🔌Inventory export API

List your P0 environments and export their access inventory as JSON. Pull credentials, identities, grants, and resources programmatically for custom integrations.

The Inventory export API lets you pull your cloud access inventory programmatically instead of using the in-app Export as JSON button. Use it to feed inventory into custom integrations, data warehouses, or compliance workflows.

The API has two read-only endpoints:

• List environments returns every environment in your organization and its assessment scopes.

• Export inventory returns the latest completed assessment for an environment as a single JSON document, grouped by entity type.

Environments are backed by IAM assessments, so an environment's id is also its assessment ID. Use the id from the list endpoint as the assessmentId path parameter when you export.

Authenticate each request with an API key or user token in the Authorization header:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.p0.app/o/{orgId}/assessment

Both endpoints require the assessment.read permission. API keys carry the Owner role, which includes this permission. To create a key, see Generating an API key.

6KB

inventory-export-api.yaml

Open

List environments

get

Returns every environment in the organization, along with the assessment scopes each environment covers and when each last completed an assessment.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

The environments in the organization.

application/json

401

The caller could not be authenticated.

403

The caller is authenticated but lacks the required assessment.read permission.

get/assessment

HTTPcURLJavaScriptPython

GET /o/demo-org/assessment HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "environments": [
    {
      "id": "text",
      "name": "Prod",
      "targets": [
        {
          "id": "text",
          "integration": "gcloud",
          "type": "project",
          "label": "text"
        }
      ],
      "lastCompletedAt": "2026-08-07T22:05:46.034Z"
    }
  ]
}

Export inventory

get

Exports the inventory of an environment's latest completed assessment as a single JSON document, grouped by entity type. The response is streamed, so it scales to large environments. The X-P0-Assessment-Job-Id and X-P0-Assessment-Completed-At response headers identify the assessment job the inventory came from and when it finished.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

assessmentIdstringRequired

The environment ID returned by the list endpoint. An environment ID is also its assessment ID.

Responses

200

The environment's inventory, grouped by entity type.

application/json

401

The caller could not be authenticated.

403

The caller is authenticated but lacks the required assessment.read permission.

404

No environment matches the given ID.

422

The environment has no completed assessment to export.

429

Too many inventory exports are in progress. Back off and retry shortly.

get/assessment/{assessmentId}/export

HTTPcURLJavaScriptPython

GET /o/demo-org/assessment/{assessmentId}/export HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "completedAt": "2026-08-07T22:05:46.034Z",
  "credentials": [
    {
      "key": "text",
      "ANY_ADDITIONAL_PROPERTY": "anything",
      "risk": [
        {
          "id": "escalation:privilege",
          "name": "Privilege escalation",
          "score": "CRITICAL"
        }
      ]
    }
  ],
  "identities": [
    {
      "key": "text",
      "ANY_ADDITIONAL_PROPERTY": "anything",
      "risk": [
        {
          "id": "escalation:privilege",
          "name": "Privilege escalation",
          "score": "CRITICAL"
        }
      ]
    }
  ],
  "grants": [
    {
      "key": "text",
      "ANY_ADDITIONAL_PROPERTY": "anything",
      "risk": [
        {
          "id": "escalation:privilege",
          "name": "Privilege escalation",
          "score": "CRITICAL"
        }
      ]
    }
  ],
  "resources": [
    {
      "key": "text",
      "ANY_ADDITIONAL_PROPERTY": "anything"
    }
  ]
}

Response notes

• Export groups entities into credentials, identities, grants, and resources. Grants appear as entitlements in the inventory UI.

• Every entity carries a key, its stable identifier in the inventory graph, alongside the entity's own fields. Fields vary by entity type and by cloud provider.

• The export unions every scope of the assessment and de-duplicates entities by key, so each entity appears once even when it spans multiple scopes.

• The export contains the raw inventory entities. Aggregated roll-ups that the inventory UI layers on top, such as risk summaries and connected-node references, aren't included.

• The X-P0-Assessment-Job-Id response header identifies the assessment job the inventory came from. Use it to correlate an export with a specific assessment run.

Example export request

curl -sD - "https://api.p0.app/o/{orgId}/assessment/{assessmentId}/export" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -o inventory.json

The response is streamed and gzip-compressed, so it scales to large environments. The -o flag writes the body to inventory.json, and -D - prints the response headers so you can read the job ID.

Related

• Access Inventory: browse and query your inventory in the P0 dashboard.

• Generating an API key: create a key to authenticate these requests.

• Management API: other programmatic P0 APIs.