> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/inventory/inventory-export-api.md).

# Inventory export API

The Inventory export API lets you pull your cloud [access inventory](/inventory/access-inventory.md) programmatically instead of using the in-app **Export as JSON** button. Use it to feed inventory into custom integrations, data warehouses, or compliance workflows.

The API has two read-only endpoints:

* **List environments** returns every environment in your organization and its assessment scopes.
* **Export inventory** returns the latest completed assessment for an environment as a single JSON document, grouped by entity type.

Environments are backed by IAM assessments, so an environment's `id` is also its assessment ID. Use the `id` from the list endpoint as the `assessmentId` path parameter when you export.

Authenticate each request with a [bearer token](/getting-started/authenticating-with-the-p0-api.md) in the `Authorization` header:

```bash
curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.p0.app/o/{orgId}/assessment
```

Both endpoints require the `assessment.read` permission. A token from an identity with the **Owner** role includes this permission. To get a token, see [Authenticating with the P0 API](/getting-started/authenticating-with-the-p0-api.md).

{% file src="/files/1hQJXIe7jnIweH7Ypuof" %}

## List environments

> Returns every environment in the organization, along with the assessment scopes each environment covers.

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app/o/{orgId}","variables":{"orgId":{"default":"demo-org","description":"The organization ID"}}}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"schemas":{"EnvironmentList":{"type":"object","properties":{"environments":{"type":"array","items":{"$ref":"#/components/schemas/Environment"}}}},"Environment":{"type":"object","description":"An environment in the organization. Environments are backed by IAM assessments.","properties":{"id":{"type":"string","description":"The environment ID. Pass this as the `assessmentId` path parameter to export the environment's inventory."},"name":{"type":"string","description":"The display name of the environment."},"targets":{"type":"array","description":"The assessment scopes the environment covers.","items":{"$ref":"#/components/schemas/AssessmentScope"}}}},"AssessmentScope":{"type":"object","description":"A single scope covered by an environment's assessment.","properties":{"id":{"type":"string","description":"The identifier of the scoped target, such as a project, account, or subscription ID."},"integration":{"type":"string","description":"The cloud integration the scope belongs to."},"type":{"type":"string","description":"The kind of target the scope covers."}}}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated."}}},"paths":{"/assessment":{"get":{"summary":"List environments","description":"Returns every environment in the organization, along with the assessment scopes each environment covers.","responses":{"200":{"description":"The environments in the organization.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentList"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}}}}
```

## Export inventory

> Exports the inventory of an environment's latest completed assessment as a single JSON document, grouped by entity type. The response is streamed, so it scales to large environments. The \`X-P0-Assessment-Job-Id\` response header identifies the assessment job the inventory came from.

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app/o/{orgId}","variables":{"orgId":{"default":"demo-org","description":"The organization ID"}}}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"parameters":{"assessmentId":{"name":"assessmentId","in":"path","required":true,"description":"The environment ID returned by the list endpoint. An environment ID is also its assessment ID.","schema":{"type":"string"}}},"schemas":{"InventoryExport":{"type":"object","description":"The environment's inventory, grouped by entity type. Each entity appears once per group; entities that span multiple assessment scopes are de-duplicated by key.","properties":{"credentials":{"type":"array","description":"Keys, tokens, and other credentials discovered in the environment.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"identities":{"type":"array","description":"Users, service accounts, and groups.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"grants":{"type":"array","description":"Access grants that bind a principal to a privilege set on one or more resources. These appear as entitlements in the inventory UI.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"resources":{"type":"array","description":"Cloud resources such as buckets, databases, and compute instances.","items":{"$ref":"#/components/schemas/InventoryEntity"}}}},"InventoryEntity":{"type":"object","description":"A single inventory entity. Every entity carries a stable `key` alongside its own fields. The remaining fields vary by entity type and by cloud provider.","required":["key"],"properties":{"key":{"type":"string","description":"The entity's stable identifier in the inventory graph."}},"additionalProperties":true}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated."},"NotFoundError":{"description":"No environment matches the given ID."},"NoCompletedAssessmentError":{"description":"The environment has no completed assessment to export."},"TooManyRequestsError":{"description":"Too many inventory exports are in progress. Back off and retry shortly."}}},"paths":{"/assessment/{assessmentId}/export":{"get":{"summary":"Export inventory","description":"Exports the inventory of an environment's latest completed assessment as a single JSON document, grouped by entity type. The response is streamed, so it scales to large environments. The `X-P0-Assessment-Job-Id` response header identifies the assessment job the inventory came from.","parameters":[{"$ref":"#/components/parameters/assessmentId"}],"responses":{"200":{"description":"The environment's inventory, grouped by entity type.","headers":{"X-P0-Assessment-Job-Id":{"description":"The ID of the assessment job the inventory came from.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InventoryExport"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"404":{"$ref":"#/components/responses/NotFoundError"},"422":{"$ref":"#/components/responses/NoCompletedAssessmentError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}}}}
```

