string, required - `aliasFinal` string, nullable - `automaticAliases` string[] - `branchMatcher` object - `pattern` string, required: The pattern to match against branch names - `type` 'endsWith' | 'equals' | 'startsWith', required: The type of matching to perform - `buildingAt` number - `builds` object[] - `dest` string - `src` string - `use` string, required - `checksConclusion` 'canceled' | 'failed' | 'skipped' | 'succeeded' - `checksState` 'completed' | 'registered' | 'running' - `connectBuildsEnabled` false | true - `connectConfigurationId` string - `createdAt` number, required - `createdIn` string, required - `creator` object, nullable, required - `email` string, required - `githubLogin` string - `gitlabLogin` string - `uid` string, required - `username` string, required - `deletedAt` number - `deploymentHostname` string, required - `forced` false | true - `id` string, required - `meta` object - `monorepoManager` string, nullable - `name` string, required - `oidcTokenClaims` object - `aud` string, required - `custom_environment_id` string - `deployment_id` string - `environment` string, required - `iss` string, required - `mfe_group_ids` string[] - `owner` string, required - `owner_id` string, required - `plan` string - `project` string, required - `project_id` string, required - `scope` string, required - `sub` string, required - `plan` 'enterprise' | 'hobby' | 'pro', required - `previewCommentsEnabled` false | true: Whether or not preview comments are enabled for the deployment - `private` false | true, required - `readyAt` number - `readyState` 'BLOCKED' | 'BUILDING' | 'CANCELED' | 'ERROR' | 'INITIALIZING' | 'QUEUED' | 'READY', required - `readySubstate` 'PROMOTED' | 'ROLLING' | 'STAGED' - `requestedAt` number - `target` string, nullable - `teamId` string, nullable - `type` 'LAMBDAS', required - `url` string, required - `userId` string: Present for user creators; omitted for app/integration/system creators. - `withCache` false | true - `link` union - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github-limited', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `host` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github-custom-host', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `productionBranch` string, required - `projectId` string, required - `projectName` string, required - `projectNamespace` string, required - `projectNameWithNamespace` string, required - `projectOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. This is the id of the top level group that a namespace belongs to. Gitlab supports group nesting (up to 20 levels). - `projectUrl` string, required - `sourceless` false | true - `type` 'gitlab', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `name` string, required - `owner` string, required - `productionBranch` string, required - `slug` string, required - `sourceless` false | true - `type` 'bitbucket', required - `updatedAt` number - `uuid` string, required - `workspaceUuid` string, required - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string, required - `repoId` string, required - `sourceless` false | true - `type` 'vercel', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string, required - `repoId` string, required - `sourceless` false | true - `type` 'v0', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `owner` string, required: Owner (namespace) slug, e.g. `acme`. - `ownerId` string, required: Origin namespace id (`ns_…`) of the owner. - `productionBranch` string, required - `repo` string, required - `repoId` string, required: Origin repository id. - `sourceless` false | true - `type` 'cursor-origin', required - `updatedAt` number - `live` false | true - `name` string, required - `nodeVersion` '10.x' | '12.x' | '14.x' | '16.x' | '18.x' | '20.x' | '22.x' | '24.x' | '26.x' | '8.10.x', required - `oidcTokenConfig` object - `enabled` false | true: Whether or not to generate OpenID Connect JSON Web Tokens. - `issuerMode` 'global' | 'team': - team: `https://oidc.vercel.com/[team_slug]` - global: `https://oidc.vercel.com` - `outputDirectory` string, nullable - `passport` object, nullable - `connectorId` string, required - `deploymentType` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews', required - `passwordProtection` object, nullable - `paused` false | true - `resourceConfig` object, required - `buildMachineElasticLastUpdated` number - `buildMachineElasticReason` 'basic-floor' | 'build-timeout-failure' | 'enospc-failure' | 'enterprise-floor' | 'high-peak-disk' | 'high-peak-memory' | 'long-build-duration' | 'oom-failure' | 'short-build-duration' | 'sustained-high-cpu' - `buildMachineElasticTransition` object - `algorithmVersion` string, required - `at` number, required - `direction` 'downgrade' | 'upgrade', required - `buildMachineSelection` 'elastic' | 'fixed' - `buildMachineType` '14cpu-28gb' | 'basic' | 'enhanced' | 'standard' | 'turbo' - `buildQueue` object - `configuration` 'SKIP_NAMESPACE_QUEUE' | 'WAIT_FOR_NAMESPACE_QUEUE' - `elasticConcurrencyEnabled` false | true - `enableFunctionsBeta` false | true - `fluid` false | true - `functionDefaultMemoryType` 'performance' | 'performance_xl' | 'standard' | 'standard_legacy' - `functionDefaultRegions` string[], required - `functionDefaultTimeout` number - `functionZeroConfigFailover` false | true - `isNSNBDisabled` false | true - `elasticBuildMachine` union - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 4, required - `label` 'standard', required - `memory` 8192, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 8, required - `label` 'enhanced', required - `memory` 16384, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 14, required - `label` '14cpu-28gb', required - `memory` 28672, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 30, required - `label` 'turbo', required - `memory` 61440, required - `rollingRelease` object, nullable: Project-level rolling release configuration that defines how deployments should be gradually rolled out - `canaryResponseHeader` false | true: Whether the request served by a canary deployment should return a header indicating a canary was served. Defaults to `false` when omitted. - `gate` object: Automated gating configuration. Omitted (the default) means no gating is configured, which is equivalent to `enabled: false`. - `action` 'pause' | 'rollback', required: What to do when the gate trips: pause the rollout, or roll it back. - `checks` object[], required: The checks to evaluate. An empty array means nothing is evaluated. - `excludePaths` string[]: Request paths to ignore entirely — dropped from both the numerator (errors) and the denominator (total requests). Matched exactly against the request path with any query string removed; no prefix or glob matching. Defaults to `[]` when omitted. - `excludeStatusCodes` number[]: Response status codes to ignore entirely — dropped from both the numerator (errors) and the denominator (total requests). Defaults to `[]` when omitted. - `ingestWatermarkSeconds` number: Seconds of ingest lag to allow for: the query's upper bound is `now() - this value`, so the check never reads a window that is still filling. Defaults to `30` when omitted. - `significanceLevel` number: A run fails only when the canary's error rate is higher and its one-sided Fisher p-value is below this significance level. Defaults to `0.05`; lower values require stronger evidence. - `type` 'error-rate-5xx', required: The metric this check evaluates. - `dryRun` false | true, required: When true, a tripped gate is only reported — {@link action} is not taken. - `enabled` false | true, required: Whether automated gating is enabled for this project's rollouts. - `failureThreshold` number: How many failing evaluations within {@link windowSize} trip the gate. Defaults to `3` when omitted. - `windowSize` number: How many of the most recent evaluations {@link failureThreshold} is counted against. Defaults to `5` when omitted. - `stages` object[], nullable: An array of all the stages required during a deployment release. Each stage defines a target percentage and advancement rules. The final stage must always have targetPercentage: 100. - `duration` number: Duration in minutes for automatic advancement to the next stage - `linearShift` false | true: Whether to linearly shift traffic over the duration of this stage - `requireApproval` false | true: Whether or not this stage requires manual approval to proceed - `targetPercentage` number, required: The percentage of traffic to serve to the canary deployment (0-100) - `target` string, required: The environment that the release targets, currently only supports production. Adding in case we want to configure with alias groups or custom environments. - `rootDirectory` string, nullable - `security` object - `attackModeActiveUntil` number, nullable - `attackModeEnabled` false | true - `attackModeUpdatedAt` number - `botIdEnabled` false | true - `firewallBypassIps` string[] - `firewallConfigVersion` number - `firewallEnabled` false | true - `firewallRoutes` object[] - `dest` string - `handle` 'finalize' | 'init' - `has` object[] - `key` string - `type` 'cookie' | 'domain_environment' | 'environment' | 'header' | 'headers' | 'host' | 'initial_request_path' | 'ip_address' | 'method' | 'path' | 'protocol' | 'query' | 'region' | 'scheme' | 'trusted_source', required - `value` union - string - object - … - `missing` object[] - `key` string - `type` 'cookie' | 'domain_environment' | 'environment' | 