Projects 2 API

المشاريع ٢ — a second, independent projects section: its own tables, permissions (projects2:*) and types. Same rules as Projects.

Two gates, two bodies (both 403): the community's page switch (settings.pageVisibility.projects2, off by default) → FEATURE_DISABLED; the plan lacks projects2 → FEATURE_NOT_AVAILABLE. Every route needs both.

Who reads what (GET / and GET /{id} accept an optional token):

• approved member → every project of the community;
• guest or signed-in non-member → only projects with isGuestVisible: true, and only when the community exposes projects to guests; otherwise an empty page / 404. A token alone is not membership.
• creator.email is removed for guests.

Who writes what:

• create: projects2:manage, projects2:create or projects2:moderate;
• edit / delete ANY project: projects2:manage, projects2:moderate or projects2:edit; the creator (createdBy) may always edit and delete their own. projects2:create alone does NOT edit other people's projects.
• assignedOwnerId (hand a project to another member) needs projects2:manage or projects2:moderate, and the target must be an APPROVED member of this community (403 PROJECT_OWNER_ASSIGN_FORBIDDEN / 400 PROJECT_OWNER_NOT_MEMBER).
• create and edit are refused to members restricted from media or suspended (403 RESTRICTION_BLOCKED), and count against the storage quota.
• communityId in the body is optional; if sent it must equal the path's (400 COMMUNITY_MISMATCH).

5 endpoints.

GET /api/communities/{communityId}/projects2

Auth: optional — a token changes what you can see (see "Who may read what").

Parameters

Responses

POST /api/communities/{communityId}/projects2

Auth: Bearer JWT required.

Parameters

Request body (required) — multipart/form-data

Type: Project2WriteForm

Responses

DELETE /api/communities/{communityId}/projects2/{id}

Auth: Bearer JWT required.

Parameters

Responses

GET /api/communities/{communityId}/projects2/{id}

Auth: optional — a token changes what you can see (see "Who may read what").

Parameters

Responses

PUT /api/communities/{communityId}/projects2/{id}

Send only the fields to change. removeLogo is refused unless a new projectLogo is uploaded; removeBanner=true clears the banner. assignedOwnerId="" gives the project back to the caller. Auth: Bearer JWT required.

Parameters

Request body — multipart/form-data

Type: object

Responses