> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-cli/p0-commands-and-usage/p0-request.md).

# p0 request

Manually request time-boxed just-in-time access to a resource instead of standing permissions.

### Overview

* Request just-in-time access to any resource your organization has connected to P0: cloud roles, directory groups, databases, Kubernetes clusters, servers, and more.
* Create a time-boxed access request instead of granting standing permissions.
* Send the request for approval. Once it is approved, P0 grants the access for the duration you asked for and removes it when that time ends.
* Attach a reason that approvers see and that is kept in the audit trail.
* Optionally wait (`--wait`) until your access is ready before the command returns.

### Prerequisites

* **Logged-in user**
* **Network access**: allow HTTPS to `https://api.p0.app/o/<org-slug>/command/`.

### Syntax

```bash
p0 request <integration> <access-type> [arguments...] [options]
```

A request has three parts, in this order:

1. **Integration and access type.** Two words that say what kind of access you want, such as `aws role`, `okta membership`, or `k8s resource`.
2. **Arguments.** Values you type without a flag name. Each access type has its own arguments, and their order matters. For `aws resource`, the resource ARN comes first and the policies come after it.
3. **Options.** Values that start with `--`, such as `--account 123456789012` or `--reason "Debugging"`. Options can go anywhere after the access type.

For example, in this command `MyReadOnlyRole` is an argument, and `--account` and `--reason` are options:

```bash
p0 request aws role MyReadOnlyRole --account 123456789012 --reason "Investigate S3 access"
```

Quote any value that contains spaces, such as a Kubernetes role or a reason.

{% hint style="info" %}
The integrations you see depend on what your organization has installed and what your access policies let you request. Run `p0 request --help` to list them, and `p0 request <integration> <access-type> --help` to see the arguments and options for one access type.
{% endhint %}

### Options

These options work with every integration:

* `--reason <text>`
  * Why you need access. Approvers see it, and it is kept in the audit log.
* `--duration <duration>`
  * How long you need access, such as `'10 minutes'`, `'2 hours'`, `'5 days'`, or `'1 week'`. Your organization's policy can limit the maximum.
* `-w`, `--wait`
  * Wait until access is granted before the command returns.
* `--help`
  * Show the arguments and options for any integration or access type.

### Supported integrations

Arguments are shown in `<angle brackets>`. Options are shown with `--`. Arguments ending in `...` accept more than one value.

| Integration         | Command                                                         | Common options                                                 |
| ------------------- | --------------------------------------------------------------- | -------------------------------------------------------------- |
| AWS                 | `p0 request aws role <name>`                                    | `--account`                                                    |
|                     | `p0 request aws permission-set <name>`                          | `--account`                                                    |
|                     | `p0 request aws group <name>`                                   | `--account`                                                    |
|                     | `p0 request aws policy <arns...>`                               | `--account`                                                    |
|                     | `p0 request aws resource <arn> <policies...>`                   | `--account`, `--object`                                        |
| Google Cloud        | `p0 request gcloud role <name...>`                              | `--project`                                                    |
|                     | `p0 request gcloud permission <name...>`                        | `--project`                                                    |
|                     | `p0 request gcloud resource <locator> <accesses...>`            | `--project`, `--service`, `--object`                           |
| Microsoft Azure     | `p0 request azure resource <subscription> <resource> <role>`    |                                                                |
| Kubernetes          | `p0 request k8s resource <role>`                                | `--cluster`, `--locator`                                       |
| PostgreSQL          | `p0 request postgres role <name>`                               | `--instance`, `--database`                                     |
|                     | `p0 request postgres sql <query>`                               | `--instance`, `--database`                                     |
| PostgreSQL (legacy) | `p0 request pg role <instance> <role>`                          |                                                                |
|                     | `p0 request pg sql <instance> <text>`                           |                                                                |
| MySQL               | `p0 request mysql role <name>`                                  | `--instance`, `--database`                                     |
|                     | `p0 request mysql sql <query>`                                  | `--instance`, `--database`                                     |
| Snowflake           | `p0 request snowflake role <name>`                              | `--account`, `--user`                                          |
|                     | `p0 request snowflake sql <text>`                               | `--account`, `--user`, `--warehouse`, `--database`, `--schema` |
| Databricks          | `p0 request databricks privilege <catalog> <privileges...>`     | `--schema`, `--table`, `--volume`, `--function`                |
|                     | `p0 request databricks admin <workspace-admin\|account-admin>`  | `--account`, `--workspace`                                     |
| SSH                 | `p0 request ssh session <destination>`                          | `--provider`, `--parent`, `--sudo`                             |
|                     | `p0 request ssh group`                                          | `--name`, `--destination`, `--provider`, `--sudo`              |
|                     | `p0 request ssh parent <parent>`                                | `--provider`, `--sudo`                                         |
|                     | `p0 request ssh all`                                            | `--sudo`                                                       |
| Okta                | `p0 request okta membership <group-name>`                       |                                                                |
| Google Workspace    | `p0 request workspace membership <group-email>`                 |                                                                |
| Entra ID            | `p0 request entra-id membership <group-name-or-id>`             |                                                                |
|                     | `p0 request entra-id assignment <role-name-or-id>`              |                                                                |
| Entra ID (legacy)   | `p0 request azure-ad membership <group-name-or-id>`             |                                                                |
| GitHub              | `p0 request github role <org/repo> <role>`                      |                                                                |
|                     | `p0 request github team <org/team> <member\|maintainer>`        |                                                                |
|                     | `p0 request github force-merge <org>/<repo>/<branch>`           |                                                                |
| Docker Hub          | `p0 request docker role <organization> <member\|editor\|owner>` |                                                                |
| 1Password           | `p0 request 1password item <account> <vault> <item>`            |                                                                |
| Oracle Cloud        | `p0 request oci group <domain-ocid> <group-ocid>`               |                                                                |
| Tailscale           | `p0 request tailscale device <name>`                            | `--organization`                                               |
|                     | `p0 request tailscale tag <name>`                               | `--organization`                                               |
|                     | `p0 request tailscale ssh <name>`                               | `--organization`                                               |
| Salesforce          | `p0 request salesforce permission-set <id...>`                  | `--domain`                                                     |
| Cloudflare          | `p0 request cloudflare group <role...>`                         | `--locator`                                                    |
| Grafana Cloud       | `p0 request grafana-cloud group <team...>`                      | `--locator`                                                    |
| Custom application  | `p0 request app access <locator> <policy...>`                   |                                                                |
| Custom resource     | `p0 request custom resource <application> <item>`               |                                                                |
| AI Gateway          | `p0 request agentic agent <gateway> <server> <id...>`           |                                                                |
| Access bundle       | `p0 request bundle request <bundle-id>`                         |                                                                |