'header' | 'headers' | 'host' | 'initial_request_path' | 'ip_address' | 'method' | 'path' | 'protocol' | 'query' | 'region' | 'scheme' | 'trusted_source', required - `value` union - string - object - … - `mitigate` object - `action` 'bypass' | 'challenge' | 'deny' | 'log' | 'rate_limit' | 'redirect', required - `erl` object - `algo` 'fixed_window' | 'token_bucket', required - `keys` string[], required - `limit` number, required - `window` number, required - `log_headers` union - string[] - '*' - `rule_id` string, required - `ttl` number - `response_has` object[] - `key` string - `type` 'response_status', required - `value` union - string - object - … - `src` union - string - object - `eq` string - `gt` number - `gte` number - `inc` string[] - `list` string - `lt` number - `lte` number - `neq` string - `ninc` string[] - `pre` string - `re` string - `suf` string - `status` number - `tierRequirement` 'priority' - `transforms` object[] - `args` string, required - `op` 'append', required - `target` object, required - `key` string, required - `type` 'request.headers', required - `firewallSeawallEnabled` false | true - `firewallUpdatedAt` number - `ja3Enabled` false | true - `ja4Enabled` false | true - `log_headers` union - string[] - '*' - `managedRules` object, nullable - `ai_bots` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `bot_filter` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `owasp` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `traffic_sources` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `vercel_ruleset` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `pageIntegrityEnabled` false | true: Whether Page Integrity is enabled for this project. Used by the metadata service to gate DynamoDB lookups against the page-integrity-inventory table. - `requestLogsKey` string[] - `rulesets` object - `serverlessFunctionRegion` string, required - `serverlessFunctionZeroConfigFailover` false | true - `skipGitConnectDuringLink` false | true - `sourceFilesOutsideRootDirectory` false | true - `speedInsights` object - `canceledAt` number - `dataReceivedAt` number: When the first free (not Speed Insights Plus) production data point was observed, in ms. Set once by subscriber-analytics-events; projects that already had data before this field shipped get it backfilled on their next batch, so it reads "first free data point observed", not necessarily "first ever". - `disabledAt` number - `enabledAt` number - `hasData` false | true - `id` string, required - `paidAt` number - `ssoProtection` object, nullable - `april2026SecurityIncidentMigrationAppliedFrom` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews' | 'null', nullable - `cve55182MigrationAppliedFrom` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews' | 'null', nullable - `deploymentType` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews', required - `targets` object - `tier` 'priority' - `transferCompletedAt` number - `transferredFromAccountId` string - `transferStartedAt` number - `transferToAccountId` string - `trustedSources` object, nullable - `enableVercelCiSameRepository` false | true: Allow same-team Vercel CI access to preview and production deployments built from the CI run's repository, using the deployment source rather than the current project repository link. Defaults to enabled when not stored; omitted or null Trusted Sources updates preserve the stored value. - `oidcProviders` object - `projects` object - `updatedAt` number - `webAnalytics` object - `canceledAt` number - `disabledAt` number - `enabledAt` number - `hasData` true - `id` string, required - object - `pagination` union, required - object: This object contains information related to the pagination of the current request using continuation tokens. Since CosmosDB doesn't support going to previous pages, only count and next are provided. - `count` number, required: Amount of items in the current page. - `next` string, nullable, required: Continuation token that must be used to request the next page. Base32 encoded for safe URL transmission. - Pagination: This object contains information related to the pagination of the current request, including the necessary parameters to get the next or previous page of data. - `count` number, required: Amount of items in the current page. - `next` number, nullable, required: Timestamp that must be used to request the next page. - `prev` number, nullable, required: Timestamp that must be used to request the previous page. - `projects` object[], required - `accountId` string, required - `alias` object[], required - `configuredBy` 'A' | 'CNAME' | 'dns-01' | 'http' | 'null', nullable - `configuredChangedAt` number, nullable - `createdAt` number, nullable - `deployment` object, nullable, required - `alias` string[] - `aliasAssigned` union - number - false | true - `aliasError` object, nullable - `code` string, required - `message` string, required - `aliasFinal` string, nullable - `automaticAliases` string[] - `branchMatcher` object - `pattern` string, required: The pattern to match against branch names - `type` 'endsWith' | 'equals' | 'startsWith', required: The type of matching to perform - `buildingAt` number - `builds` object[] - `dest` string - `src` string - `use` string, required - `checksConclusion` 'canceled' | 'failed' | 'skipped' | 'succeeded' - `checksState` 'completed' | 'registered' | 'running' - `connectBuildsEnabled` false | true - `connectConfigurationId` string - `createdAt` number, required - `createdIn` string, required - `creator` object, nullable, required - `email` string, required - `githubLogin` string - `gitlabLogin` string - `uid` string, required - `username` string, required - `deletedAt` number - `deploymentHostname` string, required - `forced` false | true - `id` string, required - `meta` object - `monorepoManager` string, nullable - `name` string, required - `oidcTokenClaims` object - `aud` string, required - `custom_environment_id` string - `deployment_id` string - `environment` string, required - `iss` string, required - `mfe_group_ids` string[] - `owner` string, required - `owner_id` string, required - `plan` string - `project` string, required - `project_id` string, required - `scope` string, required - `sub` string, required - `plan` 'enterprise' | 'hobby' | 'pro', required - `previewCommentsEnabled` false | true: Whether or not preview comments are enabled for the deployment - `private` false | true, required - `readyAt` number - `readyState` 'BLOCKED' | 'BUILDING' | 'CANCELED' | 'ERROR' | 'INITIALIZING' | 'QUEUED' | 'READY', required - `readySubstate` 'PROMOTED' | 'ROLLING' | 'STAGED' - `requestedAt` number - `target` string, nullable - `teamId` string, nullable - `type` 'LAMBDAS', required - `url` string, required - `userId` string: Present for user creators; omitted for app/integration/system creators. - `withCache` false | true - `domain` string, required - `environment` 'preview' | 'production', required - `gitBranch` string, nullable - `redirect` string, nullable - `redirectStatusCode` 301 | 302 | 307 | 308 | null, nullable - `target` 'PREVIEW' | 'PRODUCTION' | 'STAGING', required - `analytics` object - `canceledAt` number, nullable - `disabledAt` number, required - `enabledAt` number, required - `id` string, required - `paidAt` number - `sampleRatePercent` number, nullable - `spendLimitInDollars` number, nullable - `appliedCve55182Migration` false | true - `autoAssignCustomDomains` false | true - `autoAssignCustomDomainsUpdatedBy` string - `autoExposeSystemEnvs` false | true - `buildCommand` string, nullable - `commandForIgnoringBuildStep` string, nullable - `createdAt` number - `creator` union - object - `type` 'user', required - `via` union, required - object: Set when a Vercel App or Integration acts on behalf of a {@link User}. Captures user-consented OAuth delegation that the ACL layer may inspect to evaluate scope restrictions. This is NOT for impersonation or token-exchange provenance — those live on `auth.token`, not on the principal. - … - object: Set when a Vercel App or Integration acts on behalf of a {@link User}. Captures user-consented OAuth delegation that the ACL layer may inspect to evaluate scope restrictions. This is NOT for impersonation or token-exchange provenance — those live on `auth.token`, not on the principal. - … - `user` object, required - `id` string, required - object - `project` object, required - `id` string, required - `type` 'project', required - object - `app` object, required - `clientId` string: The protocol-facing OAuth client ID. This may differ from {@link id} when Client ID Metadata Documents (CIMD) are used. - `id` string, required: The internal ID of the Vercel App backing this principal. - `type` 'app', required - object - `integration` object, required - `configurationId` string, required - `integrationId` string, required - `type` 'integration', required - object - `type` 'system', required - `customerSupportCodeVisibility` false | true - `deploymentExpiration` object, required: Retention policies for deployments. These are enforced at the project level, but we also maintain an instance of this at the team level as a default policy that gets applied to new projects. - `deploymentsToKeep` number: Minimum number of production deployments to keep for this project, even if they are over the production expiration limit. - `expirationDays` number: Number of days to keep non-production deployments (mostly preview deployments) before