> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-management/management-api/api-key-management-api.md).

# API key management API

The API Key Management API lets you create, list, and delete your organization's API keys programmatically. Use these endpoints to automate key provisioning and rotation in your infrastructure-as-code and CI/CD workflows.

All requests require the **Owner** role. Authenticate each request with an existing token by including it in the `Authorization` header (see [Authenticating with the P0 API](/getting-started/authenticating-with-the-p0-api.md)):

```bash
curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.p0.app/o/{orgId}/api-key/keys
```

{% hint style="warning" %}
Every API key is granted the **Owner** role, so any key can create, list, and delete other API keys. Treat each key as a full administrative credential, and store it securely.
{% endhint %}

To create a key through the P0 dashboard instead, see [Generating an API key](/p0-management/generating-an-api-key.md).

{% file src="/files/elo2vJlaIaAmUti5jEnw" %}

## List API keys

> Returns metadata for every API key in the organization, ordered by creation time. Never returns key material.

```json
{"openapi":"3.0.4","info":{"title":"P0 API Key Management API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app/o/{orgId}","variables":{"orgId":{"default":"demo-org","description":"The organization ID"}}}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"schemas":{"ApiKeyMetadata":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier of the API key."},"created":{"type":"string","format":"date-time","description":"The time the key was created."},"name":{"type":"string","description":"The descriptive name of the key."},"user":{"type":"object","description":"The user or service account associated with the key."}}}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated."}}},"paths":{"/api-key/keys":{"get":{"summary":"List API keys","description":"Returns metadata for every API key in the organization, ordered by creation time. Never returns key material.","responses":{"200":{"description":"A list of API key metadata.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ApiKeyMetadata"}}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}}}}
```

## Create an API key

> Creates a new API key and returns the plaintext key. Requires the Owner role.

```json
{"openapi":"3.0.4","info":{"title":"P0 API Key Management API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app/o/{orgId}","variables":{"orgId":{"default":"demo-org","description":"The organization ID"}}}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"schemas":{"CreateApiKeyRequest":{"type":"object","required":["name"],"properties":{"name":{"type":"string","description":"A descriptive name for the key. Must be unique within the organization."}}},"CreateApiKeyResponse":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier of the API key."},"created":{"type":"string","format":"date-time","description":"The time the key was created."},"name":{"type":"string","description":"The descriptive name of the key."},"rawApiKey":{"type":"string","description":"The plaintext API key. Returned only in this response and never retrievable later."},"user":{"type":"object","description":"The user or service account associated with the key."}}}},"responses":{"BadRequestError":{"description":"The request is invalid, for example a missing or duplicate name."},"UnauthorizedError":{"description":"The caller could not be authenticated."}}},"paths":{"/api-key/keys":{"post":{"summary":"Create an API key","description":"Creates a new API key and returns the plaintext key. Requires the Owner role.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApiKeyRequest"}}}},"responses":{"200":{"description":"The created API key, including the plaintext key material.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApiKeyResponse"}}}},"400":{"$ref":"#/components/responses/BadRequestError"},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}}}}
```

## Delete an API key

> Revokes an API key by ID. Requires the Owner role.

```json
{"openapi":"3.0.4","info":{"title":"P0 API Key Management API","version":"1.0.0"},"servers":[{"url":"https://api.p0.app/o/{orgId}","variables":{"orgId":{"default":"demo-org","description":"The organization ID"}}}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}},"parameters":{"keyId":{"name":"keyId","in":"path","required":true,"description":"The ID of the API key","schema":{"type":"string"}}},"schemas":{"DeleteApiKeyResponse":{"type":"object","properties":{"ok":{"type":"boolean","description":"Indicates the key was deleted."}}}},"responses":{"UnauthorizedError":{"description":"The caller could not be authenticated."}}},"paths":{"/api-key/keys/{keyId}":{"delete":{"summary":"Delete an API key","description":"Revokes an API key by ID. Requires the Owner role.","parameters":[{"$ref":"#/components/parameters/keyId"}],"responses":{"200":{"description":"The key was deleted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteApiKeyResponse"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}}}}
```

## The ApiKeyMetadata object

```json
{"openapi":"3.0.4","info":{"title":"P0 API Key Management API","version":"1.0.0"},"components":{"schemas":{"ApiKeyMetadata":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier of the API key."},"created":{"type":"string","format":"date-time","description":"The time the key was created."},"name":{"type":"string","description":"The descriptive name of the key."},"user":{"type":"object","description":"The user or service account associated with the key."}}}}}}
```

## The CreateApiKeyRequest object

```json
{"openapi":"3.0.4","info":{"title":"P0 API Key Management API","version":"1.0.0"},"components":{"schemas":{"CreateApiKeyRequest":{"type":"object","required":["name"],"properties":{"name":{"type":"string","description":"A descriptive name for the key. Must be unique within the organization."}}}}}}
```

## The CreateApiKeyResponse object

```json
{"openapi":"3.0.4","info":{"title":"P0 API Key Management API","version":"1.0.0"},"components":{"schemas":{"CreateApiKeyResponse":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier of the API key."},"created":{"type":"string","format":"date-time","description":"The time the key was created."},"name":{"type":"string","description":"The descriptive name of the key."},"rawApiKey":{"type":"string","description":"The plaintext API key. Returned only in this response and never retrievable later."},"user":{"type":"object","description":"The user or service account associated with the key."}}}}}}
```

## The DeleteApiKeyResponse object

```json
{"openapi":"3.0.4","info":{"title":"P0 API Key Management API","version":"1.0.0"},"components":{"schemas":{"DeleteApiKeyResponse":{"type":"object","properties":{"ok":{"type":"boolean","description":"Indicates the key was deleted."}}}}}}
```

## Response notes

* **Create** returns the plaintext key in the `rawApiKey` field. P0 returns it only in this response and stores only a salted hash, so you cannot retrieve it later. Copy it immediately.
* **List** returns key metadata only, ordered by creation time. It never includes key material. Use each key's `id` to delete it.
* **Delete** immediately revokes the key. Any integration still using the key can no longer authenticate, so confirm the key is unused before you delete it.

Key creation and deletion are recorded in the [audit log](/integrations/siem-integrations/audit-log-format.md) as `admin.api-key.created` and `admin.api-key.deleted` events.