Only for role=user — which projects they can query via API.