Command API

Enable external systems to programmatically initiate access requests, enabling automation and integration with internal tools, bots, and security workflows.

The Command API enables programmatic creation of access requests within the P0 platform. It is designed to support custom workflows and automation. Integrate with external systems and services to initiate access grants without using the P0 user interface.

This is particularly useful for integrating P0 into your internal tooling, bots, or security workflows that require automatic access escalation based on alerts, CI/CD pipelines, or external approvals.

commands-api.yaml

4KB

Open

Create an access request

post

Runs a P0 command for the authenticated identity. The request runs through your organization's access policies, guardrails, and audit trail exactly as a request made in the P0 dashboard or CLI does.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

orgIdstringRequired

The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.

Body

argvstring[]Required

The command arguments, matching the p0 request CLI command with the leading p0 removed. Each flag and its value are separate array elements, for example ["request", "aws", "role", "MyReadOnlyRole", "--account", "123456789012", "--reason", "..."].

scriptNamestringRequired

The client name to record for the invocation. Use p0.

Example: p0

waitbooleanOptional

When true, the response streams newline-delimited JSON status updates over the open connection until the request is approved, denied, or errors, instead of returning once the request is created. For one-shot status checks in automation, prefer polling GET /o/{orgId}/permission-requests/{requestId} from the Access Requests API.

Responses

200

The command ran. For request commands the body confirms the created access request and returns its ID.

application/json

okbooleanOptionalExample: true

idstringOptional

The ID of the created access request. Use it with the Access Requests API to check status, approve, deny, or revoke.

messagestringOptional

A human-readable confirmation, including a link to the request details page.

isPreexistingbooleanOptional

Whether an equivalent request or grant already existed.

requestobjectOptional

The created access request document.

400

The request body is invalid, for example argv is missing or is not an array of strings.

application/json

401

The caller could not be authenticated.

application/json

408

The command did not complete before the server's timeout.

post/o/{orgId}/command

POST /o/{orgId}/command HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 47

{
  "argv": [
    "text"
  ],
  "scriptName": "p0",
  "wait": true
}

{
  "ok": true,
  "id": "text",
  "message": "text",
  "isPreexisting": true,
  "request": {}
}