> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/argoproj/argo-cd/llms.txt
> Use this file to discover all available pages before exploring further.

# AppProject API

> Project management, RBAC policies, and access control for Argo CD

## Overview

The Project Service API manages AppProject resources, which provide logical grouping and access control for Applications. Projects define where apps can deploy, what can be deployed, and who can access them.

**Base Path:** `/api/v1/projects`

**gRPC Service:** `project.ProjectService`

## AppProject Resource

An AppProject provides multi-tenancy and RBAC controls for Applications.

### AppProject Spec

<ParamField path="sourceRepos" type="string[]" required>
  Allowed source repositories (supports wildcards)

  ```yaml theme={null}
  sourceRepos:
  - 'https://github.com/myorg/*'
  - 'https://helm.example.com'
  ```
</ParamField>

<ParamField path="destinations" type="ApplicationDestination[]" required>
  Allowed deployment destinations

  <Expandable title="ApplicationDestination fields">
    <ResponseField name="server" type="string">
      Kubernetes server URL (supports wildcards)
    </ResponseField>

    <ResponseField name="name" type="string">
      Cluster name (alternative to server)
    </ResponseField>

    <ResponseField name="namespace" type="string">
      Target namespace (supports wildcards)
    </ResponseField>
  </Expandable>
</ParamField>

<ParamField path="clusterResourceWhitelist" type="ResourceSelector[]">
  Allowed cluster-scoped resources

  <Expandable title="ResourceSelector fields">
    <ResponseField name="group" type="string">
      API group (empty for core)
    </ResponseField>

    <ResponseField name="kind" type="string">
      Resource kind
    </ResponseField>
  </Expandable>
</ParamField>

<ParamField path="clusterResourceBlacklist" type="ResourceSelector[]">
  Denied cluster-scoped resources
</ParamField>

<ParamField path="namespaceResourceWhitelist" type="ResourceSelector[]">
  Allowed namespace-scoped resources
</ParamField>

<ParamField path="namespaceResourceBlacklist" type="ResourceSelector[]">
  Denied namespace-scoped resources
</ParamField>

<ParamField path="roles" type="ProjectRole[]">
  RBAC roles for the project

  <Expandable title="ProjectRole fields">
    <ResponseField name="name" type="string" required>
      Role name
    </ResponseField>

    <ResponseField name="description" type="string">
      Role description
    </ResponseField>

    <ResponseField name="policies" type="string[]" required>
      RBAC policies (Casbin format)
    </ResponseField>

    <ResponseField name="groups" type="string[]">
      SSO groups bound to this role
    </ResponseField>

    <ResponseField name="jwtTokens" type="JWTToken[]">
      JWT tokens for automation
    </ResponseField>
  </Expandable>
</ParamField>

<ParamField path="syncWindows" type="SyncWindow[]">
  Time windows for controlling sync operations
</ParamField>

<ParamField path="sourceNamespaces" type="string[]">
  Namespaces where Applications can be created
</ParamField>

### Example AppProject

```yaml theme={null}
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: production
  namespace: argocd
spec:
  description: Production applications
  
  # Allowed sources
  sourceRepos:
  - 'https://github.com/myorg/*'
  - 'https://charts.helm.sh/stable'
  
  # Allowed destinations
  destinations:
  - namespace: 'prod-*'
    server: https://kubernetes.default.svc
  - namespace: production
    server: 'https://prod-*.example.com'
  
  # Cluster resources
  clusterResourceWhitelist:
  - group: ''
    kind: Namespace
  
  # Namespace resources  
  namespaceResourceBlacklist:
  - group: ''
    kind: ResourceQuota
  
  # Roles
  roles:
  - name: ci-role
    description: CI/CD automation
    policies:
    - p, proj:production:ci-role, applications, sync, production/*, allow
    - p, proj:production:ci-role, applications, get, production/*, allow
  
  - name: developer
    description: Developer access
    policies:
    - p, proj:production:developer, applications, get, production/*, allow
    groups:
    - myorg:developers
```

## API Operations

### List Projects

Retrieve list of projects.

```bash theme={null}
GET /api/v1/projects
```

<CodeGroup>
  ```bash cURL theme={null}
  curl https://argocd-server/api/v1/projects \
    -H "Authorization: Bearer $TOKEN"
  ```

  ```go Go theme={null}
  import projectpkg "github.com/argoproj/argo-cd/v3/pkg/apiclient/project"

  projectClient := projectpkg.NewProjectServiceClient(conn)
  projects, err := projectClient.List(ctx, &projectpkg.ProjectQuery{})
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://argocd-server/api/v1/projects",
      headers={"Authorization": f"Bearer {token}"}
  )
  projects = response.json()
  ```
</CodeGroup>

