Docs

List the teams I belong to

GET
/users/me/teams

The signed-in user's own team roster, ordered by team name.

With project_id, the teams are listed only when the session belongs to that project.

Authorization

sessionCookie
cookie__Host-zitadel_session<token>

The session cookie issued at session creation or superseding handoff exchange.

A browser holds it as __Host-zitadel_session, with Secure. Over plain http to a loopback host (localhost, 127.0.0.1, ::1) the server sets it as zitadel_session instead, without Secure or the prefix, so that Safari keeps it, and accepts that name there too; __Host-zitadel_session takes precedence. A program sends __Host-zitadel_session over any transport.

A missing or invalid cookie yields 401 with code auth.unauthorized and the message Missing or invalid session token.

Cross-site request forgery (ADR 053 §5): a state-changing request that this cookie authenticates must come from the same origin — a cross-site browser request is refused with 403 and code auth.csrf_invalid. Every such request must also send the session's token from GET /sessions/me/csrf in the X-Zitadel-CSRF header, or it answers the same 403. The only exceptions are the POST …/query reads, which need no token. Safe methods (GET) are not checked. A request a project secret authenticates is not affected.

Query Parameters

limit?integer

Maximum number of items to return.

Range1 <= value <= 100
Default20
page_token?string

Token for fetching the next page of results. Obtain this value from next_page_token in the previous response. Omit to start from the beginning. Its format is opaque and may change between releases.

project_id?string

The project the caller signs its users in to. The cookie's session is used only when it belongs to this project; a session of any other project answers 403 with sess.project_mismatch.

A session belongs to one project, while a browser sends its cookie to every app on the same host. An app passes its own project, so that a session of another project never reads or acts as one of its users, and signing out of the app never ends it. The SDKs pass it when they read the session or sign out.

sess.project_mismatch does not mean the session is invalid: it is live in its own project, so keep its cookie.

Match^[a-zA-Z0-9_-]+$

Response Body

The user's teams.

application/json
  1. response

Paginated list of the teams a user belongs to.

teams*array<>
next_page_token?|

Token to pass as page_token in the next request to fetch the following page. Absent when there are no more results.

Example Request
import { configureZitadel, getApi } from "@zitadel/api/config";// In the browser, through the SDK proxy: the session cookie authenticates the call.const client = getApi(configureZitadel({ projectId: "proj_01KWH1P4MYS7F0N9WD3P2E4YM5" }));const myTeams = await client.listMyTeams();
Example Response
{  "teams": [    {      "id": "string",      "name": "string",      "membership_status": "pending",      "created_at": "2019-08-24T14:15:22Z",      "updated_at": "2019-08-24T14:15:22Z"    }  ],  "next_page_token": "string"}

Was this helpful?