prb access-review command reference

Manage access reviews. This page documents 26 commands under prb access-review.

Flags and examples below come from the command definitions. A Required flag is explicitly marked required by Cobra; an unmarked flag can still be needed by runtime validation or a non-interactive workflow. Empty strings and empty lists are registered defaults, not sample values.

Every command also inherits the global flags. Run prb <command> --help to check your installed version. Replace placeholder IDs and names in source examples before running them. Return to the complete CLI command reference to browse another command.

Commands

Command	Description	Usage	Source
prb access-review	Manage access reviews.	prb access-review <command>	View implementation
prb access-review campaign	Manage access review campaigns.	prb access-review campaign <command>	View implementation
prb access-review campaign add-source	Add a scope source to an access review campaign.	prb access-review campaign add-source <campaign-id>	View implementation
prb access-review campaign cancel	Cancel an access review campaign.	prb access-review campaign cancel <id>	View implementation
prb access-review campaign close	Close an access review campaign.	prb access-review campaign close <id>	View implementation
prb access-review campaign create	Create an access review campaign.	prb access-review campaign create	View implementation
prb access-review campaign delete	Delete an access review campaign.	prb access-review campaign delete <id>	View implementation
prb access-review campaign list	List access review campaigns.	prb access-review campaign list	View implementation
prb access-review campaign remove-source	Remove a scope source from an access review campaign.	prb access-review campaign remove-source <campaign-id>	View implementation
prb access-review campaign start	Start an access review campaign.	prb access-review campaign start <id>	View implementation
prb access-review campaign update	Update an access review campaign.	prb access-review campaign update <campaign-id>	View implementation
prb access-review campaign view	View an access review campaign.	prb access-review campaign view <id>	View implementation
prb access-review entry	Manage access review entries.	prb access-review entry <command>	View implementation
prb access-review entry decide	Record a decision on an access entry.	prb access-review entry decide <entry-id>	View implementation
prb access-review entry decide-all	Record decisions on multiple access entries.	prb access-review entry decide-all	View implementation
prb access-review entry flag	Flag an access entry.	prb access-review entry flag <entry-id>	View implementation
prb access-review entry list	List access entries for a campaign or campaign source.	prb access-review entry list [<campaign-id>]	View implementation
prb access-review source	Manage access sources.	prb access-review source <command>	View implementation
prb access-review source create	Create an access source.	prb access-review source create	View implementation
prb access-review source delete	Delete an access source.	prb access-review source delete <id>	View implementation
prb access-review source list	List access sources.	prb access-review source list	View implementation
prb access-review source setup-aws	Show AWS access source setup values.	prb access-review source setup-aws	View implementation
prb access-review source setup-azure	Show Azure access source setup values.	prb access-review source setup-azure	View implementation
prb access-review source setup-gcp	Show GCP access source setup values.	prb access-review source setup-gcp	View implementation
prb access-review source update	Update an access source.	prb access-review source update <source-id>	View implementation
prb access-review source view	View an access source.	prb access-review source view <id>	View implementation

prb access-review

Manage access reviews.

Usage

prb access-review <command>

View command implementation.

prb access-review campaign

Manage access review campaigns.

Usage

prb access-review campaign <command>

View command implementation.

prb access-review campaign add-source

Add a scope source to an access review campaign.

Usage

prb access-review campaign add-source <campaign-id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--source-id	string	""	Required	Access source ID to add (required)

View command implementation.

prb access-review campaign cancel

Cancel an access review campaign.

Usage

prb access-review campaign cancel <id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--yes, -y	boolean	false	—	Skip confirmation prompt

View command implementation.

prb access-review campaign close

Close an access review campaign.

Usage

prb access-review campaign close <id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--yes, -y	boolean	false	—	Skip confirmation prompt

View command implementation.

prb access-review campaign create

Create an access review campaign.

Usage

prb access-review campaign create

Accepts no positional arguments.

Flags

Flag	Type	Default	Required	Description
--description	string	""	—	Campaign description
--name	string	""	Required	Campaign name (required)
--org	string	""	—	Organization ID
--source-id	string list	[]	—	Access source IDs to include (can be repeated)

View command implementation.

prb access-review campaign delete

Delete an access review campaign.

Usage

prb access-review campaign delete <id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--yes, -y	boolean	false	—	Skip confirmation prompt

View command implementation.

prb access-review campaign list

List access review campaigns.

