Access requests API
Enable programmatic approval, denial, and revocation of access, enabling seamless integration with internal tools, bots, and security workflows for automated access escalation.
The Access Request API enables programmatic approval, denial, and revocation of access requests within the P0 platform. It is designed to support custom workflows and automation. Integrate with external systems and services to process access grants without using the P0 user interface.
This is particularly useful for integrating P0 into your internal tooling, bots, or security workflows that require automatic access escalation based on alerts, CI/CD pipelines, or external approvals.
Approves a pending access request, after which P0 provisions the access. The optional body overrides the grant duration.
The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.
The ID of the access request, as returned by the Command API when the request was created.
A P0 duration to grant instead of the requested one, for example 30m, 2h, or 1d.
2hSet to true when expirationLength is not one of the organization's preset expiry options.
The request was approved.
SuccessThe caller could not be authenticated.
The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.
No access request exists with this ID in this organization.
POST /o/{orgId}/permission-requests/{requestId}/approve HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 47
{
"expirationLength": "2h",
"isCustomExpiry": true
}{
"message": "Success"
}Denies a pending access request. Denial cannot be undone — the requestor must submit a new request.
The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.
The ID of the access request, as returned by the Command API when the request was created.
The request was denied.
SuccessThe caller could not be authenticated.
The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.
No access request exists with this ID in this organization.
POST /o/{orgId}/permission-requests/{requestId}/deny HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"message": "Success"
}Revokes an active grant before it expires. P0 automatically revokes access at expiry, so this is only needed to end a grant early. Revocation cannot be undone — the requestor must submit a new request to restore access.
The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.
The ID of the access request, as returned by the Command API when the request was created.
The grant was revoked.
SuccessThe caller could not be authenticated.
The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.
No access request exists with this ID in this organization.
POST /o/{orgId}/permission-requests/{requestId}/revoke HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"message": "Success"
}Last updated