> ## Documentation Index
> Fetch the complete documentation index at: https://docs.craftkit.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List projects

> List the authenticated account's non-deleted projects, newest-created first.



## OpenAPI

````yaml /openapi.yaml get /v1/projects
openapi: 3.1.0
info:
  title: Craftkit API
  version: 1.0.0
  description: |
    The Craftkit public REST API. Design templates with typed variables, render
    PDFs asynchronously, share and track them, and send them out for digital
    signature.

    ## Authentication

    Most endpoints authenticate with a **project API key** as a bearer token:

    ```
    Authorization: Bearer ck_live_xxxxxxxxxxxxxxxx
    ```

    Keys come in `ck_live_` (production) and `ck_test_` (test) flavours. The
    `/v1/projects*` endpoints are the one exception — they authenticate with a
    separate **account API key** (`ck_acct_…`) instead, scoped to every
    project the account owns rather than to a single project. The two
    credential types are strictly disjoint: a project key is rejected on
    `/v1/projects*` and an account key is rejected everywhere else. See
    [Authentication](/guides/authentication).

    Embed iframe surfaces use a short-lived **embed session JWT** instead, and
    the admin provisioning endpoint uses the deployment-wide
    `CRAFTKIT_ADMIN_KEY`. Inbound webhooks (`/v1/hooks/*`) are not
    bearer-authed — they are verified by an HMAC signature header.

    ## Idempotency

    `POST /v1/templates/{slug}/render` and `POST /v1/signatures` accept an
    `Idempotency-Key` request header. Retrying with the same key returns the
    original resource instead of creating (and, for signatures, billing) a
    duplicate.

    ## Errors

    Application errors use a shared envelope:

    ```json
    { "error": { "code": "invalid_request", "message": "...", "issues": { } } }
    ```

    A small number of admin/embed endpoints return a flatter shape
    (`{ "error": "invalid_credentials" }`); those are documented inline.
servers:
  - url: https://api.craftkit.dev
    description: Production
security:
  - bearerApiKey: []
tags:
  - name: Projects
    description: >-
      Account-scoped project management and per-project key minting. Every
      operation requires an account key (`ck_acct_…`) — a project key
      (`ck_live_…`) is rejected.
  - name: Templates
    description: Create, list, fetch, republish, delete templates and enqueue renders.
  - name: Renders
    description: Poll render status, download PDFs, manage shares, email, and engagement.
  - name: Signatures
    description: >-
      Send rendered PDFs out for digital signatures via the signature service
      and track status.
  - name: Webhooks
    description: Inbound webhook receivers (HMAC-authenticated, not bearer-authed).
  - name: Embed
    description: Embed session minting, catalogs, builder templates, form submission.
  - name: Admin
    description: Org provisioning (deployment admin key only).
  - name: System
    description: Health and status.
paths:
  /v1/projects:
    get:
      tags:
        - Projects
      summary: List projects
      description: >-
        List the authenticated account's non-deleted projects, newest-created
        first.
      operationId: listProjects
      responses:
        '200':
          description: The account's projects.
          content:
            application/json:
              schema:
                type: object
                required:
                  - projects
                properties:
                  projects:
                    type: array
                    items:
                      $ref: '#/components/schemas/ProjectSummary'
              example:
                projects:
                  - id: 3f9b6c2e-1a2b-4c3d-9e8f-7a6b5c4d3e2f
                    slug: acme-corp
                    name: Acme Corp
                    createdAt: '2026-06-01T09:00:00.000Z'
        '401':
          $ref: '#/components/responses/Unauthorized'
      security:
        - bearerAccountKey: []
components:
  schemas:
    ProjectSummary:
      type: object
      description: >-
        Shape returned in the GET /v1/projects list — lighter than the full
        Project.
      required:
        - id
        - slug
        - name
        - createdAt
      properties:
        id:
          type: string
          format: uuid
        slug:
          type: string
        name:
          type: string
        createdAt:
          type: string
          format: date-time
    Error:
      type: object
      description: Shared application error envelope.
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
            message:
              type: string
            issues:
              description: Optional Zod flatten() / issues detail.
      example:
        error:
          code: invalid_request
          message: Request body did not match expected shape.
  responses:
    Unauthorized:
      description: Missing or invalid bearer token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: unauthorized
              message: Missing Bearer token.
  securitySchemes:
    bearerApiKey:
      type: http
      scheme: bearer
      description: >
        Project API key (`ck_live_…` or `ck_test_…`) presented as a bearer
        token.

        For embed partner endpoints this is the partner secret key, which is the

        same credential type.
    bearerAccountKey:
      type: http
      scheme: bearer
      description: |
        Account API key (`ck_acct_…`) presented as a bearer token. Distinct
        credential system from `bearerApiKey` — validated against a separate
        table, never against project keys or vice versa. Scoped to every
        project owned by the account; used **only** by the `/v1/projects*`
        endpoints below (each of which declares this scheme explicitly and
        does not inherit the document-level `bearerApiKey` default). Minted
        from the dashboard (**Account → API keys**) — there is no
        programmatic endpoint that issues an account key.

````