### Get Project

Retrieve a specific project.

```bash theme={null}
GET /api/v1/projects/{name}
```

<ParamField path="name" type="string" required>
  Project name
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl https://argocd-server/api/v1/projects/production \
    -H "Authorization: Bearer $TOKEN"
  ```

  ```go Go theme={null}
  project, err := projectClient.Get(ctx, &projectpkg.ProjectQuery{
      Name: "production",
  })
  ```
</CodeGroup>

### Get Detailed Project

Get project with global projects and scoped resources.

```bash theme={null}
GET /api/v1/projects/{name}/detailed
```

<ParamField path="name" type="string" required>
  Project name
</ParamField>

**Response includes:**

* Project definition
* Global projects
* Scoped repositories
* Scoped clusters

### Create Project

Create a new project.

```bash theme={null}
POST /api/v1/projects
```

<ParamField body="project" type="AppProject" required>
  Complete AppProject resource
</ParamField>

<ParamField body="upsert" type="boolean">
  Update if already exists (default: false)
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://argocd-server/api/v1/projects \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "project": {
        "metadata": {
          "name": "production"
        },
        "spec": {
          "description": "Production applications",
          "sourceRepos": ["*"],
          "destinations": [
            {
              "namespace": "*",
              "server": "https://kubernetes.default.svc"
            }
          ],
          "clusterResourceWhitelist": [
            {"group": "", "kind": "Namespace"}
          ]
        }
      }
    }'
  ```

  ```go Go theme={null}
  project, err := projectClient.Create(ctx, &projectpkg.ProjectCreateRequest{
      Project: &v1alpha1.AppProject{
          ObjectMeta: metav1.ObjectMeta{
              Name: "production",
          },
          Spec: v1alpha1.AppProjectSpec{
              SourceRepos: []string{"*"},
              Destinations: []v1alpha1.ApplicationDestination{
                  {
                      Server:    "https://kubernetes.default.svc",
                      Namespace: "*",
                  },
              },
          },
      },
  })
  ```

  ```yaml YAML (via kubectl) theme={null}
  kubectl apply -f - <<EOF
  apiVersion: argoproj.io/v1alpha1
  kind: AppProject
  metadata:
    name: production
    namespace: argocd
  spec:
    description: Production applications
    sourceRepos:
    - '*'
    destinations:
    - namespace: '*'
      server: https://kubernetes.default.svc
  EOF
  ```
</CodeGroup>

### Update Project

Update an existing project.

```bash theme={null}
PUT /api/v1/projects/{project.metadata.name}
```

<ParamField body="project" type="AppProject" required>
  Updated AppProject resource
</ParamField>

### Delete Project

Delete a project.

```bash theme={null}
DELETE /api/v1/projects/{name}
```

<ParamField path="name" type="string" required>
  Project name
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X DELETE https://argocd-server/api/v1/projects/production \
    -H "Authorization: Bearer $TOKEN"
  ```

  ```go Go theme={null}
  _, err := projectClient.Delete(ctx, &projectpkg.ProjectQuery{
      Name: "production",
  })
  ```
</CodeGroup>

## Token Management

### Create Project Token

Generate a JWT token for a project role.

```bash theme={null}
POST /api/v1/projects/{project}/roles/{role}/token
```

<ParamField path="project" type="string" required>
  Project name
</ParamField>

<ParamField path="role" type="string" required>
  Role name
</ParamField>

<ParamField body="description" type="string">
  Token description
</ParamField>

<ParamField body="expiresIn" type="int64">
  Token lifetime in seconds (0 = no expiration)
</ParamField>

<ParamField body="id" type="string">
  Custom token identifier
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://argocd-server/api/v1/projects/production/roles/ci-role/token \
    -H "Authorization: Bearer $TOKEN" \
    -d '{
      "description": "CI Pipeline Token",
      "expiresIn": 2592000
    }'
  ```

  ```go Go theme={null}
  tokenResp, err := projectClient.CreateToken(ctx, &projectpkg.ProjectTokenCreateRequest{
      Project:     "production",
      Role:        "ci-role",
      Description: "CI Pipeline Token",
      ExpiresIn:   2592000, // 30 days
  })
  token := tokenResp.Token
  ```
</CodeGroup>

**Response:**

```json theme={null}
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

### Delete Project Token

Revoke a project token.

