> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/access-management/access-management/just-in-time-access/just-in-time-api.md).

# Just-in-time API

P0’s Just-In-Time APIs enable secure, automated access provisioning with fine-grained control. These APIs are purpose-built for modern DevOps and security teams who need to grant ephemeral access based on intent, not static policies.

**Key API Groups:**

* [Command API](/access-management/access-management/just-in-time-access/just-in-time-api/command-api.md): Submit actionable commands that trigger access workflows, such as requesting temporary AWS roles or starting pre-approved tasks. Ideal for CLI or bot-driven automation.
* [Access requests API](/access-management/access-management/just-in-time-access/just-in-time-api/access-requests-api.md): Programmatically approve, deny, or revoke access requests with full context. These APIs allow security teams and automated systems to control access lifecycles in real time.

To manage the policies that decide how these requests get approved, see the [Access policies API](/policy-studio/policy-studio/access-policies-api.md) in Policy Studio.

All endpoints are protected with bearer tokens and designed for high-trust, auditable interactions.

For a step-by-step walkthrough of creating, checking, approving, and revoking a request in code, see [Automate access requests with the API](/p0-api/automate-access-requests-with-the-api.md). For a map of all P0 APIs and the authentication they share, see the [P0 API overview](/p0-api/p0-api-overview.md).

## JIT Settings in P0 Management

P0 Management provides a user-friendly interface to configure key Just-in-time (JIT) access settings: **custom expiry**, **approvable duration**, **max access duration**, and **standing access duration**. These settings define the lifetime and conditions of temporary access for users. Admins can configure these parameters directly within the app, allowing for granular control over access privileges in line with least-privilege principles and audit requirements. By tailoring these durations in the UI, organizations can automate and standardize just-in-time access workflows without leaving the P0 platform.

### Impact on User Access and Permissions

When set on the P0 Management page, these settings directly influence how users request and receive access within the app:

* **Custom Expiry**
  * Admins can define multiple custom expiry presets (e.g., 30 minutes, 2 hours, 1 day).
  * When users request access, these presets appear as selectable options in the access request UI, allowing requestors or approvers to choose the most appropriate duration for the use case.
  * This streamlines access requests, promotes consistency, and reduces the risk of over-permissioning.
* **Approvable Duration**
  * Defines the window of time within which an access request must be approved. Requests that remain pending beyond this duration are automatically timed out.
  * Admins can configure this setting directly from the P0 Management page. The default is 14 days.
  * This prevents stale requests from lingering indefinitely, ensuring that unapproved requests are cleaned up automatically.
* **Max Access Duration**
  * Sets the upper limit for how long any single access grant can last, regardless of the preset or custom request.
  * The UI enforces this limit, preventing users or approvers from granting access that exceeds the configured maximum.
  * This ensures no temporary access persists longer than governance policies allow.
* **Standing Access Duration**
  * Sets the default and the maximum duration for standing access — access granted without a human approver, through always-allow and auto-approve (on-call) rules.
  * Standing access can't exceed this duration, and the duration itself can't exceed the max access duration. The default is 24 hours.
  * Admins can configure it directly from the P0 Management page, supporting dynamic permissioning and minimizing standing privileges.

<figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2Fgit-blob-26eeb5a743d6d71b68be49d19abd414e2a8bd399%2FJIT-Settings-in-P0-Management.png?alt=media" alt="P0 Management Just-in-time settings page showing expiry duration options, maximum access duration, and standing access duration configuration" width="560"><figcaption></figcaption></figure>

These controls allow admins to tailor access durations directly in the app, streamlining workflows and supporting least-privilege principles. For more details, see the [Just-in-time settings API](/p0-management/management-api/just-in-time-settings-api.md).

You can also configure these settings as code with the [P0 Terraform provider](https://registry.terraform.io/providers/p0-security/p0/latest/docs) (version `0.50.0` or later):

* Use [`p0_access_durations`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/access_durations) to set the approvable, max access, and standing access durations.
* Use [`p0_expiry_options`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/expiry_options) to define the custom expiry presets requestors can select.