Project API

Project API

Create project scopes, manage region admission, and submit ownership-transfer bundles.

The Project API manages workload ownership scopes within an organization. Organization access is required even when the caller also holds a project role.

Create a project

POST/organizations/{organization_id}/projects
Scope
projects:write
Auth
Bearer API key
Repeat calls
Repeat the identical request with its Idempotency-Key.

Creates a project ownership and admission scope.

Project definition
namestringrequired
Display name after surrounding whitespace is trimmed.
rule1–128 characters
owner_team_idstringrequired
Existing organization team responsible for this project.
allowed_region_idsstring[]required
Explicit permitted region IDs. An empty array creates a project with no region admission.
labelsobjectoptional
String-pair allocation and ownership labels.
default{}

Returns 201 with data.id, revision, name, owner_team_id, and effective region admission. Creation records project metadata; it does not reserve physical capacity or create network resources. An unknown team or forbidden region returns 422 invalid_reference or policy_violation before creation.

Read and change admission

GET/organizations/{organization_id}/projects/{project_id}
Scope
projects:read
Auth
Bearer API key

Returns project configuration and its ETag.

Requires projects:read and returns the configuration ETag.

GET/organizations/{organization_id}/projects
Scope
projects:read
Auth
Bearer API key

Lists projects visible within the organization.

List the organization collection with standard pagination; visibility follows the caller's bindings.

PATCH/organizations/{organization_id}/projects/{project_id}
Scope
projects:write
Auth
Bearer API key

Updates project metadata and admission configuration.

Requires projects:write and If-Match. Writable fields are name, owner_team_id, allowed_region_ids, labels, and admission_enabled. Omission preserves a field. Arrays and label objects replace their whole stored value; null is invalid. admission_enabled defaults to true at creation.

Removing a region prevents new placements but leaves existing resources managed. Setting admission to false prevents new project allocations; it does not stop guests, waive charges, or prohibit required cleanup.

Preview a transfer

POST/organizations/{organization_id}/projects/{project_id}/transfer-plans
Scope
projects:write
Auth
Bearer API key

Creates a transfer preview with the resolved dependency bundle.

Accepts destination_project_id and a nonempty resource_ids array. It requires transfer permission in both projects. The response is 201 with the resolved dependency bundle, blockers, source revisions, and a plan ID.

A preview does not change ownership. Shared dependencies outside the selected bundle appear as blockers rather than being silently copied.

POST/organizations/{organization_id}/projects/{project_id}/transfer-plans/{plan_id}/apply
Scope
projects:write
Auth
Bearer API key

Applies a reviewed project-resource transfer plan.

Requires the transfer plan's ETag in If-Match and an idempotency key. Accepted execution returns 202 and a parent operation. Changed dependencies return 412 plan_stale. Destination quota or policy failures return 422.

Delete

DELETE/organizations/{organization_id}/projects/{project_id}
Scope
projects:write
Auth
Bearer API key

Deletes an empty project. Requires projects:write and its current If-Match. A nonempty project returns 409 project_not_empty with blocking resource classes. Active transfer plans and retention-locked data can also block removal.

A successful metadata deletion returns 204. Historical audit records retain the project ID. Use resource transfer for side effects, quotas for allocation limits, and API conventions for errors.