Usage

prb access-review campaign list

Accepts no positional arguments.

Flags

Flag	Type	Default	Required	Description
--after	string	""	—	Cursor from the previous page (the Next cursor line)
--json	boolean	false	—	Output JSON (same as —output json)
--limit, -L	integer	30	—	Maximum number of campaigns to list
--order-by	string	""	—	Order by field (CREATED_AT)
--order-direction	string	"DESC"	—	Sort direction (ASC, DESC)
--org	string	""	—	Organization ID
--output, -o	string	""	—	Output format: json, table (default)

View command implementation.

prb access-review campaign remove-source

Remove a scope source from an access review campaign.

Usage

prb access-review campaign remove-source <campaign-id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--source-id	string	""	Required	Access source ID to remove (required)

View command implementation.

prb access-review campaign start

Start an access review campaign.

Usage

prb access-review campaign start <id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--yes, -y	boolean	false	—	Skip confirmation prompt

View command implementation.

prb access-review campaign update

Update an access review campaign.

Usage

prb access-review campaign update <campaign-id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--description	string	""	—	Campaign description
--json	boolean	false	—	Output JSON (same as —output json)
--name	string	""	—	Campaign name
--output, -o	string	""	—	Output format: json, table (default)

View command implementation.

prb access-review campaign view

View an access review campaign.

Usage

prb access-review campaign view <id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--json	boolean	false	—	Output JSON (same as —output json)
--output, -o	string	""	—	Output format: json, table (default)

View command implementation.

prb access-review entry

Manage access review entries.

Usage

prb access-review entry <command>

View command implementation.

prb access-review entry decide

Record a decision on an access entry.

Usage

prb access-review entry decide <entry-id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--decision	string	""	Required	Decision to record (APPROVED, REVOKE, DEFER, ESCALATE)
--json	boolean	false	—	Output JSON (same as —output json)
--note	string	""	—	Decision note
--output, -o	string	""	—	Output format: json, table (default)

Examples

# Approve an access entry
prb access-review entry decide <entry-id> --decision APPROVED

# Revoke with a note
prb access-review entry decide <entry-id> --decision REVOKE --note "User left the company"

# Defer a decision
prb access-review entry decide <entry-id> --decision DEFER --note "Need more context"

View command implementation.

prb access-review entry decide-all

Record decisions on multiple access entries.

Usage

prb access-review entry decide-all

Accepts no positional arguments.

Flags

Flag	Type	Default	Required	Description
--decision	string	""	Required	Decision to record (APPROVED, REVOKE, DEFER, ESCALATE)
--entry-id	string list	[]	Required	Access entry IDs (can be repeated)
--json	boolean	false	—	Output JSON (same as —output json)
--note	string	""	—	Decision note (applied to all entries)
--output, -o	string	""	—	Output format: json, table (default)

Examples

# Approve multiple entries
prb access-review entry decide-all --entry-id <id1> --entry-id <id2> --decision APPROVED

# Revoke multiple entries with a note
prb access-review entry decide-all --entry-id <id1> --entry-id <id2> --decision REVOKE --note "Batch cleanup"

View command implementation.

prb access-review entry flag

Flag an access entry.

Usage

prb access-review entry flag <entry-id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--flags	string list	[]	Required	Flags to set (ORPHANED, INACTIVE, EXCESSIVE, ROLE_MISMATCH, NEW, etc.)
--json	boolean	false	—	Output JSON (same as —output json)
--output, -o	string	""	—	Output format: json, table (default)
--reason	string	""	—	Reason for flagging

Examples

# Flag an entry as orphaned
prb access-review entry flag <entry-id> --flags ORPHANED --reason "No matching identity"

# Flag an entry with multiple flags
prb access-review entry flag <entry-id> --flags ORPHANED,INACTIVE --reason "No login in 90 days"

# Clear all flags
prb access-review entry flag <entry-id> --flags ""

View command implementation.

prb access-review entry list

List access entries for a campaign or campaign source.

