diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index 3eb5ece485d..8297d8755b7 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -1609,7 +1609,7 @@ func Routes() *web.Router {
 						Patch(reqToken(), reqRepoWriter(unit.TypeIssues, unit.TypePullRequests), bind(api.EditMilestoneOption{}), repo.EditMilestone).
 						Delete(reqToken(), reqRepoWriter(unit.TypeIssues, unit.TypePullRequests), repo.DeleteMilestone)
 				})
-			}, repoAssignment())
+			}, repoAssignment(), checkTokenPublicOnly())
 		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryIssue))
 
 		// NOTE: these are Gitea package management API - see packages.CommonRoutes and packages.DockerContainerRoutes for endpoints that implement package manager APIs
@@ -1700,6 +1700,7 @@ func Routes() *web.Router {
 
 			m.Group("/projects", func() {
 				m.Post("", bind(api.NewProjectOption{}), projects.CreateOrgProject)
+				m.Get("", projects.ListOrgProjects)
 			})
 		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(true), checkTokenPublicOnly())
 		m.Group("/teams/{teamid}", func() {