List the projects I can act on
The projects the signed-in user can act on: those they hold an active grant on, either directly or through a team they are a member of. For a platform operator (ADR 075) that is every project of the deployment. Ordered by project id and paged with an opaque cursor.
This is not the same question as queryProjects, which answers with the one
project the calling credential is bound to. Here the session is the caller
and the grants are the answer, so the list spans projects.
With name_contains, only the projects whose name contains that text are
listed. The search runs on the server together with the grants, so it
reaches every project the user can act on, however many there are, and
pages like the full list.
With project_id, the projects are listed only when the session belongs to
that project. It names the project the session was signed in to, not one to
list.
sessionCookie__Host-zitadel_session<token>The session cookie issued at session creation or superseding handoff exchange.
A browser holds it as __Host-zitadel_session, with Secure. Over plain
http to a loopback host (localhost, 127.0.0.1, ::1) the server sets it
as zitadel_session instead, without Secure or the prefix, so that Safari
keeps it, and accepts that name there too; __Host-zitadel_session takes
precedence. A program sends __Host-zitadel_session over any transport.
A missing or invalid cookie yields 401 with code auth.unauthorized and the message
Missing or invalid session token.
Cross-site request forgery (ADR 053 §5): a state-changing request that this
cookie authenticates must come from the same origin — a cross-site browser
request is refused with 403 and code auth.csrf_invalid. Every such
request must also send the session's token from GET /sessions/me/csrf in the
X-Zitadel-CSRF header, or it answers the same 403. The only exceptions are
the POST …/query reads, which need no token. Safe methods (GET) are not checked. A request a project secret
authenticates is not affected.
limit?integerMaximum number of items to return.
1 <= value <= 10020page_token?stringToken for fetching the next page of results.
Obtain this value from next_page_token in the previous response.
Omit to start from the beginning.
Its format is opaque and may change between releases.
name_contains?stringNarrows the list to the projects whose name contains this text,
ignoring case, as contains matches text in a query endpoint's
filter. Send the same value with every page_token the search
returns: a token continues the list it came from. An empty value
lists every project, as leaving it out does.
project_id?stringThe project the caller signs its users in to. The cookie's session is used
only when it belongs to this project; a session of any other project answers
403 with sess.project_mismatch.
A session belongs to one project, while a browser sends its cookie to every app on the same host. An app passes its own project, so that a session of another project never reads or acts as one of its users, and signing out of the app never ends it. The SDKs pass it when they read the session or sign out.
sess.project_mismatch does not mean the session is invalid: it is live in
its own project, so keep its cookie.
^[a-zA-Z0-9_-]+$The projects the session user can act on.
application/json- response
Paginated list of projects, ordered by project id.
projects*array<>next_page_token?|Token to pass as page_token in the next request to fetch the following page.
Present when the page was full. A following request may return an empty page
and no token, which ends the listing.
import { configureZitadel, getApi } from "@zitadel/api/config";// In the browser, through the SDK proxy: the session cookie authenticates the call.const client = getApi(configureZitadel({ projectId: "proj_01KWH1P4MYS7F0N9WD3P2E4YM5" }));const myProjects = await client.listMyProjects({ name_contains: "acme" });{ "projects": [ { "id": "string", "name": "string", "origins": [ { "pattern": "string", "kind": "primary" } ], "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z", "password_hash": { "algorithm": "argon2i", "params": { "time": 0, "memory": 0, "threads": 0, "cost": 0, "rounds": 0, "hash": "sha1" } } } ], "next_page_token": "string"}Was this helpful?