diff --git a/backend/app/api/v1/projects.py b/backend/app/api/v1/projects.py
new file mode 100644
index 0000000..a22ed3a
--- /dev/null
+++ b/backend/app/api/v1/projects.py
@@ -0,0 +1,76 @@
+"""Project endpoints."""
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlalchemy.orm import Session
+from typing import List, Optional
+from app.database import get_db
+from app.schemas.project import ProjectCreate, ProjectUpdate, ProjectResponse, ProjectStats
+from app.services.project_service import ProjectService
+from app.api.deps import get_current_user, get_tenant_id, require_roles
+from app.core.permissions import Role
+from app.models.user import User
+
+router = APIRouter(prefix="/projects")
+
+
+@router.get("", response_model=List[ProjectResponse])
+def list_projects(
+    status: Optional[str] = None,
+    skip: int = 0, limit: int = 100,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    return ProjectService.list_projects(db, user.tenant_id, status, skip, limit)
+
+
+@router.post("", response_model=ProjectResponse)
+def create_project(
+    req: ProjectCreate,
+    user: User = Depends(require_roles(Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER)),
+    db: Session = Depends(get_db),
+):
+    return ProjectService.create_project(db, user.tenant_id, user.id, req)
+
+
+@router.get("/{project_id}", response_model=ProjectResponse)
+def get_project(
+    project_id: int,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    p = ProjectService.get_project(db, user.tenant_id, project_id)
+    if not p:
+        raise HTTPException(status_code=404, detail="Project not found")
+    return p
+
+
+@router.put("/{project_id}", response_model=ProjectResponse)
+def update_project(
+    project_id: int,
+    req: ProjectUpdate,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    try:
+        return ProjectService.update_project(db, user.tenant_id, project_id, req)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+
+
+@router.delete("/{project_id}")
+def delete_project(
+    project_id: int,
+    user: User = Depends(require_roles(Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER)),
+    db: Session = Depends(get_db),
+):
+    if ProjectService.delete_project(db, user.tenant_id, project_id):
+        return {"success": True, "message": f"Project #{project_id} deleted"}
+    raise HTTPException(status_code=404, detail="Project not found")
+
+
+@router.get("/{project_id}/stats", response_model=ProjectStats)
+def get_project_stats(
+    project_id: int,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    return ProjectService.get_stats(db, user.tenant_id, project_id)