P4 REST API

Developers can use the P4 REST API to build scripts and applications that integrate with P4, automate workflows, and extend P4.

Features offered in Technology Preview are experimental and not guaranteed to always work as expected. If you have feedback and functionality suggestions, email techpreview@perforce.com.

The REST API runs on the built-in P4 Web Server, which must be started before you can use the API. To learn more, see p4 webserver in the P4 CLI Reference.

Escape P4 Server reserved characters in filenames when using REST API requests. To learn more, see P4 REST API: Reserved characters.

To learn more about using the REST API, see the P4 REST API documentation.

P4 REST API 2026.1 enhancements

The P4 REST API is in Technology Preview and under active development. If you used P4 REST API 2025.2, review the changes and required actions to make sure your application is not impacted when upgrading to P4 REST API 2026.1.

To learn more about these changes, see the P4 CLI Documentation.

Security headers

The P4 REST API automatically adds security headers to HTTP responses to help protect against common web attacks. These headers follow OWASP recommendations for REST APIs and cannot be enabled, disabled, or modified.

Headers added to all responses

The P4 REST API adds the following headers to every HTTP response:

Header	Value	Purpose
`Cache-Control`	`no-store`	Prevents browsers and caches from storing API responses.
`Content-Security-Policy`	`frame-ancestors 'none'`	Prevents API responses from being displayed in frames.
`X-Content-Type-Options`	`nosniff`	Prevents browsers from guessing content types and interpreting responses incorrectly.
`X-Frame-Options`	`DENY`	Provides additional protection against framing and clickjacking (UI redress) attacks.

Additional headers for file content responses

The GET ./file/contents endpoint adds the following headers in addition to those listed in the previous table. These headers help prevent browsers from rendering returned file content as HTML.

Header	Value	Purpose
`Content-Security-Policy`	`default-src 'none'`	Prevents the browser from loading scripts, style sheets, images, or other resources if it attempts to render the response as a web page.
`Permissions-Policy`	Multiple directives disabled.	Disables browser features such as camera, microphone, geolocation, and USB access.
`Referrer-Policy`	`no-referrer`	Prevents referrer information from being sent in subsequent requests.