API Key Management API

Create, list, and delete P0 API keys programmatically with the Management API.

The API Key Management API lets you create, list, and delete your organization's API keys programmatically. Use these endpoints to automate key provisioning and rotation in your infrastructure-as-code and CI/CD workflows.

All requests require the Owner role. Authenticate each request with an existing API key or user token by including it in the Authorization header:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.p0.app/o/{orgId}/api-key/keys

Every API key is granted the Owner role, so any key can create, list, and delete other API keys. Treat each key as a full administrative credential, and store it securely.

To create a key through the P0 dashboard instead, see Generating an API key.

4KB

api-key-management-api.yaml

Open

List API keys

get

Retrieve a list of all API keys for the organization. Returns metadata only; raw keys are never exposed after creation.

Authorizations

bearerAuth

AuthorizationstringRequired

Firebase Authentication token, API token, or P0 JWT

Path parameters

orgIdstringRequired

Organization identifier

Responses

200

API keys retrieved successfully

application/json

idstringRequired

Unique identifier for the API key

namestringRequired

Human-readable name for the API key

createdstring · date-timeRequired

Timestamp when the key was created

userone ofRequired

User or service account that created the key

or

401

Unauthorized

403

Forbidden - User lacks apikey.metadata.read permission

get/o/{orgId}/api-key/keys

HTTPcURLJavaScriptPython

GET /o/{orgId}/api-key/keys HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "id": "key_abc123",
    "name": "CI/CD Pipeline Key",
    "created": "2024-01-15T10:30:00Z",
    "user": {
      "uid": "user123",
      "email": "[e-mail]"
    }
  },
  {
    "id": "key_xyz789",
    "name": "Terraform Automation",
    "created": "2024-02-20T14:45:00Z",
    "user": {
      "isApiUser": true,
      "uid": "api_user456",
      "name": "Service Account"
    }
  }
]

Create API key

post

Create a new API key for programmatic access. The raw API key is returned only once at creation time and should be stored securely. This action is audited as 'admin.api-key.created'.

Authorizations

bearerAuth

AuthorizationstringRequired

Firebase Authentication token, API token, or P0 JWT

Path parameters

orgIdstringRequired

Organization identifier

Body

application/json

namestring · min: 1 · max: 100Required

Unique name for the API key (used for identification)

Responses

200

API key created successfully

application/json

idstringRequired

Unique identifier for the API key

namestringRequired

Human-readable name for the API key

createdstring · date-timeRequired

Timestamp when the key was created

rawApiKeystring · uuidRequired

The actual API key value. IMPORTANT: This is only returned once at creation time. Store it securely.

userone ofRequired

User or service account that created the key

or

400

Bad Request - Invalid input or duplicate key name

401

Unauthorized

403

Forbidden - User lacks apikey.add permission

post/o/{orgId}/api-key/keys

HTTPcURLJavaScriptPython

POST /o/{orgId}/api-key/keys HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "name": "GitHub Actions Deployment"
}

{
  "id": "key_new123",
  "name": "GitHub Actions Deployment",
  "created": "2024-03-10T16:20:00Z",
  "rawApiKey": "550e8400-e29b-41d4-a716-446655440000",
  "user": {
    "uid": "user123",
    "email": "[e-mail]"
  }
}

Delete API key

delete

Permanently delete an API key, immediately revoking its access. This action is audited as 'admin.api-key.deleted'.

Authorizations

bearerAuth

AuthorizationstringRequired

Firebase Authentication token, API token, or P0 JWT

Path parameters

orgIdstringRequired

Organization identifier

keyIdstringRequired

API key identifier

Responses

200

API key deleted successfully

application/json

okbooleanOptional

401

Unauthorized

403

Forbidden - User lacks apikey.delete permission

404

API key not found

delete/o/{orgId}/api-key/keys/{keyId}

HTTPcURLJavaScriptPython

DELETE /o/{orgId}/api-key/keys/{keyId} HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "ok": true
}

Response notes

• Create returns the plaintext key in the rawApiKey field. P0 returns it only in this response and stores only a salted hash, so you cannot retrieve it later. Copy it immediately.

• List returns key metadata only, ordered by creation time. It never includes key material. Use each key's id to delete it.

• Delete immediately revokes the key. Any integration still using the key can no longer authenticate, so confirm the key is unused before you delete it.

Key creation and deletion are recorded in the audit log as admin.api-key.created and admin.api-key.deleted events.