## The AssessmentScope object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"AssessmentScope":{"type":"object","description":"A single scope covered by an environment's assessment.","properties":{"id":{"type":"string","description":"The identifier of the scoped target, such as a project, account, or subscription ID."},"integration":{"type":"string","description":"The cloud integration the scope belongs to."},"type":{"type":"string","description":"The kind of target the scope covers."}}}}}}
```

## The Environment object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"Environment":{"type":"object","description":"An environment in the organization. Environments are backed by IAM assessments.","properties":{"id":{"type":"string","description":"The environment ID. Pass this as the `assessmentId` path parameter to export the environment's inventory."},"name":{"type":"string","description":"The display name of the environment."},"targets":{"type":"array","description":"The assessment scopes the environment covers.","items":{"$ref":"#/components/schemas/AssessmentScope"}}}},"AssessmentScope":{"type":"object","description":"A single scope covered by an environment's assessment.","properties":{"id":{"type":"string","description":"The identifier of the scoped target, such as a project, account, or subscription ID."},"integration":{"type":"string","description":"The cloud integration the scope belongs to."},"type":{"type":"string","description":"The kind of target the scope covers."}}}}}}
```

## The EnvironmentList object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"EnvironmentList":{"type":"object","properties":{"environments":{"type":"array","items":{"$ref":"#/components/schemas/Environment"}}}},"Environment":{"type":"object","description":"An environment in the organization. Environments are backed by IAM assessments.","properties":{"id":{"type":"string","description":"The environment ID. Pass this as the `assessmentId` path parameter to export the environment's inventory."},"name":{"type":"string","description":"The display name of the environment."},"targets":{"type":"array","description":"The assessment scopes the environment covers.","items":{"$ref":"#/components/schemas/AssessmentScope"}}}},"AssessmentScope":{"type":"object","description":"A single scope covered by an environment's assessment.","properties":{"id":{"type":"string","description":"The identifier of the scoped target, such as a project, account, or subscription ID."},"integration":{"type":"string","description":"The cloud integration the scope belongs to."},"type":{"type":"string","description":"The kind of target the scope covers."}}}}}}
```

## The InventoryEntity object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"InventoryEntity":{"type":"object","description":"A single inventory entity. Every entity carries a stable `key` alongside its own fields. The remaining fields vary by entity type and by cloud provider.","required":["key"],"properties":{"key":{"type":"string","description":"The entity's stable identifier in the inventory graph."}},"additionalProperties":true}}}}
```

## The InventoryExport object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"InventoryExport":{"type":"object","description":"The environment's inventory, grouped by entity type. Each entity appears once per group; entities that span multiple assessment scopes are de-duplicated by key.","properties":{"credentials":{"type":"array","description":"Keys, tokens, and other credentials discovered in the environment.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"identities":{"type":"array","description":"Users, service accounts, and groups.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"grants":{"type":"array","description":"Access grants that bind a principal to a privilege set on one or more resources. These appear as entitlements in the inventory UI.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"resources":{"type":"array","description":"Cloud resources such as buckets, databases, and compute instances.","items":{"$ref":"#/components/schemas/InventoryEntity"}}}},"InventoryEntity":{"type":"object","description":"A single inventory entity. Every entity carries a stable `key` alongside its own fields. The remaining fields vary by entity type and by cloud provider.","required":["key"],"properties":{"key":{"type":"string","description":"The entity's stable identifier in the inventory graph."}},"additionalProperties":true}}}}
```

## Response notes

* **Export** groups entities into `credentials`, `identities`, `grants`, and `resources`. Grants appear as **entitlements** in the inventory UI.
* Every entity carries a `key`, its stable identifier in the inventory graph, alongside the entity's own fields. Fields vary by entity type and by cloud provider.
* The export unions every scope of the assessment and de-duplicates entities by `key`, so each entity appears once even when it spans multiple scopes.
* The export contains the raw inventory entities. Each credential, identity, and grant carries a `risk` array with the same risk roll-up the inventory UI shows; resources don't include a `risk` field. Connected-node references that the UI layers on top aren't included.
* The `X-P0-Assessment-Job-Id` response header identifies the assessment job the inventory came from. Use it to correlate an export with a specific assessment run.

### Example export request

```bash
curl -sD - "https://api.p0.app/o/{orgId}/assessment/{assessmentId}/export" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -o inventory.json
```

The response is streamed, so it scales to large environments. The `-o` flag writes the body to `inventory.json`, and `-D -` prints the response headers so you can read the job ID.

## Related

* [P0 API overview](/getting-started/p0-api-overview.md): a map of every P0 API and the authentication they share.
* [Access Inventory](/inventory/access-inventory.md): browse and query your inventory in the P0 dashboard.
* [Authenticating with the P0 API](/getting-started/authenticating-with-the-p0-api.md): get a token to authenticate these requests.
* [Management API](/p0-management/management-api.md): other programmatic P0 APIs.