Access Requests API

Enable programmatic approval, denial, and revocation of access—enabling seamless integration with internal tools, bots, and security workflows for automated access escalation.

The Access Request API enables programmatic approval, denial, and revocation of access requests within the P0 platform. It is designed to support custom workflows and automation. Integrate with external systems and services to process access grants without using the P0 user interface.

This is particularly useful for integrating P0 into your internal tooling, bots, or security workflows that require automatic access escalation based on alerts, CI/CD pipelines, or external approvals.

Approve a permission request

post

Approve an access request by request ID.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

orgIdstringRequired

Organization identifier

requestIdstringRequired

Unique identifier for the permission request

Body

application/json

expirationLengthstringRequired

Duration for which access should be granted (e.g. "2h", "30m")

Example: 2h

Responses

200

Request approved

No content

400

Invalid or expired request

401

Unauthorized

post

/o/{orgId}/permission-requests/{requestId}/approve

HTTPcURLJavaScriptPython

POST /o/{orgId}/permission-requests/{requestId}/approve HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 25

{
  "expirationLength": "2h"
}

No content

Deny a permission request

post

Deny an access request by request ID.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

orgIdstringRequired

Organization identifier

requestIdstringRequired

Unique identifier for the permission request

Body

application/json

objectOptional

Responses

200

Request denied

No content

400

Invalid or expired request

401

Unauthorized

post

/o/{orgId}/permission-requests/{requestId}/deny

HTTPcURLJavaScriptPython

POST /o/{orgId}/permission-requests/{requestId}/deny HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

No content

Revoke a granted permission

post

Revoke access previously granted by request ID.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

orgIdstringRequired

Organization identifier

requestIdstringRequired

Unique identifier for the permission request

Body

application/json

objectOptional

Responses

200

Access revoked

No content

400

Invalid or expired request

401

Unauthorized

post

/o/{orgId}/permission-requests/{requestId}/revoke

HTTPcURLJavaScriptPython

POST /o/{orgId}/permission-requests/{requestId}/revoke HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

No content