Reverse engineering the API as per How to reverse engineer the Sonar Web API
I find that the user interface (which is obviously capable of listing projects without admin privileges) uses /api/components/search_projects
which does what I need.
This is not documented here - https://sonarcloud.io/web_api/api/projects?deprecated=false
A useful parameter is ‘filter’:
&filter=isFavorite%and%20query%20%3D%20%22sometext%22