> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-api/p0-api-overview.md).

# P0 API overview

A map of every P0 API — access requests, policies, organization settings, inventory export, and integration webhooks — with the shared base URL, authentication, and permissions that apply to all of th

P0 exposes a set of HTTP APIs so you can drive access, configure your organization, and export inventory from your own code instead of the P0 dashboard. This page maps every P0 API and describes the base URL, authentication, and permissions that they share.

If you are new to the P0 API, start with the [Automate access requests with the API](/p0-api/automate-access-requests-with-the-api.md) walkthrough, then use the API map to find the reference for each endpoint.

## Base URL

Every management endpoint lives under your organization's base URL, which includes your organization slug (`orgId`):

```
https://api.p0.app/o/{orgId}
```

Your `orgId` is the organization slug shown in the P0 dashboard URL and as your org name in the CLI.

## Authentication

The APIs that P0 hosts authenticate with a bearer token. Include the token in the `Authorization` header on every request:

```bash
curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.p0.app/o/{orgId}/...
```

To get a token, see [Authenticating with the P0 API](/p0-api/authenticating-with-the-p0-api.md). We recommend a Google Cloud service-account token; a legacy API key also works.

The Webhook APIs are the exception. Because P0 calls an endpoint that you host, you secure that endpoint on your side rather than with a P0 API key. See each webhook page for its authentication model.

## Permissions

A token carries the P0 role of the identity behind it, so a token is only as privileged as that identity. The exception is an API key, which always carries the **Owner** role and cannot be scoped to a lesser role.

What an identity can do also depends on your access policies. An Owner can change organization settings and revoke any grant. Approving and denying requests follow your access policies rather than the Owner role. Creating a request is open to any member of your organization. Grant each identity the least privilege it needs, and treat a high-privilege token as a sensitive credential:

* Store tokens in a secrets manager or environment variables, and never commit them to version control.
* Rotate long-lived secrets regularly, and delete unused API keys.
* In production, route approvals through [Policy Studio](/policy-studio/policy-studio.md) rather than approving every request with the same automation identity.

## API map

### Just-in-time access

Request and manage ephemeral access programmatically. See the [Just-in-time API](/access-management/access-management/just-in-time-access/just-in-time-api.md) overview for how these fit together.

| API                                                                                                                     | Purpose                                                                                                                       |
| ----------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| [Command API](/access-management/access-management/just-in-time-access/just-in-time-api/command-api.md)                 | Create an access request. The request body mirrors the [p0 request](/p0-cli/p0-commands-and-usage/p0-request.md) CLI command. |
| [Access requests API](/access-management/access-management/just-in-time-access/just-in-time-api/access-requests-api.md) | Approve, deny, or revoke an existing request by ID.                                                                           |
| [Access policies API](/policy-studio/policy-studio/access-policies-api.md)                                              | Create, read, update, and delete the access policies that route requests to approval paths.                                   |

### Organization management

Configure your organization's settings as code. See the [Management API](/p0-management/management-api.md) overview for the full group.

| API                                                                                     | Purpose                                                                                 |
| --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| [Role management API](/p0-management/management-api/role-management-api.md)             | Assign and remove P0 roles for users and groups.                                        |
| [Just-in-time settings API](/p0-management/management-api/just-in-time-settings-api.md) | Configure custom expiry options and approvable, maximum, and standing access durations. |
| [API key management API](/p0-management/management-api/api-key-management-api.md)       | Create, list, and delete API keys.                                                      |

### Inventory

| API                                                        | Purpose                                                                                                                |
| ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| [Inventory export API](/inventory/inventory-export-api.md) | List assessed environments and export the grouped inventory of identities, credentials, grants, and resources as JSON. |

### Integration APIs

P0 exposes APIs to configure resource integrations, such as AWS. Rather than calling these APIs directly, we strongly recommend the [P0 Terraform provider](https://registry.terraform.io/providers/p0-security/p0/latest/docs). It simplifies configuration and lets you manage both the P0 install and the cloud resources an integration depends on — for example, the AWS role P0 assumes — in one place.

The integration APIs are available for direct use on request.

### Webhook APIs (you implement)

These integrations reverse the direction: P0 calls an HTTP endpoint that you host. Each page includes an OpenAPI specification for the payloads P0 sends.

| API                                                                         | Purpose                                                                                                           |
| --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| [Custom resource](/integrations/resource-integrations/custom-resource.md)   | Receive grant, revoke, and list events so P0 can manage access to a resource P0 does not integrate with natively. |
| [Custom notifiers](/integrations/notifier-integrations/custom-notifiers.md) | Receive notification events, such as a created request or pre-approval, to deliver through your own channel.      |

### Related references

| Reference                                                               | Purpose                                                                                                 |
| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| [Audit log format](/integrations/siem-integrations/audit-log-format.md) | The payload and field reference for audit events P0 streams to your SIEM, including API-driven actions. |

## Infrastructure as code

You can manage roles, access durations, expiry options, and integration installs as code with the [P0 Terraform provider](https://registry.terraform.io/providers/p0-security/p0/latest/docs) instead of calling the management APIs directly. Managing organization settings requires provider version `0.50.0` or later.

## Related

* [Automate access requests with the API](/p0-api/automate-access-requests-with-the-api.md) — a step-by-step walkthrough that ties the Command and Access Requests APIs together.
* [Authenticating with the P0 API](/p0-api/authenticating-with-the-p0-api.md) — get a bearer token to authenticate your requests.
* [Manage integrations as code with the P0 Terraform provider](/getting-started/get-started-with-the-p0-terraform-provider.md) — manage P0 as code.