> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/inventory/inventory-export-api.md).

# Inventory export API

List your P0 environments and export their access inventory as JSON. Pull credentials, identities, grants, and resources programmatically for custom integrations.

The Inventory export API lets you pull your cloud [access inventory](/inventory/access-inventory.md) programmatically instead of using the in-app **Export as JSON** button. Use it to feed inventory into custom integrations, data warehouses, or compliance workflows.

The API has two read-only endpoints:

* **List environments** returns every environment in your organization and its assessment scopes.
* **Export inventory** returns the latest completed assessment for an environment as a single JSON document, grouped by entity type.

Environments are backed by IAM assessments, so an environment's `id` is also its assessment ID. Use the `id` from the list endpoint as the `assessmentId` path parameter when you export.

Authenticate each request with a [bearer token](/p0-api/authenticating-with-the-p0-api.md) in the `Authorization` header:

```bash
curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.p0.app/o/{orgId}/assessment
```

Both endpoints require the `assessment.read` permission. A token from an identity with the **Owner** role includes this permission. To get a token, see [Authenticating with the P0 API](/p0-api/authenticating-with-the-p0-api.md).

{% file src="/files/1hQJXIe7jnIweH7Ypuof" %}

## List environments

> Returns every environment in the organization, along with the assessment scopes each environment covers.

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app/o/{orgId}","variables":{"orgId":{"default":"demo-org","description":"The organization ID"}}}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"schemas":{"EnvironmentList":{"type":"object","properties":{"environments":{"type":"array","items":{"$ref":"#/components/schemas/Environment"}}}},"Environment":{"type":"object","description":"An environment in the organization. Environments are backed by IAM assessments.","properties":{"id":{"type":"string","description":"The environment ID. Pass this as the `assessmentId` path parameter to export the environment's inventory."},"name":{"type":"string","description":"The display name of the environment."},"targets":{"type":"array","description":"The assessment scopes the environment covers.","items":{"$ref":"#/components/schemas/AssessmentScope"}}}},"AssessmentScope":{"type":"object","description":"A single scope covered by an environment's assessment.","properties":{"id":{"type":"string","description":"The identifier of the scoped target, such as a project, account, or subscription ID."},"integration":{"type":"string","description":"The cloud integration the scope belongs to."},"type":{"type":"string","description":"The kind of target the scope covers."}}}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated."}}},"paths":{"/assessment":{"get":{"summary":"List environments","description":"Returns every environment in the organization, along with the assessment scopes each environment covers.","responses":{"200":{"description":"The environments in the organization.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentList"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}}}}
```

## Export inventory

> Exports the inventory of an environment's latest completed assessment as a single JSON document, grouped by entity type. The response is streamed, so it scales to large environments. The \`X-P0-Assessment-Job-Id\` response header identifies the assessment job the inventory came from.

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app/o/{orgId}","variables":{"orgId":{"default":"demo-org","description":"The organization ID"}}}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"parameters":{"assessmentId":{"name":"assessmentId","in":"path","required":true,"description":"The environment ID returned by the list endpoint. An environment ID is also its assessment ID.","schema":{"type":"string"}}},"schemas":{"InventoryExport":{"type":"object","description":"The environment's inventory, grouped by entity type. Each entity appears once per group; entities that span multiple assessment scopes are de-duplicated by key.","properties":{"credentials":{"type":"array","description":"Keys, tokens, and other credentials discovered in the environment.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"identities":{"type":"array","description":"Users, service accounts, and groups.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"grants":{"type":"array","description":"Access grants that bind a principal to a privilege set on one or more resources. These appear as entitlements in the inventory UI.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"resources":{"type":"array","description":"Cloud resources such as buckets, databases, and compute instances.","items":{"$ref":"#/components/schemas/InventoryEntity"}}}},"InventoryEntity":{"type":"object","description":"A single inventory entity. Every entity carries a stable `key` alongside its own fields. The remaining fields vary by entity type and by cloud provider.","required":["key"],"properties":{"key":{"type":"string","description":"The entity's stable identifier in the inventory graph."}},"additionalProperties":true}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated."},"NotFoundError":{"description":"No environment matches the given ID."},"NoCompletedAssessmentError":{"description":"The environment has no completed assessment to export."},"TooManyRequestsError":{"description":"Too many inventory exports are in progress. Back off and retry shortly."}}},"paths":{"/assessment/{assessmentId}/export":{"get":{"summary":"Export inventory","description":"Exports the inventory of an environment's latest completed assessment as a single JSON document, grouped by entity type. The response is streamed, so it scales to large environments. The `X-P0-Assessment-Job-Id` response header identifies the assessment job the inventory came from.","parameters":[{"$ref":"#/components/parameters/assessmentId"}],"responses":{"200":{"description":"The environment's inventory, grouped by entity type.","headers":{"X-P0-Assessment-Job-Id":{"description":"The ID of the assessment job the inventory came from.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InventoryExport"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"404":{"$ref":"#/components/responses/NotFoundError"},"422":{"$ref":"#/components/responses/NoCompletedAssessmentError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}}}}
```

