> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/access-management/just-in-time-access/just-in-time-api/access-requests-api.md).

# Access requests API

The Access Request API enables programmatic approval, denial, and revocation of access requests within the P0 platform. It is designed to support custom workflows and automation. Integrate with external systems and services to process access grants without using the P0 user interface.

This is particularly useful for integrating P0 into your internal tooling, bots, or security workflows that require automatic access escalation based on alerts, CI/CD pipelines, or external approvals.

{% file src="/files/rSAVbzaUZ2nSPwiFXWkD" %}

## Approve an access request

> Approves a pending access request, after which P0 provisions the access. The optional body overrides the grant duration.

```json
{"openapi":"3.0.4","info":{"title":"P0 Access Requests API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"parameters":{"OrgId":{"name":"orgId","in":"path","required":true,"description":"The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.","schema":{"type":"string"}},"RequestId":{"name":"requestId","in":"path","required":true,"description":"The ID of the access request, as returned by the Command API when the request was created.","schema":{"type":"string"}}},"schemas":{"ActionSuccess":{"type":"object","properties":{"message":{"type":"string"}}},"Error":{"type":"object","properties":{"error":{"type":"string","description":"A human-readable description of the failure."}}}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ForbiddenError":{"description":"The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFoundError":{"description":"No access request exists with this ID in this organization.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/o/{orgId}/permission-requests/{requestId}/approve":{"post":{"summary":"Approve an access request","description":"Approves a pending access request, after which P0 provisions the access. The optional body overrides the grant duration.","parameters":[{"$ref":"#/components/parameters/OrgId"},{"$ref":"#/components/parameters/RequestId"}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{"expirationLength":{"type":"string","description":"A P0 duration to grant instead of the requested one, for example `30m`, `2h`, or `1d`."},"isCustomExpiry":{"type":"boolean","description":"Set to `true` when `expirationLength` is not one of the organization's preset expiry options."}}}}}},"responses":{"200":{"description":"The request was approved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionSuccess"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"}}}}}}
```

## Deny an access request

> Denies a pending access request. Denial cannot be undone — the requestor must submit a new request.

```json
{"openapi":"3.0.4","info":{"title":"P0 Access Requests API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"parameters":{"OrgId":{"name":"orgId","in":"path","required":true,"description":"The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.","schema":{"type":"string"}},"RequestId":{"name":"requestId","in":"path","required":true,"description":"The ID of the access request, as returned by the Command API when the request was created.","schema":{"type":"string"}}},"schemas":{"ActionSuccess":{"type":"object","properties":{"message":{"type":"string"}}},"Error":{"type":"object","properties":{"error":{"type":"string","description":"A human-readable description of the failure."}}}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ForbiddenError":{"description":"The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFoundError":{"description":"No access request exists with this ID in this organization.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/o/{orgId}/permission-requests/{requestId}/deny":{"post":{"summary":"Deny an access request","description":"Denies a pending access request. Denial cannot be undone — the requestor must submit a new request.","parameters":[{"$ref":"#/components/parameters/OrgId"},{"$ref":"#/components/parameters/RequestId"}],"responses":{"200":{"description":"The request was denied.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionSuccess"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"}}}}}}
```

## Revoke an access grant

> Revokes an active grant before it expires. P0 automatically revokes access at expiry, so this is only needed to end a grant early. Revocation cannot be undone — the requestor must submit a new request to restore access.

```json
{"openapi":"3.0.4","info":{"title":"P0 Access Requests API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"parameters":{"OrgId":{"name":"orgId","in":"path","required":true,"description":"The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.","schema":{"type":"string"}},"RequestId":{"name":"requestId","in":"path","required":true,"description":"The ID of the access request, as returned by the Command API when the request was created.","schema":{"type":"string"}}},"schemas":{"ActionSuccess":{"type":"object","properties":{"message":{"type":"string"}}},"Error":{"type":"object","properties":{"error":{"type":"string","description":"A human-readable description of the failure."}}}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ForbiddenError":{"description":"The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFoundError":{"description":"No access request exists with this ID in this organization.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/o/{orgId}/permission-requests/{requestId}/revoke":{"post":{"summary":"Revoke an access grant","description":"Revokes an active grant before it expires. P0 automatically revokes access at expiry, so this is only needed to end a grant early. Revocation cannot be undone — the requestor must submit a new request to restore access.","parameters":[{"$ref":"#/components/parameters/OrgId"},{"$ref":"#/components/parameters/RequestId"}],"responses":{"200":{"description":"The grant was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionSuccess"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"}}}}}}
```