> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-cli/troubleshooting/p0-request.md). # p0 request Resolve common p0 request errors when requesting just-in-time access from the CLI, including flag, provider, network, and approval workflow issues. Below is a troubleshooting guide for `p0 request`, organized into seven categories. Each section uses a table to show common symptoms, their likely causes, and resolutions. *** ### 1. Authentication & Authorization Failures | Symptom | Cause | Resolution | | ---------------------------------------------------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Error: Permission denied: iam.roles.get on projects/my-project` | P0's service account lacks rights to fetch or provision that resource. | Grant the P0 service account the needed IAM role (e.g. `roles/iam.roleViewer` on GCP, or `iam:GetRole` on AWS). ([Google Cloud](https://cloud.google.com/iam/docs/roles-permissions)) | *** ### 2. Network & Connectivity Issues | Symptom | Cause | Resolution | | ---------------------------------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | | `connect ECONNREFUSED https://api.p0.app/o//command/` | Outbound HTTPS is blocked by firewall or proxy. | Allow HTTPS to your P0 API endpoint. If you're behind a corporate proxy, set `HTTPS_PROXY` / `HTTP_PROXY`. | | `getaddrinfo ENOTFOUND ` | DNS resolution failure for your P0 tenant domain. | Verify DNS can resolve ``. If needed, add an `/etc/hosts` entry or fix your network DNS settings. | | `Request timed out connecting to host` | Extremely slow or unreliable network to the endpoint. | Increase the CLI's HTTP timeout in `~/.p0/config.json` under `"timeout"`, or improve network connectivity. | *** ### 3. Flag & Usage Errors | Symptom | Cause | Resolution | | --------------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | | `unknown option '--lenght'` | Typo in the flag name. | Correct the spelling (`--length`) or run `p0 request --help` to see valid flags. | | `Missing required flag: --reason` | Your org policy mandates a `--reason`, but you omitted it. | Always supply a justification: `--reason "Debugging issue"` | *** ### 4. Subcommand & Provider Validation | Symptom | Cause | Resolution | | -------------------------------------------------------------------------- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------- | | `Subcommand is required for aws. Run 'p0 request aws --help' for details.` | You specified `aws` but didn't include `role`, `resource`, etc. | Add the correct subcommand. e.g.:`p0 request aws role MyReadOnlyRole --reason "Audit"` | *** ### 5. Pagination & Truncation Questions | Symptom | Cause | Resolution | | ---------------------------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | "Showing the first N" though more exist | More results exist than `--size` displays. | Increase `--size` (e.g. `--size 200`), or use `--like ` to filter results and avoid truncation. | | isTruncated=true with no `--like` filter | The backend is signaling more results exist, but you haven't narrowed the query. | Add a search term after your subcommand, e.g.:`p0 ls aws resource logs --like auth` | *** ### 6. Debugging Tips
TaskCommand / Action
Enable debug logsp0 request aws role MyRole --reason "test" --debug
Inspect local configcat ~/.p0/config.jsonVerify fields like appUrl, timeout, proxy settings.
Test API directly
curl -X POST https://api.p0.app/o/<org>/command/ \
-H "Authorization: Bearer $(p0 print-bearer-token)" \
-d '{"argv":["request","aws","role","MyRole"],"scriptName":"p0"}'
Validate Integration StateUse the native CLI/console to confirm resource existence:
aws iam list-roles
gcloud iam roles list --project my-project