🔌P0 API overview
A map of every P0 API — access requests, policies, organization settings, inventory export, and integration webhooks — with the shared base URL, authentication, and permissions that apply to all of th
P0 exposes a set of HTTP APIs so you can drive access, configure your organization, and export inventory from your own code instead of the P0 dashboard. This page maps every P0 API and describes the base URL, authentication, and permissions that they share.
If you are new to the P0 API, start with the Automate access requests with the API walkthrough, then use the API map to find the reference for each endpoint.
Base URL
Every management endpoint lives under your organization's base URL, which includes your organization slug (orgId):
https://api.p0.app/o/{orgId}Your orgId is the organization slug shown in the P0 dashboard URL and as your org name in the CLI.
Authentication
The APIs that P0 hosts authenticate with a bearer token. Include the token in the Authorization header on every request:
curl -H "Authorization: Bearer YOUR_TOKEN" \
https://api.p0.app/o/{orgId}/...To get a token, see Authenticating with the P0 API. We recommend a Google Cloud service-account token; a legacy API key also works.
The Webhook APIs are the exception. Because P0 calls an endpoint that you host, you secure that endpoint on your side rather than with a P0 API key. See each webhook page for its authentication model.
Permissions
A token carries the P0 role of the identity behind it, so a token is only as privileged as that identity. The exception is an API key, which always carries the Owner role and cannot be scoped to a lesser role.
What an identity can do also depends on your access policies. An Owner can change organization settings and revoke any grant. Approving and denying requests follow your access policies rather than the Owner role. Creating a request is open to any member of your organization. Grant each identity the least privilege it needs, and treat a high-privilege token as a sensitive credential:
Store tokens in a secrets manager or environment variables, and never commit them to version control.
Rotate long-lived secrets regularly, and delete unused API keys.
In production, route approvals through your access policies rather than approving every request with the same automation identity.
API map
Just-in-time access
Request and manage ephemeral access programmatically. See the Just-in-time API overview for how these fit together.
Create an access request. The request body mirrors the p0 request CLI command.
Approve, deny, or revoke an existing request by ID.
Create, read, update, and delete the access policies that route requests to approval paths.
Organization management
Configure your organization's settings as code. See the Management API overview for the full group.
Assign and remove P0 roles for users and groups.
Configure custom expiry options and approvable, maximum, and standing access durations.
Create, list, and delete API keys.
Inventory
List assessed environments and export the grouped inventory of identities, credentials, grants, and resources as JSON.
Integration APIs
P0 exposes APIs to configure resource integrations, such as AWS. Rather than calling these APIs directly, we strongly recommend the P0 Terraform provider. It simplifies configuration and lets you manage both the P0 install and the cloud resources an integration depends on — for example, the AWS role P0 assumes — in one place.
The integration APIs are available for direct use on request.
Webhook APIs (you implement)
These integrations reverse the direction: P0 calls an HTTP endpoint that you host. Each page includes an OpenAPI specification for the payloads P0 sends.
Receive grant, revoke, and list events so P0 can manage access to a resource P0 does not integrate with natively.
Receive notification events, such as a created request or pre-approval, to deliver through your own channel.
Related references
The payload and field reference for audit events P0 streams to your SIEM, including API-driven actions.
Infrastructure as code
You can manage roles, access durations, expiry options, and integration installs as code with the P0 Terraform provider instead of calling the management APIs directly. Managing organization settings requires provider version 0.50.0 or later.
Related
Automate access requests with the API — a step-by-step walkthrough that ties the Command and Access Requests APIs together.
Authenticating with the P0 API — get a bearer token to authenticate your requests.
Get started with the P0 Terraform provider — manage P0 as code.
Last updated