## The AssessmentScope object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"AssessmentScope":{"type":"object","description":"A single scope covered by an environment's assessment.","properties":{"id":{"type":"string","description":"The identifier of the scoped target, such as a project, account, or subscription ID."},"integration":{"type":"string","description":"The cloud integration the scope belongs to."},"type":{"type":"string","description":"The kind of target the scope covers."}}}}}}
```

## The Environment object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"Environment":{"type":"object","description":"An environment in the organization. Environments are backed by IAM assessments.","properties":{"id":{"type":"string","description":"The environment ID. Pass this as the `assessmentId` path parameter to export the environment's inventory."},"name":{"type":"string","description":"The display name of the environment."},"targets":{"type":"array","description":"The assessment scopes the environment covers.","items":{"$ref":"#/components/schemas/AssessmentScope"}}}},"AssessmentScope":{"type":"object","description":"A single scope covered by an environment's assessment.","properties":{"id":{"type":"string","description":"The identifier of the scoped target, such as a project, account, or subscription ID."},"integration":{"type":"string","description":"The cloud integration the scope belongs to."},"type":{"type":"string","description":"The kind of target the scope covers."}}}}}}
```

## The EnvironmentList object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"EnvironmentList":{"type":"object","properties":{"environments":{"type":"array","items":{"$ref":"#/components/schemas/Environment"}}}},"Environment":{"type":"object","description":"An environment in the organization. Environments are backed by IAM assessments.","properties":{"id":{"type":"string","description":"The environment ID. Pass this as the `assessmentId` path parameter to export the environment's inventory."},"name":{"type":"string","description":"The display name of the environment."},"targets":{"type":"array","description":"The assessment scopes the environment covers.","items":{"$ref":"#/components/schemas/AssessmentScope"}}}},"AssessmentScope":{"type":"object","description":"A single scope covered by an environment's assessment.","properties":{"id":{"type":"string","description":"The identifier of the scoped target, such as a project, account, or subscription ID."},"integration":{"type":"string","description":"The cloud integration the scope belongs to."},"type":{"type":"string","description":"The kind of target the scope covers."}}}}}}
```

## The InventoryEntity object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"InventoryEntity":{"type":"object","description":"A single inventory entity. Every entity carries a stable `key` alongside its own fields. The remaining fields vary by entity type and by cloud provider.","required":["key"],"properties":{"key":{"type":"string","description":"The entity's stable identifier in the inventory graph."}},"additionalProperties":true}}}}
```

## The InventoryExport object

```json
{"openapi":"3.0.4","info":{"title":"P0 Inventory Export API","version":"1.0.0"},"components":{"schemas":{"InventoryExport":{"type":"object","description":"The environment's inventory, grouped by entity type. Each entity appears once per group; entities that span multiple assessment scopes are de-duplicated by key.","properties":{"credentials":{"type":"array","description":"Keys, tokens, and other credentials discovered in the environment.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"identities":{"type":"array","description":"Users, service accounts, and groups.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"grants":{"type":"array","description":"Access grants that bind a principal to a privilege set on one or more resources. These appear as entitlements in the inventory UI.","items":{"$ref":"#/components/schemas/InventoryEntity"}},"resources":{"type":"array","description":"Cloud resources such as buckets, databases, and compute instances.","items":{"$ref":"#/components/schemas/InventoryEntity"}}}},"InventoryEntity":{"type":"object","description":"A single inventory entity. Every entity carries a stable `key` alongside its own fields. The remaining fields vary by entity type and by cloud provider.","required":["key"],"properties":{"key":{"type":"string","description":"The entity's stable identifier in the inventory graph."}},"additionalProperties":true}}}}
```

## Response notes

* **Export** groups entities into `credentials`, `identities`, `grants`, and `resources`. Grants appear as **entitlements** in the inventory UI.
* Every entity carries a `key`, its stable identifier in the inventory graph, alongside the entity's own fields. Fields vary by entity type and by cloud provider.
* The export unions every scope of the assessment and de-duplicates entities by `key`, so each entity appears once even when it spans multiple scopes.
* The export contains the raw inventory entities. Each credential, identity, and grant carries a `risk` array with the same risk roll-up the inventory UI shows; resources don't include a `risk` field. Connected-node references that the UI layers on top aren't included.
* The `X-P0-Assessment-Job-Id` response header identifies the assessment job the inventory came from. Use it to correlate an export with a specific assessment run.

### Example export request

```bash
curl -sD - "https://api.p0.app/o/{orgId}/assessment/{assessmentId}/export" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -o inventory.json
```

The response is streamed, so it scales to large environments. The `-o` flag writes the body to `inventory.json`, and `-D -` prints the response headers so you can read the job ID.

## Related

* [P0 API overview](/p0-api/p0-api-overview.md): a map of every P0 API and the authentication they share.
* [Access Inventory](/inventory/access-inventory.md): browse and query your inventory in the P0 dashboard.
* [Authenticating with the P0 API](/p0-api/authenticating-with-the-p0-api.md): get a token to authenticate these requests.
* [Management API](/p0-management/management-api.md): other programmatic P0 APIs.