Usage

prb access-review entry list [<campaign-id>]

Accepts at most 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--account-type	string	""	—	Filter by account type (USER, SERVICE_ACCOUNT)
--active	boolean	false	—	Filter by active status at the source
--after	string	""	—	Cursor from the previous page (the Next cursor line)
--auth-method	string	""	—	Filter by auth method (SSO, PASSWORD, API_KEY, OAUTH2, SSH, SERVICE_ACCOUNT, UNKNOWN)
--decision	string	""	—	Filter by decision (PENDING, APPROVED, REVOKE, DEFER, ESCALATE)
--flag	string	""	—	Filter by flag (NONE, ORPHANED, INACTIVE, EXCESSIVE, ROLE_MISMATCH, NEW)
--is-admin	boolean	false	—	Filter by admin status
--json	boolean	false	—	Output JSON (same as —output json)
--limit, -L	integer	30	—	Maximum number of entries to list
--order-by	string	""	—	Order by field (CREATED_AT)
--order-direction	string	"DESC"	—	Sort direction (ASC, DESC)
--output, -o	string	""	—	Output format: json, table (default)
--source-id	string	""	—	Campaign source ID to list entries for

Examples

# List all entries for a campaign
prb access-review entry list <campaign-id>

# List entries for a specific campaign source
prb access-review entry list --source-id <campaign-source-id>

# List only pending entries
prb access-review entry list <campaign-id> --decision PENDING

# List flagged entries
prb access-review entry list <campaign-id> --flag ORPHANED

View command implementation.

prb access-review source

Manage access sources.

Usage

prb access-review source <command>

View command implementation.

prb access-review source create

Create an access source.

Usage

prb access-review source create

Accepts no positional arguments.

Additional help

Connect the provider first. Create the connector with prb connector create, or with prb connector connect for AWS, GCP, or Azure workload identity, then pass that connector id here. This operation does not collect credentials.

A CSV source is the path with no provider.

Flags

Flag	Type	Default	Required	Description
--connector-account-id	string	""	—	Connector account ID (defaults to the account named by the connector, or its only account)
--connector-id	string	""	—	Connector ID. Connect the provider first; this command does not collect credentials.
--csv-file	string	""	—	Path to CSV file with access data. A CSV source has no provider.
--name	string	""	Required	Access source name (required)
--org	string	""	—	Organization ID

Examples

# Create an access source from a connector that already exists
prb access-review source create --name "GitHub" --connector-id <connector-id>

# Create an access source for one account on that connector
prb access-review source create --name "GitHub" --connector-id <connector-id> \
  --connector-account-id <connector-account-id>

# Create an access source from a CSV file
prb access-review source create --name "Okta Users" --csv-file users.csv

View command implementation.

prb access-review source delete

Delete an access source.

Usage

prb access-review source delete <id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--yes, -y	boolean	false	—	Skip confirmation prompt

View command implementation.

prb access-review source list

List access sources.

Usage

prb access-review source list

Accepts no positional arguments.

Flags

Flag	Type	Default	Required	Description
--after	string	""	—	Cursor from the previous page (the Next cursor line)
--json	boolean	false	—	Output JSON (same as —output json)
--limit, -L	integer	30	—	Maximum number of access sources to list
--order-by	string	""	—	Order by field (CREATED_AT)
--order-direction	string	"DESC"	—	Sort direction (ASC, DESC)
--org	string	""	—	Organization ID
--output, -o	string	""	—	Output format: json, table (default)

View command implementation.

prb access-review source setup-aws

Show AWS access source setup values.

Usage

prb access-review source setup-aws

Accepts no positional arguments.

Flags

Flag	Type	Default	Required	Description
--org	string	""	—	Organization ID

View command implementation.

prb access-review source setup-azure

Show Azure access source setup values.

Usage

prb access-review source setup-azure

Accepts no positional arguments.

Flags

Flag	Type	Default	Required	Description
--org	string	""	—	Organization ID

View command implementation.

prb access-review source setup-gcp

Show GCP access source setup values.

Usage

prb access-review source setup-gcp

Accepts no positional arguments.

Flags

Flag	Type	Default	Required	Description
--org	string	""	—	Organization ID

View command implementation.

prb access-review source update

Update an access source.

Usage

prb access-review source update <source-id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--connector-id	string	""	—	Connector ID to use as data source
--csv-file	string	""	—	Path to CSV file with access data
--json	boolean	false	—	Output JSON (same as —output json)
--name	string	""	—	Access source name
--output, -o	string	""	—	Output format: json, table (default)

View command implementation.

prb access-review source view

View an access source.

Usage

prb access-review source view <id>

Requires 1 positional argument.

Flags

Flag	Type	Default	Required	Description
--json	boolean	false	—	Output JSON (same as —output json)
--output, -o	string	""	—	Output format: json, table (default)

View command implementation.