Skip to main content
Projects are the primary data isolation boundary in CDF. All objects in CDF belong to a single project, and objects in different projects are isolated from each other. Every CDF API request targets a specific project through the URL path /api/v1/projects/{project}/....

​
Projects and organizations

Projects belong to an organization. When you create a project, you assign it to one of the organization’s allowed clusters. The project inherits the organization’s OIDC configuration for authentication.
A project cannot be moved to a different cluster after creation.

​
Access control

Access within a project is managed through groups and capabilities. When creating a project, you can specify a projectAdminGroupId to designate which IdP group has admin access. If you don’t specify one, the project inherits the organization’s admin group.

​
Create a project

The cluster you choose must be in the organization’s allowed clusters. You cannot move the project later. The project copies OIDC configuration from its parent organization. Set projectAdminGroupId to an identity provider group. If you omit it, the project uses the organization’s admin group. You must be an admin of the organization or of an ancestor, and adminsCanCreateProjectsInSubtree must be true on that organization. The project can be used for sign-in as soon as it is created.

​
List projects

Any member of the organization can list its projects. Set includeAdminProperties to true only if you are an admin of the organization or of an ancestor.

​
Key capabilities

  • Create projects within an organization on a specified cluster
  • List projects in an organization
  • Configure OIDC settings inherited from the parent organization
  • Assign project admin groups to control administrative access
Last modified on November 2, 2026