diff --git a/api.rst b/api.rst
index e9e3d86..4f42b97 100644
--- a/api.rst
+++ b/api.rst
@@ -5,6 +5,7 @@
 - POST   /api/projects                              -- create a new project
 * GET    /api/project/<proj-id>                     -- return detailed project record (include steps)
 - GET    /api/project/<proj-id>/active              -- return detailed information about all currently running runs
+✓ GET    /api/project/<proj-id>/versions            -- list the versions of this project that have been built
 - GET    /api/project/<proj-id>/<step-id>           -- return detailed step information (include runs)
 * POST   /api/project/<proj-id>/<step-id>/run/<ref> -- kick off a run
 - GET    /api/project/<proj-id>/<step-id>/run/<ref> -- return detailed run information
diff --git a/src/main/nim/strawbosspkg/server.nim b/src/main/nim/strawbosspkg/server.nim
index 8d4fe1f..1f8deab 100644
--- a/src/main/nim/strawbosspkg/server.nim
+++ b/src/main/nim/strawbosspkg/server.nim
@@ -162,6 +162,26 @@ proc start*(cfg: StrawBossConfig): void =
 
       resp(Http501, makeJsonResp(Http501), JSON)
 
+    get "/project/@projectName/versions":
+      ## Get a list of all versions that we have built
+
+      checkAuth(); if not authed: return true
+
+      # Make sure we know about that project
+      var project: ProjectDef
+      try: project = cfg.findProject(@"projectName")
+      except: resp(Http404, makeJsonResp(Http404, getCurrentExceptionMsg()), JSON)
+
+      var versions: seq[string] = @[]
+      for cfgFilePath in walkFiles(cfg.artifactsRepo & "/" & project.name & "/configuration.*.json"):
+        let vstart = cfgFilePath.rfind("/configuration.") + 15
+        versions.add(cfgFilePath[vstart..^6])
+
+      if versions.len == 0:
+        resp(Http404, makeJsonResp(Http404, "I have not built any versions of " & project.name), JSON)
+
+      resp($(%(versions)), JSON)
+
     get "/project/@projectName/@version?":
       ## Get a detailed project record including step definitions (ProjectConfig).
 
@@ -185,7 +205,7 @@ proc start*(cfg: StrawBossConfig): void =
 
       # No version requested, use "latest"
       else:
-        let confFilePaths = toSeq(walkFiles("configuration.*.json"))
+        let confFilePaths = toSeq(walkFiles(cfg.artifactsRepo & "/" & project.name & "/configuration.*.json"))
         if confFilePaths.len == 0:
           resp(Http404, makeJsonResp(Http404, "I have not built any versions of " & project.name), JSON)
         let modTimes = confFilePaths.mapIt(it.getLastModificationTime)
diff --git a/src/test/nim/tserver.nim b/src/test/nim/tserver.nim
index 450cffe..e626473 100644
--- a/src/test/nim/tserver.nim
+++ b/src/test/nim/tserver.nim
@@ -123,5 +123,31 @@ suite "strawboss server continued":
 
   test "handle missing project configuration":
     let http = newAuthenticatedHttpClient(apibase, "bob@builder.com", "password")
-    let resp = http.get(apiBase & "/projects/test-project-1")
+    let resp = http.get(apiBase & "/projects/" & cfg.projects[0].name)
     check resp.status.startsWith("404")
+
+  test "gives 404 when no versions built":
+    let http = newAuthenticatedHttpClient(apibase, "bob@builder.com", "password")
+    let resp = http.get(apiBase & "/projects/" & cfg.projects[0].name & "/versions")
+    check resp.status.startsWith("404")
+
+  test "GET /api/project/@projectName/versions":
+    let projArtifactsDir = tmpArtifactsDir & "/" & cfg.projects[0].name
+    let expectedVersions = @["alpha", "beta", "1.0.0", "1.0.1"]
+
+    # Touch configuration files
+    createDir(projArtifactsDir)
+    for v in expectedVersions:
+      var f: File
+      check open(f, projArtifactsDir & "/configuration." & v & ".json", fmWrite)
+      close(f)
+
+    let http = newAuthenticatedHttpClient(apibase, "bob@builder.com", "password")
+    let resp = http.get(apiBase & "/project/" & cfg.projects[0].name & "/versions")
+    let returnedVersions = parseJson(resp.body).getElems.mapIt(it.getStr)
+    check sameContents(expectedVersions, returnedVersions)
+
+  # Last-chance catch to kill the server in case some test err'ed and didn't
+  # reach it's teardown handler
+  discard newAsyncHttpClient().post(apiBase & "/service/debug/stop")
+