soft deletion. - `expirationDaysCanceled` number: Number of days to keep canceled deployments before soft deletion. - `expirationDaysErrored` number: Number of days to keep errored deployments before soft deletion. - `expirationDaysProduction` number: Number of days to keep production deployments before soft deletion. - `devCommand` string, nullable - `directoryListing` false | true, required - `env` object[] - `comment` string - `configurationId` string, nullable - `contentHint` union - object - `storeId` string, required - `type` 'redis-url', required - object - `storeId` string, required - `type` 'redis-rest-api-url', required - object - `storeId` string, required - `type` 'redis-rest-api-token', required - object - `storeId` string, required - `type` 'redis-rest-api-read-only-token', required - object - `storeId` string, required - `type` 'blob-read-write-token', required - object - `storeId` string, required - `type` 'blob-store-id', required - object - `storeId` string, required - `type` 'blob-webhook-public-key', required - object - `storeId` string, required - `type` 'postgres-url', required - object - `storeId` string, required - `type` 'postgres-url-non-pooling', required - object - `storeId` string, required - `type` 'postgres-prisma-url', required - object - `storeId` string, required - `type` 'postgres-user', required - object - `storeId` string, required - `type` 'postgres-host', required - object - `storeId` string, required - `type` 'postgres-password', required - object - `storeId` string, required - `type` 'postgres-database', required - object - `storeId` string, required - `type` 'postgres-url-no-ssl', required - object - `integrationConfigurationId` string, required - `integrationId` string, required - `integrationProductId` string, required - `storeId` string, required - `type` 'integration-store-secret', required - object - `projectId` string, required - `type` 'flags-connection-string', required - `createdAt` number - `createdBy` string, nullable - `customEnvironmentIds` string[] - `decrypted` false | true - `edgeConfigId` string, nullable - `edgeConfigTokenId` string, nullable - `gitBranch` string - `id` string - `internalContentHint` object, nullable: Similar to `contentHints`, but should not be exposed to the user. - `encryptedValue` string, required: Contains the `value` of the env variable, encrypted with a special key to make decryption possible in the subscriber Lambda. - `type` 'flags-secret', required - `key` string, required - `legacyValue` string: Legacy now-encryption ciphertext, present after migration swaps value/vsmValue - `sunsetSecretId` string: This is used to identify variables that have been migrated from type secret to sensitive. - `target` union - string[] - 'development' | 'development' | 'preview' | 'preview' | 'production' - `type` 'encrypted' | 'plain' | 'secret' | 'sensitive' | 'system', required - `updatedAt` number - `updatedBy` string, nullable - `value` string, required - `visibility` 'config' | 'secret': User-facing config/secret model. When set, authoritative for new code paths. Legacy rows omit this field and callers fall back to existing `type` behavior. - `vsmValue` string - `framework` 'actix-web' | 'angular' | 'ash' | 'astro' | 'axum' | 'blitzjs' | 'brunch' | 'bun' | 'container' | 'create-react-app' | 'django' | 'docusaurus' | 'docusaurus-2' | 'dojo' | 'eleventy' | 'elysia' | 'ember' | 'eve' | 'express' | 'factory-eve' | 'fastapi' | 'fasthtml' | 'fastify' | 'flask' | 'gatsby' | 'go' | 'gridsome' | 'h3' | 'hexo' | 'hono' | 'hugo' | 'hydrogen' | 'ionic-angular' | 'ionic-react' | 'jekyll' | 'koa' | 'mastra' | 'middleman' | 'nestjs' | 'nextjs' | 'nitro' | 'node' | 'nuxtjs' | 'parcel' | 'polymer' | 'preact' | 'python' | 'react-router' | 'redwoodjs' | 'remix' | 'ruby' | 'rust' | 'saber' | 'sanity' | 'sanity-v2' | 'sapper' | 'scully' | 'services' | 'solidstart' | 'solidstart-1' | 'stencil' | 'storybook' | 'svelte' | 'sveltekit' | 'sveltekit-1' | 'tanstack-start' | 'tanstack-start-lovable' | 'umijs' | 'vite' | 'vitepress' | 'vue' | 'vuepress' | 'xmcp' | 'zola' | 'null', nullable - `gitComments` object - `onCommit` false | true, required: Whether the Vercel bot should comment on commits - `onPullRequest` false | true, required: Whether the Vercel bot should comment on PRs - `gitForkProtection` false | true - `gitProviderOptions` object - `consolidatedGitCommitStatus` object: Configuration for consolidated git commit status reporting. When enabled, Vercel will post a single consolidated commit status instead of individual statuses for each deployment. - `enabled` false | true, required: Whether consolidated commit status is enabled. - `propagateFailures` false | true, required: Whether to propagate individual deployment failures to the consolidated status. - `createDeployments` 'disabled' | 'enabled', required: Whether the Vercel bot should automatically create GitHub deployments https://docs.github.com/en/rest/deployments/deployments#about-deployments NOTE: repository-dispatch events should be used instead - `disableRepositoryDispatchEvents` false | true: Whether the Vercel bot should not automatically create GitHub repository-dispatch events on deployment events. https://vercel.com/docs/git/vercel-for-github#repository-dispatch-events - `true`: disable repository-dispatch events for this project (explicit override of the team setting). - `false`: enable repository-dispatch events for this project (explicit override of the team setting). - absent: inherit from `team.disableRepositoryDispatchEvents`. - `gitCommitStatus` false | true: Whether Vercel should post commit statuses for this project. When omitted, commit statuses remain enabled. - `requireVerifiedCommits` false | true: Whether the project requires commits to be signed & verified before deployments will be created. - `true`: require verified commits for this project (explicit override of the team setting). - `false`: do not require verified commits (explicit override of the team setting). - absent: inherit from `team.requireVerifiedCommits`. - `hasActiveBranches` false | true - `id` string, required - `installCommand` string, nullable - `internalRoutes` union[] - union - object - `expiry` number - `src` string, required - `status` number, required - object - `has` union[], required - … - `mitigate` object, required - … - `src` string - `ipBuckets` object[] - `bucket` string, required - `default` false | true - `supportUntil` number - `latestDeployments` object[] - `alias` string[] - `aliasAssigned` union - number - false | true - `aliasError` object, nullable - `code` string, required - `message` string, required - `aliasFinal` string, nullable - `automaticAliases` string[] - `branchMatcher` object - `pattern` string, required: The pattern to match against branch names - `type` 'endsWith' | 'equals' | 'startsWith', required: The type of matching to perform - `buildingAt` number - `builds` object[] - `dest` string - `src` string - `use` string, required - `checksConclusion` 'canceled' | 'failed' | 'skipped' | 'succeeded' - `checksState` 'completed' | 'registered' | 'running' - `connectBuildsEnabled` false | true - `connectConfigurationId` string - `createdAt` number, required - `createdIn` string, required - `creator` object, nullable, required - `email` string, required - `githubLogin` string - `gitlabLogin` string - `uid` string, required - `username` string, required - `deletedAt` number - `deploymentHostname` string, required - `forced` false | true - `id` string, required - `meta` object - `monorepoManager` string, nullable - `name` string, required - `oidcTokenClaims` object - `aud` string, required - `custom_environment_id` string - `deployment_id` string - `environment` string, required - `iss` string, required - `mfe_group_ids` string[] - `owner` string, required - `owner_id` string, required - `plan` string - `project` string, required - `project_id` string, required - `scope` string, required - `sub` string, required - `plan` 'enterprise' | 'hobby' | 'pro', required - `previewCommentsEnabled` false | true: Whether or not preview comments are enabled for the deployment - `private` false | true, required - `readyAt` number - `readyState` 'BLOCKED' | 'BUILDING' | 'CANCELED' | 'ERROR' | 'INITIALIZING' | 'QUEUED' | 'READY', required - `readySubstate` 'PROMOTED' | 'ROLLING' | 'STAGED' - `requestedAt` number - `target` string, nullable - `teamId` string, nullable - `type` 'LAMBDAS', required - `url` string, required - `userId` string: Present for user creators; omitted for app/integration/system creators. - `withCache` false | true - `link` union - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github-limited', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `host` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github-custom-host', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `productionBranch` string, required - `projectId` string, required - `projectName` string, required - `projectNamespace` string, required - `projectNameWithNamespace` string, required - `projectOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. This is the id of the top level group that a namespace belongs to. Gitlab supports group nesting (up to 20 levels). - `projectUrl` string, required - `sourceless` false | true - `type` 'gitlab', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `name` string, required - `owner` string, required - `productionBranch` string, required - `slug` string, required - `sourceless` false | true - `type` 'bitbucket', required - `updatedAt` number - `uuid` string, required - `workspaceUuid` string, required - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string, required - `repoId` string, required - `sourceless` false | true - `type` 'vercel', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string, required - `repoId` string, required - `sourceless` false | true - `type` 'v0', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `owner` string, required: Owner (namespace) slug, e.g. `acme`. - `ownerId` string, required: Origin namespace id (`ns_…`) of the owner. - `productionBranch` string, required - `repo` string, required - `repoId` string, required: Origin repository id. - `sourceless` false | true - `type` 'cursor-origin', required - `updatedAt` number - `live` false | true - `name` string, required - `nodeVersion` '10.x' | '12.x' | '14.x' | '16.x' | '18.x' | '20.x' | '22.x' | '24.x' | '26.x' | '8.10.x', required - `oidcTokenConfig` object - `enabled` false | true: Whether or not to generate OpenID Connect JSON Web Tokens. - `issuerMode` 'global' | 'team': - team: `https://oidc.vercel.com/[team_slug]` - global: `https://oidc.vercel.com` - `outputDirectory` string, nullable - `passport` object, nullable - `connectorId` string, required - `deploymentType` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews', required - `passwordProtection` object, nullable - `paused` false | true - `resourceConfig` object, required - `buildMachineElasticLastUpdated` number - `buildMachineElasticReason` 'basic-floor' | 'build-timeout-failure' | 'enospc-failure' | 'enterprise-floor' | 'high-peak-disk' | 'high-peak-memory' | 'long-build-duration' | 'oom-failure' | 'short-build-duration' | 'sustained-high-cpu' - `buildMachineElasticTransition` object - `algorithmVersion` string, required - `at` number, required - `direction` 'downgrade' | 'upgrade', required - `buildMachineSelection` 'elastic' | 'fixed' - `buildMachineType` '14cpu-28gb' | 'basic' | 'enhanced' | 'standard' | 'turbo' - `buildQueue` object - `configuration` 'SKIP_NAMESPACE_QUEUE' | 'WAIT_FOR_NAMESPACE_QUEUE' - `elasticConcurrencyEnabled` false | true - `enableFunctionsBeta` false | true - `fluid` false | true - `functionDefaultMemoryType` 'performance' | 'performance_xl' | 'standard' | 'standard_legacy' - `functionDefaultRegions` string[], required - `functionDefaultTimeout` number - `functionZeroConfigFailover` false | true - `isNSNBDisabled` false | true - `elasticBuildMachine` union - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 4, required - `label` 'standard', required - `memory` 8192, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 8, required - `label` 'enhanced', required - `memory` 16384, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 14, required - `label` '14cpu-28gb', required - `memory` 28672, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 30, required - `label` 'turbo', required - `memory` 61440, required - `rollingRelease` object, nullable: Project-level rolling release configuration that defines how deployments should be gradually rolled out - `canaryResponseHeader` false | true: Whether the request served by a canary deployment should return a header indicating a canary was served. Defaults to `false` when omitted. - `gate` object: Automated gating configuration. Omitted (the default) means no gating is configured, which is equivalent to `enabled: false`. - `action` 'pause' | 'rollback', required: What to do when the gate trips: pause the rollout, or roll it back. - `checks` object[], required: The checks to evaluate. An empty array means nothing is evaluated. - `excludePaths` string[]: Request paths to ignore entirely — dropped from both the numerator (errors) and the denominator (total requests). Matched exactly against the request path with any query string removed; no prefix or glob matching. Defaults to `[]` when omitted. - `excludeStatusCodes` number[]: Response status codes to ignore entirely — dropped from both the numerator (errors) and the denominator (total requests). Defaults to `[]` when omitted. - `ingestWatermarkSeconds` number: Seconds of ingest lag to allow for: the query's upper bound is `now() - this value`, so the check never reads a window that is still filling. Defaults to `30` when omitted. - `significanceLevel` number: A run fails only when the canary's error rate is higher and its one-sided Fisher p-value is below this significance level. Defaults to `0.05`; lower values require stronger evidence. - `type` 'error-rate-5xx', required: The metric this check evaluates. - `dryRun` false | true, required: When true, a tripped gate is only reported — {@link action} is not taken. - `enabled` false | true, required: Whether automated gating is enabled for this project's rollouts. - `failureThreshold` number: How many failing evaluations within {@link windowSize} trip the gate. Defaults to `3` when omitted. - `windowSize` number: How many of the most recent evaluations {@link failureThreshold} is counted against. Defaults to `5` when omitted. - `stages` object[], nullable: An array of all the stages required during a deployment release. Each stage defines a target percentage and advancement rules. The final stage must always have targetPercentage: 100. - `duration` number: Duration in minutes for automatic advancement to the next stage - `linearShift` false | true: Whether to linearly shift traffic over the duration of this stage - `requireApproval` false | true: Whether or not this stage requires manual approval to proceed - `targetPercentage` number, required: The percentage of traffic to serve to the canary deployment (0-100) - `target` string, required: The environment that the release targets, currently only supports production. Adding in case we want to configure with alias groups or custom environments. - `rootDirectory` string, nullable - `security` object - `attackModeActiveUntil` number, nullable - `attackModeEnabled` false | true - `attackModeUpdatedAt` number - `botIdEnabled` false | true - `firewallBypassIps` string[] - `firewallConfigVersion` number - `firewallEnabled` false | true - `firewallRoutes` object[] - `dest` string - `handle` 'finalize' | 'init' - `has` object[] - `key` string - `type` 'cookie' | 'domain_environment' | 'environment' | 'header' | 'headers' | 'host' | 'initial_request_path' | 'ip_address' | 'method' | 'path' | 'protocol' | 'query' | 'region' | 'scheme' | 'trusted_source', required - `value` union - … - `missing` object[] - `key` string - `type` 'cookie' | 'domain_environment' | 'environment' | 'header' | 'headers' | 'host' | 'initial_request_path' | 'ip_address' | 'method' | 'path' | 'protocol' | 'query' | 'region' | 'scheme' | 'trusted_source', required - `value` union - … - `mitigate` object - `action` 'bypass' | 'challenge' | 'deny' | 'log' | 'rate_limit' | 'redirect', required - `erl` object - … - `log_headers` union - … - `rule_id` string, required - `ttl` number - `response_has` object[] - `key` string - `type` 'response_status', required - `value` union - … - `src` union - string - object - … - `status` number - `tierRequirement` 'priority' - `transforms` object[] - `args` string, required - `op` 'append', required - `target` object, required - … - `type` 'request.headers', required - `firewallSeawallEnabled` false | true - `firewallUpdatedAt` number - `ja3Enabled` false | true - `ja4Enabled` false | true - `log_headers` union - string[] - '*' - `managedRules` object, nullable - `ai_bots` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `bot_filter` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `owasp` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `traffic_sources` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `vercel_ruleset` object, required - `action` 'challenge' | 'deny' | 'log' - `active` false | true, required - `pageIntegrityEnabled` false | true: Whether Page Integrity is enabled for this project. Used by the metadata service to gate DynamoDB lookups against the page-integrity-inventory table. - `requestLogsKey` string[] - `rulesets` object - `serverlessFunctionRegion` string, required - `serverlessFunctionZeroConfigFailover` false | true - `skipGitConnectDuringLink` false | true - `sourceFilesOutsideRootDirectory` false | true - `speedInsights` object - `canceledAt` number - `dataReceivedAt` number: When the first free (not Speed Insights Plus) production data point was observed, in ms. Set once by subscriber-analytics-events; projects that already had data before this field shipped get it backfilled on their next batch, so it reads "first free data point observed", not necessarily "first ever". - `disabledAt` number - `enabledAt` number - `hasData` false | true - `id` string, required - `paidAt` number - `ssoProtection` object, nullable - `april2026SecurityIncidentMigrationAppliedFrom` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews' | 'null', nullable - `cve55182MigrationAppliedFrom` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews' | 'null', nullable - `deploymentType` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews', required - `targets` object - `tier` 'priority' - `transferCompletedAt` number - `transferredFromAccountId` string - `transferStartedAt` number - `transferToAccountId` string - `trustedSources` object, nullable - `enableVercelCiSameRepository` false | true: Allow same-team Vercel CI access to preview and production deployments