```bash theme={null}
DELETE /api/v1/projects/{project}/roles/{role}/token/{iat}
```

<ParamField path="project" type="string" required>
  Project name
</ParamField>

<ParamField path="role" type="string" required>
  Role name
</ParamField>

<ParamField path="iat" type="int64" required>
  Token issued-at timestamp
</ParamField>

<ParamField query="id" type="string">
  Token ID (alternative to iat)
</ParamField>

## RBAC Policies

Project roles use Casbin policy syntax:

```
p, <subject>, <resource>, <action>, <object>, <effect>
```

### Policy Components

* **subject**: `proj:<project>:<role>`
* **resource**: `applications`, `clusters`, `repositories`, etc.
* **action**: `get`, `create`, `update`, `delete`, `sync`, `override`, `action/*`
* **object**: `<project>/<application>` or `<project>/*`
* **effect**: `allow` or `deny`

### Policy Examples

```yaml theme={null}
roles:
- name: ci-role
  policies:
  # Allow sync on all apps in project
  - p, proj:production:ci-role, applications, sync, production/*, allow
  
  # Allow get on all apps
  - p, proj:production:ci-role, applications, get, production/*, allow
  
  # Deny delete operations
  - p, proj:production:ci-role, applications, delete, production/*, deny

- name: admin
  policies:
  # Full access to project
  - p, proj:production:admin, applications, *, production/*, allow
  - p, proj:production:admin, repositories, *, production/*, allow
  - p, proj:production:admin, clusters, get, *, allow
```

## Sync Windows

Control when applications can be synced.

### Get Sync Windows

Get active and assigned sync windows for a project.

```bash theme={null}
GET /api/v1/projects/{name}/syncwindows
```

<ParamField path="name" type="string" required>
  Project name
</ParamField>

**Response:**

```json theme={null}
{
  "windows": [
    {
      "kind": "allow",
      "schedule": "0 22 * * *",
      "duration": "1h",
      "applications": ["*"],
      "manualSync": true
    }
  ]
}
```

### Sync Window Configuration

```yaml theme={null}
syncWindows:
- kind: allow
  schedule: '0 22 * * *'  # 10 PM daily
  duration: 1h
  applications:
  - '*'
  manualSync: true
  
- kind: deny
  schedule: '0 0 * * 0'   # Sunday midnight
  duration: 24h
  applications:
  - 'production-*'
  manualSync: false
```

## Events & Monitoring

### List Project Events

Get Kubernetes events for a project.

```bash theme={null}
GET /api/v1/projects/{name}/events
```

<ParamField path="name" type="string" required>
  Project name
</ParamField>

### List Project Links

Get deep links configured for the project.

```bash theme={null}
GET /api/v1/projects/{name}/links
```

## Global Projects

Global projects provide shared configuration.

### Get Global Projects

Get global projects for a project.

```bash theme={null}
GET /api/v1/projects/{name}/globalprojects
```

<ParamField path="name" type="string" required>
  Project name
</ParamField>

## Resource Restrictions

### Allow All Resources

```yaml theme={null}
clusterResourceWhitelist:
- group: '*'
  kind: '*'
```

### Specific Resource Types

```yaml theme={null}
namespaceResourceWhitelist:
- group: 'apps'
  kind: Deployment
- group: ''
  kind: Service
- group: ''
  kind: ConfigMap
```

### Deny Specific Resources

```yaml theme={null}
namespaceResourceBlacklist:
- group: ''
  kind: ResourceQuota
- group: ''
  kind: LimitRange
```

## Wildcard Patterns

### Source Repositories

```yaml theme={null}
sourceRepos:
- 'https://github.com/myorg/*'        # All repos in org
- 'https://github.com/myorg/app-*'    # Repos starting with app-
- '*'                                  # All repositories
```

### Destinations

```yaml theme={null}
destinations:
- namespace: 'prod-*'                 # Namespaces starting with prod-
  server: 'https://kubernetes.default.svc'
- namespace: '*'
  server: 'https://prod-*.example.com' # Cluster URLs matching pattern
```

## Next Steps

<CardGroup cols={2}>
  <Card title="Application API" icon="rocket" href="/api/application">
    Create applications in projects
  </Card>

  <Card title="Cluster API" icon="server" href="/api/cluster">
    Configure destination clusters
  </Card>

  <Card title="Repository API" icon="code-branch" href="/api/repository">
    Configure source repositories
  </Card>
</CardGroup>