> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-cli/p0-commands-and-usage/p0-ls.md).

# p0 ls

Discover which resources and arguments you can use with P0's request, grant, and allow commands.

### **Overview** <a href="#overview" id="overview"></a>

The p0 ls command lets you **discover** which resources and arguments you can use with P0's request (grant/request) and standing-access (allow) workflows. It:

* Lists valid identifiers (ARNs, role names, group IDs, etc.)
* Marks items you **already have access** to with \*
* Supports filtering and paging
* Outputs either human-readable lists or raw JSON

Use p0 ls to eliminate guesswork when constructing p0 grant or p0 allow commands.

***

### **Prerequisites** <a href="#prerequisites" id="prerequisites"></a>

* **Logged-in user**
* **Network access**

  Allow HTTPS egress to https\://\<your-tenant>/o/\<org-slug>/command/.

***

### **Global Syntax & Flags** <a href="#global-syntax-and-flags" id="global-syntax-and-flags"></a>

```plaintext
p0 ls <integration> <access-type> <argument> [search-term] [options]
```

* **\<integration> \<access-type>**: the same two words you use with `p0 request`, such as `aws role` or `okta membership`.
* **\<argument>**: the argument or option of that request whose values you want to list. For example, `p0 ls aws role name` lists values for the role name, and `p0 ls aws role account` lists values for `--account`.
* **\[search-term]**: show only values that match this text.
* **--\<option> \<value>**: narrow the list. Some lists need one, such as `--cluster` for Kubernetes roles.
* **--size N**: how many items to display (default: 15).
* **--json**: print the full JSON response and exit.
* **--approved**: show only access you already have or that would be approved automatically.
* **--principal \<email>**: list what a different user can request.
* **--all**: list resources available to all users.
* **--help**: show the arguments you can list for any integration or access type.

***

### **Providers & Subcommands** <a href="#providers-and-subcommands" id="providers-and-subcommands"></a>

Run `p0 ls <integration> <access-type> --help` to see the exact list of arguments for your organization. Each example below lists values you can pass to the matching [p0 request](/p0-cli/p0-commands-and-usage/p0-request.md) command.

#### **AWS** <a href="#aws" id="aws"></a>

* **role**: `account`, `name`
* **permission-set**: `account`, `name`
* **group**: `account`, `name`
* **policy**: `account`, `arns`
* **resource**: `account`, `arn`, `policies`

**Examples**

List the AWS accounts you can request a role in:

```plaintext
p0 ls aws role account
```

List IAM roles containing "ReadOnly":

```plaintext
p0 ls aws role name ReadOnly
```

Find permission sets containing "ReadOnly" in one account:

```plaintext
p0 ls aws permission-set name ReadOnly --account 123456789012
```

List IAM groups:

```plaintext
p0 ls aws group name --account 123456789012
```

List policies that match `AmazonS3`:

```plaintext
p0 ls aws policy arns AmazonS3
```

List resource ARNs matching a bucket:

```plaintext
p0 ls aws resource arn my-bucket
```

List the policies you can request on one resource:

```plaintext
p0 ls aws resource policies --arn arn:aws:s3:::my-bucket
```

***

#### **Azure** <a href="#azure" id="azure"></a>

* **resource**: `subscription`, `resource`, `role`

**Examples**

List subscriptions:

```plaintext
p0 ls azure resource subscription
```

List resources in a subscription:

```plaintext
p0 ls azure resource resource --subscription <subscription-id>
```

List the roles you can request on a resource:

```plaintext
p0 ls azure resource role --resource <resource-id>
```

***

#### **Entra ID and Entra ID (legacy)** <a href="#azure-a-d-entra-id" id="azure-a-d-entra-id"></a>

* **membership**: `name`
* **assignment** (Entra ID only): `name`

**Examples**

List all groups you could request membership in:

```plaintext
p0 ls entra-id membership name
```

List Entra ID roles containing "Reader":

```plaintext
p0 ls entra-id assignment name Reader
```

List groups with the legacy integration:

```plaintext
p0 ls azure-ad membership name
```

***

#### **Google Cloud (GCP)** <a href="#google-cloud-gcp" id="google-cloud-gcp"></a>

* **role**: `project`, `name`
* **permission**: `project`, `name`
* **resource**: `project`, `locator`, `accesses`

**Examples**

List projects:

```plaintext
p0 ls gcloud role project
```

List roles containing "viewer":

```plaintext
p0 ls gcloud role name viewer --project my-gcp-project
```

List permissions containing "compute.instances":

```plaintext
p0 ls gcloud permission name compute.instances
```

List resources in a project:

```plaintext
p0 ls gcloud resource locator --project my-gcp-project
```

List the accesses you can request on one resource:

```plaintext
p0 ls gcloud resource accesses --locator <resource-locator>
```

***

#### **Kubernetes** <a href="#kubernetes" id="kubernetes"></a>

* **resource**: `cluster`, `role`, `locator`

**Examples**

List clusters:

```plaintext
p0 ls k8s resource cluster
```

List the roles you can request on a cluster:

```plaintext
p0 ls k8s resource role --cluster my-cluster
```

List the objects you can scope a request to:

```plaintext
p0 ls k8s resource locator --cluster my-cluster
```

`--cluster` is required for `role` and `locator`, even if your organization has one cluster.