built from the CI run's repository, using the deployment source rather than the current project repository link. Defaults to enabled when not stored; omitted or null Trusted Sources updates preserve the stored value. - `oidcProviders` object - `projects` object - `updatedAt` number - `webAnalytics` object - `canceledAt` number - `disabledAt` number - `enabledAt` number - `hasData` true - `id` string, required - object - `pagination` union, required - object: This object contains information related to the pagination of the current request using continuation tokens. Since CosmosDB doesn't support going to previous pages, only count and next are provided. - `count` number, required: Amount of items in the current page. - `next` string, nullable, required: Continuation token that must be used to request the next page. Base32 encoded for safe URL transmission. - Pagination: This object contains information related to the pagination of the current request, including the necessary parameters to get the next or previous page of data. - `count` number, required: Amount of items in the current page. - `next` number, nullable, required: Timestamp that must be used to request the next page. - `prev` number, nullable, required: Timestamp that must be used to request the previous page. - `projects` object[], required - `accountId` string, required - `alias` object[], required - `configuredBy` 'A' | 'CNAME' | 'dns-01' | 'http' | 'null', nullable - `configuredChangedAt` number, nullable - `createdAt` number, nullable - `deployment` object, nullable, required - `alias` string[] - `aliasAssigned` union - number - false | true - `aliasError` object, nullable - `code` string, required - `message` string, required - `aliasFinal` string, nullable - `automaticAliases` string[] - `branchMatcher` object - `pattern` string, required: The pattern to match against branch names - `type` 'endsWith' | 'equals' | 'startsWith', required: The type of matching to perform - `buildingAt` number - `builds` object[] - `dest` string - `src` string - `use` string, required - `checksConclusion` 'canceled' | 'failed' | 'skipped' | 'succeeded' - `checksState` 'completed' | 'registered' | 'running' - `connectBuildsEnabled` false | true - `connectConfigurationId` string - `createdAt` number, required - `createdIn` string, required - `creator` object, nullable, required - `email` string, required - `githubLogin` string - `gitlabLogin` string - `uid` string, required - `username` string, required - `deletedAt` number - `deploymentHostname` string, required - `forced` false | true - `id` string, required - `meta` object - `monorepoManager` string, nullable - `name` string, required - `oidcTokenClaims` object - `aud` string, required - `custom_environment_id` string - `deployment_id` string - `environment` string, required - `iss` string, required - `mfe_group_ids` string[] - `owner` string, required - `owner_id` string, required - `plan` string - `project` string, required - `project_id` string, required - `scope` string, required - `sub` string, required - `plan` 'enterprise' | 'hobby' | 'pro', required - `previewCommentsEnabled` false | true: Whether or not preview comments are enabled for the deployment - `private` false | true, required - `readyAt` number - `readyState` 'BLOCKED' | 'BUILDING' | 'CANCELED' | 'ERROR' | 'INITIALIZING' | 'QUEUED' | 'READY', required - `readySubstate` 'PROMOTED' | 'ROLLING' | 'STAGED' - `requestedAt` number - `target` string, nullable - `teamId` string, nullable - `type` 'LAMBDAS', required - `url` string, required - `userId` string: Present for user creators; omitted for app/integration/system creators. - `withCache` false | true - `domain` string, required - `environment` 'preview' | 'production', required - `gitBranch` string, nullable - `redirect` string, nullable - `redirectStatusCode` 301 | 302 | 307 | 308 | null, nullable - `target` 'PREVIEW' | 'PRODUCTION' | 'STAGING', required - `analytics` object - `canceledAt` number, nullable - `disabledAt` number, required - `enabledAt` number, required - `id` string, required - `paidAt` number - `sampleRatePercent` number, nullable - `spendLimitInDollars` number, nullable - `appliedCve55182Migration` false | true - `autoAssignCustomDomains` false | true - `autoAssignCustomDomainsUpdatedBy` string - `autoExposeSystemEnvs` false | true - `avatar` string, nullable - `avatarDarkMode` string, nullable - `blobs` object - `isDefaultApp` false | true: Marks the team-level, Vercel-managed default blob project (`vercel-blob-default-project`) that orphan blob stores are scoped to when connected without an explicit project. Set only by internal storage flows and immutable after creation — guards rely on it to protect the connected stores from being lost when the project is deleted or transferred. - `buildCommand` string, nullable - `commandForIgnoringBuildStep` string, nullable - `concurrencyBucketName` string - `connectBuildsEnabled` false | true - `connectConfigurationId` string, nullable - `connectConfigurations` object[], nullable - `aws` object - `securityGroupId` string - `subnetIds` string[], required - `buildsEnabled` false | true, required - `connectConfigurationId` string, required - `createdAt` number, required - `dc` string - `envId` union, required - string - 'preview' | 'production' - `passive` false | true, required - `updatedAt` number, required - `createdAt` number - `creator` union - object - `type` 'user', required - `via` union, required - object: Set when a Vercel App or Integration acts on behalf of a {@link User}. Captures user-consented OAuth delegation that the ACL layer may inspect to evaluate scope restrictions. This is NOT for impersonation or token-exchange provenance — those live on `auth.token`, not on the principal. - … - object: Set when a Vercel App or Integration acts on behalf of a {@link User}. Captures user-consented OAuth delegation that the ACL layer may inspect to evaluate scope restrictions. This is NOT for impersonation or token-exchange provenance — those live on `auth.token`, not on the principal. - … - `user` object, required - `id` string, required - object - `project` object, required - `id` string, required - `type` 'project', required - object - `app` object, required - `clientId` string: The protocol-facing OAuth client ID. This may differ from {@link id} when Client ID Metadata Documents (CIMD) are used. - `id` string, required: The internal ID of the Vercel App backing this principal. - `type` 'app', required - object - `integration` object, required - `configurationId` string, required - `integrationId` string, required - `type` 'integration', required - object - `type` 'system', required - `crons` object - `definitions` object[], required - `description` string: A human-readable description of what this cron job does. - `host` string, required: The hostname that should be used. - `hostInferred` false | true: Whether the host was inferred from the production deployment URL rather than explicitly provided. - `path` string, required: The path that should be called for the cronjob. - `schedule` string, required: The cron expression. - `source` 'api': The origin of this definition. 'api' means created via the API. Undefined means it originated from a deployment (vercel.json). - `deploymentId` string, nullable, required: The ID of the Deployment from which the definitions originated. - `disabledAt` number, nullable, required: The time the feature was disabled for this project. - `enabledAt` number, required: The time the feature was enabled for this project. Note: It enables automatically with the first Deployment that outputs cronjobs. - `updatedAt` number, required - `customEnvironments` object[] - `branchMatcher` object: Configuration for matching git branches to this environment - `pattern` string, required: The pattern to match against branch names - `type` 'endsWith' | 'equals' | 'startsWith', required: The type of matching to perform - `createdAt` number, required: Timestamp when the environment was created - `currentDeploymentAliases` string[]: List of aliases for the current deployment - `description` string: Optional description of the environment's purpose - `domains` object[]: List of domains associated with this environment - `apexName` string, required - `createdAt` number - `customEnvironmentId` string, nullable - `gitBranch` string, nullable - `name` string, required - `projectId` string, required - `redirect` string, nullable - `redirectStatusCode` 301 | 302 | 307 | 308 | null, nullable - `updatedAt` number - `verification` object[]: A list of verification challenges, one of which must be completed to verify the domain for use on the project. After the challenge is complete `POST /projects/:idOrName/domains/:domain/verify` to verify the domain. Possible challenges: - If `verification.type = TXT` the `verification.domain` will be checked for a TXT record matching `verification.value`. - `domain` string, required - `reason` string, required - `type` string, required - `value` string, required - `verified` false | true, required: `true` if the domain is verified for use with the project. If `false` it will not be used as an alias on this project until the challenge in `verification` is completed. - `id` string, required: Unique identifier for the custom environment (format: env_*) - `slug` string, required: URL-friendly name of the environment - `type` 'development' | 'preview' | 'production', required: The type of environment (production, preview, or development) - `updatedAt` number, required: Timestamp when the environment was last updated - `customerSupportCodeVisibility` false | true - `dataCache` object - `storageSizeBytes` number, nullable - `unlimited` false | true - `userDisabled` false | true, required - `defaultResourceConfig` object, required - `buildMachineElasticLastUpdated` number - `buildMachineElasticReason` 'basic-floor' | 'build-timeout-failure' | 'enospc-failure' | 'enterprise-floor' | 'high-peak-disk' | 'high-peak-memory' | 'long-build-duration' | 'oom-failure' | 'short-build-duration' | 'sustained-high-cpu' - `buildMachineElasticTransition` object - `algorithmVersion` string, required - `at` number, required - `direction` 'downgrade' | 'upgrade', required - `buildMachineSelection` 'elastic' | 'fixed' - `buildMachineType` '14cpu-28gb' | 'basic' | 'enhanced' | 'standard' | 'turbo' - `buildQueue` object - `configuration` 'SKIP_NAMESPACE_QUEUE' | 'WAIT_FOR_NAMESPACE_QUEUE' - `elasticConcurrencyEnabled` false | true - `enableFunctionsBeta` false | true - `fluid` false | true - `functionDefaultMemoryType` 'performance' | 'performance_xl' | 'standard' | 'standard_legacy' - `functionDefaultRegions` string[], required - `functionDefaultTimeout` number - `functionZeroConfigFailover` false | true - `isNSNBDisabled` false | true - `elasticBuildMachine` union - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 4, required - `label` 'standard', required - `memory` 8192, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 8, required - `label` 'enhanced', required - `memory` 16384, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 14, required - `label` '14cpu-28gb', required - `memory` 28672, required - object: Server-owned Elastic assignment; responses may fall back to the legacy label. Not accepted as input. Memory is measured in MiB. - `cores` 30, required - `label` 'turbo', required - `memory` 61440, required - `deploymentExpiration` object, required: Retention policies for deployments. These are enforced at the project level, but we also maintain an instance of this at the team level as a default policy that gets applied to new projects. - `deploymentsToKeep` number: Minimum number of production deployments to keep for this project, even if they are over the production expiration limit. - `expirationDays` number: Number of days to keep non-production deployments (mostly preview deployments) before soft deletion. - `expirationDaysCanceled` number: Number of days to keep canceled deployments before soft deletion. - `expirationDaysErrored` number: Number of days to keep errored deployments before soft deletion. - `expirationDaysProduction` number: Number of days to keep production deployments before soft deletion. - `deploymentPolicy` object, nullable: Project shape. `null` on a rule list clears the project's override for that rule type (fall back to team for every env); omitting is equivalent. Setting `deploymentPolicy` itself to `null` clears every override at once. Kept structurally distinct from {@link TeamDeploymentPolicy} so the two storage locations don't share a type by accident. - `deploymentSources` object[], nullable - `enabled` false | true, required - `environments` union[], required - union - … - `sources` string[], required - `gitSources` object[], nullable - `enabled` false | true, required - `environments` union[], required - union - … - `sources` union[], required - union - … - `devCommand` string, nullable - `directoryListing` false | true, required - `dismissedToasts` object[] - `action` 'accept' | 'cancel' | 'delete', required - `dismissedAt` number, required - `key` string, required - `value` union, required - string - number - object - `currentValue` union, required - … - `previousValue` union, required - … - false | true - `enableAffectedProjectsDeployments` false | true - `enableExternalRewriteCaching` false | true - `enablePreviewFeedback` false | true | null, nullable - `enableProductionFeedback` false | true | null, nullable - `env` object[] - `comment` string - `configurationId` string, nullable - `contentHint` union - object - `storeId` string, required - `type` 'redis-url', required - object - `storeId` string, required - `type` 'redis-rest-api-url', required - object - `storeId` string, required - `type` 'redis-rest-api-token', required - object - `storeId` string, required - `type` 'redis-rest-api-read-only-token', required - object - `storeId` string, required - `type` 'blob-read-write-token', required - object - `storeId` string, required - `type` 'blob-store-id', required - object - `storeId` string, required - `type` 'blob-webhook-public-key', required - object - `storeId` string, required - `type` 'postgres-url', required - object - `storeId` string, required - `type` 'postgres-url-non-pooling', required - object - `storeId` string, required - `type` 'postgres-prisma-url', required - object - `storeId` string, required - `type` 'postgres-user', required - object - `storeId` string, required - `type` 'postgres-host', required - object - `storeId` string, required - `type` 'postgres-password', required - object - `storeId` string, required - `type` 'postgres-database', required - object - `storeId` string, required - `type` 'postgres-url-no-ssl', required - object - `integrationConfigurationId` string, required - `integrationId` string, required - `integrationProductId` string, required - `storeId` string, required - `type` 'integration-store-secret', required - object - `projectId` string, required - `type` 'flags-connection-string', required - `createdAt` number - `createdBy` string, nullable - `customEnvironmentIds` string[] - `decrypted` false | true - `edgeConfigId` string, nullable - `edgeConfigTokenId` string, nullable - `gitBranch` string - `id` string - `internalContentHint` object, nullable: Similar to `contentHints`, but should not be exposed to the user. - `encryptedValue` string, required: Contains the `value` of the env variable, encrypted with a special key to make decryption possible in the subscriber Lambda. - `type` 'flags-secret', required - `key` string, required - `legacyValue` string: Legacy now-encryption ciphertext, present after migration swaps value/vsmValue - `sunsetSecretId` string: This is used to identify variables that have been migrated from type secret to sensitive. - `target` union - string[] - 'development' | 'development' | 'preview' | 'preview' | 'production' - `type` 'encrypted' | 'plain' | 'secret' | 'sensitive' | 'system', required - `updatedAt` number - `updatedBy` string, nullable - `value` string, required - `visibility` 'config' | 'secret': User-facing config/secret model. When set, authoritative for new code paths. Legacy rows omit this field and callers fall back to existing `type` behavior. - `vsmValue` string - `expiration` union - object - `expiresAt` number, required: Unix ms timestamp when the project is scheduled to expire. - object - `lockedAt` number, required: Unix ms timestamp when the project was locked. - `lockedBy` string, required: ID of the user, app, or integration that locked the project, or `system`. - `features` object - `webAnalytics` false | true - `framework` 'actix-web' | 'angular' | 'ash' | 'astro' | 'axum' | 'blitzjs' | 'brunch' | 'bun' | 'container' | 'create-react-app' | 'django' | 'docusaurus' | 'docusaurus-2' | 'dojo' | 'eleventy' | 'elysia' | 'ember' | 'eve' | 'express' | 'factory-eve' | 'fastapi' | 'fasthtml' | 'fastify' | 'flask' | 'gatsby' | 'go' | 'gridsome' | 'h3' | 'hexo' | 'hono' | 'hugo' | 'hydrogen' | 'ionic-angular' | 'ionic-react' | 'jekyll' | 'koa' | 'mastra' | 'middleman' | 'nestjs' | 'nextjs' | 'nitro' | 'node' | 'nuxtjs' | 'parcel' | 'polymer' | 'preact' | 'python' | 'react-router' | 'redwoodjs' | 'remix' | 'ruby' | 'rust' | 'saber' | 'sanity' | 'sanity-v2' | 'sapper' | 'scully' | 'services' | 'solidstart' | 'solidstart-1' | 'stencil' | 'storybook' | 'svelte' | 'sveltekit' | 'sveltekit-1' | 'tanstack-start' | 'tanstack-start-lovable' | 'umijs' | 'vite' | 'vitepress' | 'vue' | 'vuepress' | 'xmcp' | 'zola' | 'null', nullable - `gitComments` object - `onCommit` false | true, required: Whether the Vercel bot should comment on commits - `onPullRequest` false | true, required: Whether the Vercel bot should comment on PRs - `gitForkProtection` false | true - `gitLFS` false | true - `gitProviderOptions` object - `consolidatedGitCommitStatus` object: Configuration for consolidated git commit status reporting. When enabled, Vercel will post a single consolidated commit status instead of individual statuses for each deployment. - `enabled` false | true, required: Whether consolidated commit status is enabled. - `propagateFailures` false | true, required: Whether to propagate individual deployment failures to the consolidated status. - `createDeployments` 'disabled' | 'enabled', required: Whether the Vercel bot should automatically create GitHub deployments https://docs.github.com/en/rest/deployments/deployments#about-deployments NOTE: repository-dispatch events should be used instead - `disableRepositoryDispatchEvents` false | true: Whether the Vercel bot should not automatically create GitHub repository-dispatch events on deployment events. https://vercel.com/docs/git/vercel-for-github#repository-dispatch-events - `true`: disable repository-dispatch events for this project (explicit override of the team setting). - `false`: enable repository-dispatch events for this project (explicit override