To find valid values for an argument or option, use [p0 ls](/p0-cli/p0-commands-and-usage/p0-ls.md). For example, `p0 ls aws role name` lists the AWS roles you can request.

### Examples

#### AWS IAM role

```bash
p0 request aws role MyReadOnlyRole \
  --account 123456789012 \
  --reason "Investigating S3 access issues" \
  --wait
```

Requests the `MyReadOnlyRole` role in account `123456789012`, and waits until you can use it.

#### AWS Identity Center permission set

```bash
p0 request aws permission-set ReadOnlyAccess --account 123456789012 --duration '4 hours'
```

#### AWS resource

```bash
p0 request aws resource arn:aws:s3:::my-bucket AmazonS3ReadOnlyAccess \
  --account 123456789012 \
  --reason "Read last night's export"
```

The ARN is the first argument. Every value after it is a policy.

#### Google Cloud role

```bash
p0 request gcloud role roles/viewer \
  --project my-gcp-project \
  --reason "Ad-hoc data audit" \
  --wait
```

Requests the `roles/viewer` role on the `my-gcp-project` project, and waits until you can use it.

#### Google Cloud permission

```bash
p0 request gcloud permission compute.instances.get compute.instances.list --project my-gcp-project
```

#### Kubernetes

```bash
p0 request k8s resource "ClusterRole / view" --cluster my-cluster --reason "Check cluster health"
```

Limit the access to one namespace or object with `--locator`, written as `kind / namespace / name`. Use `*` as a wildcard:

```bash
p0 request k8s resource "CuratedRole / port-forward" \
  --cluster my-cluster \
  --locator "Pod / default / nginx-7c5ddbdf54-2xmlp" \
  --reason "Debug the API"
```

You can leave out `--cluster` when your organization has only one cluster. To request access and update your kubeconfig in one step, use [p0 kubeconfig](/p0-cli/p0-commands-and-usage/p0-kubeconfig.md).

#### PostgreSQL

```bash
p0 request postgres role analyst --instance my-instance --database orders --reason "Quarterly report"
```

Request only the permissions a SQL script needs:

```bash
p0 request postgres sql "SELECT * FROM orders WHERE created_at > now() - interval '1 day'" \
  --instance my-instance \
  --database orders
```

See [Requesting PostgreSQL access](/integrations/resource-integrations/postgresql/requesting-postgresql-access.md) for how to connect once access is granted.

#### MySQL

```bash
p0 request mysql role reporting --instance my-instance --reason "Quarterly report"
```

#### Snowflake

```bash
p0 request snowflake role ANALYST --reason "Build the churn dashboard"
```

#### SSH

```bash
p0 request ssh session my-instance --provider aws --sudo --reason "Restart the service"
```

Request access to every instance in an SSH group:

```bash
p0 request ssh group --name web-servers --duration '8 hours'
```

To request access and connect in one step, use [p0 ssh](/p0-cli/p0-commands-and-usage/p0-ssh.md).

#### Okta group

```bash
p0 request okta membership Engineering --reason "On-call shift"
```

#### Google Workspace group

```bash
p0 request workspace membership data-team@example.com
```

#### Entra ID

```bash
p0 request entra-id membership "Finance Readers"
p0 request entra-id assignment "Global Reader"
```

#### Databricks

```bash
p0 request databricks privilege main SELECT --schema sales --table orders --reason "Analyze orders"
```

#### Docker Hub

```bash
p0 request docker role my-docker-org editor --reason "Push a hotfix image"
```

#### 1Password

```bash
p0 request 1password item acme.1password.com Engineering "Prod database" --duration 1d --reason "Rotate the replica's password"
```

#### Access bundle

```bash
p0 request bundle request <bundle-id> --reason "Onboarding"
```