***

#### **PostgreSQL and MySQL** <a href="#postgresql" id="postgresql"></a>

* **role**: `instance`, `database`, `name`
* **sql**: `instance`, `database`

**Examples**

List instances:

```plaintext
p0 ls postgres role instance
```

List roles on an instance:

```plaintext
p0 ls postgres role name --instance <instance>
```

List databases on an instance:

```plaintext
p0 ls postgres role database --instance <instance>
```

List MySQL roles on an instance:

```plaintext
p0 ls mysql role name --instance <instance>
```

If your organization uses the legacy PostgreSQL integration (`pg`), list instances, then the roles on one instance:

```plaintext
p0 ls pg role instance
p0 ls pg role role --instance <instance>
```

***

#### **Snowflake** <a href="#snowflake" id="snowflake"></a>

* **role**: `account`, `user`, `name`
* **sql**: `account`, `user`

**Examples**

List Snowflake roles containing "ANALYST":

```plaintext
p0 ls snowflake role name ANALYST
```

List the Snowflake users you can run SQL as:

```plaintext
p0 ls snowflake sql user
```

***

#### **Databricks** <a href="#databricks" id="databricks"></a>

* **privilege**: `catalog`, `schema`, `table`, `volume`, `function`, `privileges`
* **admin**: `role`, `account`, `workspace`

**Examples**

List catalogs:

```plaintext
p0 ls databricks privilege catalog
```

List schemas in a catalog:

```plaintext
p0 ls databricks privilege schema --catalog main
```

List tables in a schema:

```plaintext
p0 ls databricks privilege table --catalog main --schema sales
```

List workspaces you can request workspace admin on:

```plaintext
p0 ls databricks admin workspace
```

***

#### **Okta** <a href="#okta" id="okta"></a>

* **membership**: `name`

**Examples**

List all Okta groups available to you:

```plaintext
p0 ls okta membership name
```

List groups containing "eng":

```plaintext
p0 ls okta membership name eng
```

***

#### **SSH** <a href="#ssh" id="ssh"></a>

* **session**: `destination`, `parent`, `provider`, `group`
* **group**: `name`, `destination`, `provider`, `parent`
* **parent**: `parent`, `provider`

**Examples**

List all SSH groups:

```plaintext
p0 ls ssh group name
```

Show instances matching "prod-web":

```plaintext
p0 ls ssh session destination prod-web
```

Show AWS instances only:

```plaintext
p0 ls ssh session destination --provider aws
```

List accounts and projects matching "devs":

```plaintext
p0 ls ssh parent parent devs
```

***

#### **Google Workspace** <a href="#google-workspace" id="google-workspace"></a>

* **membership**: `name`

**Examples**

List all Google Workspace groups:

```plaintext
p0 ls workspace membership name
```

List groups containing "marketing":

```plaintext
p0 ls workspace membership name marketing
```

***

#### **Other integrations** <a href="#other-integrations" id="other-integrations"></a>

| Integration        | Example                                                   |
| ------------------ | --------------------------------------------------------- |
| GitHub             | `p0 ls github role repository`                            |
|                    | `p0 ls github role role --repository my-github-org/api`   |
|                    | `p0 ls github team team`                                  |
| Docker Hub         | `p0 ls docker role organization`                          |
| 1Password          | `p0 ls 1password item account`                            |
|                    | `p0 ls 1password item vault --account acme.1password.com` |
| Oracle Cloud       | `p0 ls oci group groupId`                                 |
| Tailscale          | `p0 ls tailscale device name`                             |
| Salesforce         | `p0 ls salesforce permission-set id`                      |
| Cloudflare         | `p0 ls cloudflare group id`                               |
| Grafana Cloud      | `p0 ls grafana-cloud group id`                            |
| Custom application | `p0 ls app access locator`                                |
| Custom resource    | `p0 ls custom resource item --application <application>`  |
| AI Gateway         | `p0 ls agentic tool server --gateway <gateway>`           |
| Access bundle      | `p0 ls bundle request bundleId`                           |

***

### **Output Details** <a href="#output-details" id="output-details"></a>

* **Human mode**
  * Marks items you already have (isPreexisting) with \*.
  * Shows "Showing the first N…" and suggests filters if truncated.
  * Aligns key and value columns; long entries wrap with dimmed metadata.
* **JSON mode**

  Outputs:

```plaintext
{
  "ok": true,
  "items": [
    { "key": "...", "value": "...", "group": "...", "isPreexisting": true },
    …
  ],
  "isTruncated": false,
  "term": "",
  "arg": "<subcommand>"
}
```