of the team setting). - absent: inherit from `team.disableRepositoryDispatchEvents`. - `gitCommitStatus` false | true: Whether Vercel should post commit statuses for this project. When omitted, commit statuses remain enabled. - `requireVerifiedCommits` false | true: Whether the project requires commits to be signed & verified before deployments will be created. - `true`: require verified commits for this project (explicit override of the team setting). - `false`: do not require verified commits (explicit override of the team setting). - absent: inherit from `team.requireVerifiedCommits`. - `hasActiveBranches` false | true - `hasDeployments` false | true - `id` string, required - `installCommand` string, nullable - `internalRoutes` union[] - union - object - `expiry` number - `src` string, required - `status` number, required - object - `has` union[], required - … - `mitigate` object, required - … - `src` string - `ipBuckets` object[] - `bucket` string, required - `default` false | true - `supportUntil` number - `jobs` object - `flag-definitions-present` object - `targets` string[], required - `health-check` object - `targets` string[], required - `lint` object - `targets` string[], required - `mfe-config-present` object - `targets` string[], required - `typecheck` object - `targets` string[], required - `lastAliasRequest` object, nullable - `fromDeploymentId` string, nullable, required - `fromRollingReleaseId` string: If rolling back from a rolling release, fromDeploymentId captures the "base" of that rolling release, and fromRollingReleaseId captures the "target" of that rolling release. - `jobStatus` 'failed' | 'in-progress' | 'pending' | 'skipped' | 'succeeded', required - `requestedAt` number, required - `toDeploymentId` string, required - `type` 'promote' | 'rollback', required - `lastRollbackTarget` object, nullable - `latestDeployments` object[] - `alias` string[] - `aliasAssigned` union - number - false | true - `aliasError` object, nullable - `code` string, required - `message` string, required - `aliasFinal` string, nullable - `automaticAliases` string[] - `branchMatcher` object - `pattern` string, required: The pattern to match against branch names - `type` 'endsWith' | 'equals' | 'startsWith', required: The type of matching to perform - `buildingAt` number - `builds` object[] - `dest` string - `src` string - `use` string, required - `checksConclusion` 'canceled' | 'failed' | 'skipped' | 'succeeded' - `checksState` 'completed' | 'registered' | 'running' - `connectBuildsEnabled` false | true - `connectConfigurationId` string - `createdAt` number, required - `createdIn` string, required - `creator` object, nullable, required - `email` string, required - `githubLogin` string - `gitlabLogin` string - `uid` string, required - `username` string, required - `deletedAt` number - `deploymentHostname` string, required - `forced` false | true - `id` string, required - `meta` object - `monorepoManager` string, nullable - `name` string, required - `oidcTokenClaims` object - `aud` string, required - `custom_environment_id` string - `deployment_id` string - `environment` string, required - `iss` string, required - `mfe_group_ids` string[] - `owner` string, required - `owner_id` string, required - `plan` string - `project` string, required - `project_id` string, required - `scope` string, required - `sub` string, required - `plan` 'enterprise' | 'hobby' | 'pro', required - `previewCommentsEnabled` false | true: Whether or not preview comments are enabled for the deployment - `private` false | true, required - `readyAt` number - `readyState` 'BLOCKED' | 'BUILDING' | 'CANCELED' | 'ERROR' | 'INITIALIZING' | 'QUEUED' | 'READY', required - `readySubstate` 'PROMOTED' | 'ROLLING' | 'STAGED' - `requestedAt` number - `target` string, nullable - `teamId` string, nullable - `type` 'LAMBDAS', required - `url` string, required - `userId` string: Present for user creators; omitted for app/integration/system creators. - `withCache` false | true - `link` union - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github-limited', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `host` string, required - `org` string, required - `productionBranch` string, required - `repo` string - `repoId` number - `repoOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. - `sourceless` false | true - `type` 'github-custom-host', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `productionBranch` string, required - `projectId` string, required - `projectName` string, required - `projectNamespace` string, required - `projectNameWithNamespace` string, required - `projectOwnerId` number: A new field, should be included in all new project links, is being added just in time when a deployment is created. This is needed for Protected Git scopes. This is the id of the top level group that a namespace belongs to. Gitlab supports group nesting (up to 20 levels). - `projectUrl` string, required - `sourceless` false | true - `type` 'gitlab', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `name` string, required - `owner` string, required - `productionBranch` string, required - `slug` string, required - `sourceless` false | true - `type` 'bitbucket', required - `updatedAt` number - `uuid` string, required - `workspaceUuid` string, required - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string, required - `repoId` string, required - `sourceless` false | true - `type` 'vercel', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `org` string, required - `productionBranch` string, required - `repo` string, required - `repoId` string, required - `sourceless` false | true - `type` 'v0', required - `updatedAt` number - object - `createdAt` number - `deployHooks` object[], required - `createdAt` number - `id` string, required - `name` string, required - `ref` string, required - `url` string, required - `gitCredentialId` string, required - `owner` string, required: Owner (namespace) slug, e.g. `acme`. - `ownerId` string, required: Origin namespace id (`ns_…`) of the owner. - `productionBranch` string, required - `repo` string, required - `repoId` string, required: Origin repository id. - `sourceless` false | true - `type` 'cursor-origin', required - `updatedAt` number - `live` false | true - `microfrontends` union - object - `defaultRoute` string: A path that is used to take screenshots and as the default path in preview links when a domain for this microfrontend is shown in the UI. Includes the leading slash, e.g. `/docs` - `enabled` true, required: Whether microfrontends are enabled for this project. - `freeProjectForLegacyLimits` false | true: Whether the project was part of the legacy limits for hobby and pro-trial before billing was added. This field is only set when the team is upgraded to a paid plan and we are backfilling the subscription status. We cap the subscription to 2 projects and set this field for the 3rd project. When this field is set, the project is not charged for and we do not call any billing APIs for this project. - `groupIds` string[], required: The group IDs of microfrontends that this project belongs to. Each microfrontend project must belong to a microfrontends group that is the set of microfrontends that are used together. - `isDefaultApp` true, required - `updatedAt` number, required: Timestamp when the microfrontends settings were last updated. - object - `defaultRoute` string: A path that is used to take screenshots and as the default path in preview links when a domain for this microfrontend is shown in the UI. Includes the leading slash, e.g. `/docs` - `doNotRouteWithMicrofrontendsRouting` false | true: Whether to add microfrontends routing to aliases. This means domains in this project will route as a microfrontend. - `enabled` true, required: Whether microfrontends are enabled for this project. - `freeProjectForLegacyLimits` false | true: Whether the project was part of the legacy limits for hobby and pro-trial before billing was added. This field is only set when the team is upgraded to a paid plan and we are backfilling the subscription status. We cap the subscription to 2 projects and set this field for the 3rd project. When this field is set, the project is not charged for and we do not call any billing APIs for this project. - `groupIds` string[], required: The group IDs of microfrontends that this project belongs to. Each microfrontend project must belong to a microfrontends group that is the set of microfrontends that are used together. - `isDefaultApp` false - `routeObservabilityToThisProject` false | true: Whether observability data should be routed to this microfrontend project or a root project. - `updatedAt` number, required: Timestamp when the microfrontends settings were last updated. - object - `enabled` false, required - `freeProjectForLegacyLimits` false | true - `groupIds` unknown[], required - unknown - `updatedAt` number, required - `name` string, required - `nodeVersion` '10.x' | '12.x' | '14.x' | '16.x' | '18.x' | '20.x' | '22.x' | '24.x' | '26.x' | '8.10.x', required - `oidcTokenConfig` object - `enabled` false | true: Whether or not to generate OpenID Connect JSON Web Tokens. - `issuerMode` 'global' | 'team': - team: `https://oidc.vercel.com/[team_slug]` - global: `https://oidc.vercel.com` - `optionsAllowlist` object, nullable - `paths` object[], required - `value` string, required - `outputDirectory` string, nullable - `passiveConnectConfigurationId` string, nullable - `passport` object, nullable - `connectorId` string, required - `deploymentType` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews', required - `passwordProtection` object, nullable: Password protection settings returned without the secret password hash. - `deploymentType` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews', required - `paused` false | true - `permissions` object: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `accessGroup` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `agent` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayApiKey` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayApiKeyBypassAll` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayApiKeyOwnedBySelf` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayApiKeySpendAttribution` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayApiKeyZdrExemption` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayBudget` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayByokCredentials` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayCredits` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayGuardrails` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayPrivateModels` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayRules` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewaySettings` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayTranscripts` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayTranscriptsSettings` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayUsage` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aiGatewayVirtualModelConfigs` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `alertRules` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `alerts` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aliasGlobal` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aliasProject` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `aliasProtectionBypass` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `analytics` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `analyticsSampling` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `analyticsUsage` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `apiKey` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `apiKeyAiGateway` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `apiKeyOwnedBySelf` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `auditLog` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `automation` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingAddress` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingInformation` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingInvoice` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingInvoiceEmailRecipient` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingInvoiceLanguage` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingPlan` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingPurchaseOrder` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingRefund` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `billingTaxId` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `blob` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `blobStoreTokenSet` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `budget` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `buildMachine` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `buildMachineDefault` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `bulkRedirects` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `cacheArtifact` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `cacheArtifactUsageEvent` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `ciInvocations` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `ciLogs` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `codeChecks` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `codeOwners` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `concurrentBuilds` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connect` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connectConfiguration` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connectConfigurationLink` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connectLogs` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connexClient` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connexClientAccess` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connexClientProject` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connexContact` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connexInstallation` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `connexToken` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `cursorOriginInstallation` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `dataCacheBillingSettings` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `dataCacheNamespace` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `defaultDeploymentProtection` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deployment` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentBuildLogs` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentCheck` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentCheckPreview` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentCheckReRunFromProductionBranch` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentPolicy` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentPreview` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentPrivate` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentProductionGit` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentPromote` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentProtectionException` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentRollback` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `deploymentV0` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domain` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domainAcceptDelegation` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domainAuthCodes` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domainCertificate` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domainCheckConfig` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domainMove` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domainPurchase` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domainRecord` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `domainTransferIn` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `drain` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `edgeCacheNamespace` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `edgeConfig` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `edgeConfigItem` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `edgeConfigSchema` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `edgeConfigToken` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `emaSetup` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `endpointVerification` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `environments` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `event` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `fileUpload` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `flagsExplorerSubscription` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `gitCredentialGrant` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `githubUsage` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - `gitRepository` ACLAction[]: Requested and authorized operations when `checkPermissions` is used. Legacy `includePermissions` responses contain a broader, non-authoritative permission summary. - … truncated; see the full OpenAPI document linked below ## Other responses - `400`: One of the provided values in the request query is invalid. - `401`: The request is not authorized. - `403`: You do not have permission to access this resource. - `404` - `410` ## Changes - **2026-11-03** `60686c0e1f6a`: 2 breaking, 1 info - the response property `oneOf[subschema #3]/projects/items/rollbackDescription/userId` became optional for the status `200` - the response property `oneOf[subschema #3]/projects/items/rollbackDescription/username` became optional for the status `200` - added the optional property `oneOf[subschema #3]/projects/items/rollbackDescription/principal` to the response with the `200` status - **2026-11-02** `67be12f2c6e5`: 1 info - added the optional property `oneOf[subschema #3]/projects/items/jobs/health-check` to the response with the `200` status - **2026-11-02** `c2940ffc90cd`: 1 info - added the optional property `oneOf[subschema #3]/projects/items/permissions/schedulePreview` to the response with the `200` status - **2026-10-27** `ef8042371d97`: 1 info - added the optional property `oneOf[subschema #3]/projects/items/permissions/aiGatewayByokCredentials` to the response with the `200` status - **2026-10-27** `b84a170955a3`: 1 breaking, 1 info - added `subschema #1, subschema #2, subschema #3` to the response body `oneOf` list for the response status `200` - removed `subschema #1, subschema #2, subschema #3` from the response body `oneOf` list for the response status `200` [Operation history](https://skmtc.dev/vercel/apis/vercel-api/changes/v10/projects/get.md) --- [API](https://skmtc.dev/vercel/apis/vercel-api.md) - [All operations](https://skmtc.dev/vercel/apis/vercel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/vercel-api/revisions/60686c0e1f6a?raw)