opschain security roles review list

Included from Basic tier

Lists the converted grants pending review; --all includes the confirmed ones. The ORIGIN column names the securing prefix each grant was converted from, (widened) when the conversion widened it to the enclosing project; PRINCIPAL is the user (or the group of a group-targeted grant).

opschain security roles review list
ROLE                    TARGET  PRINCIPAL           SCOPE   ORIGIN                                                     REVIEW   ID
security_administrator  user    alice               global  securing_prefix (global)                                   pending  019a...
security_administrator  user    bob                 web     securing_prefix /projects/web/environments/dev (widened)   pending  019a...
security_administrator  group   ldap:policy-admins  global  securing_prefix (global)                                   pending  019a...

-o, --output json|yaml emits the grant rows as a machine document.

Flags

Flag	Meaning
--all	Include converted grants already confirmed.
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--filter <column>[!]=<value>	Keep only rows matching the term (repeatable; terms AND). Columns are the printed table headers lowercased; * wildcards match the whole cell case-insensitively, != negates, commas mean any-of. Applied client-side. Grammar: opschain docs cli.

See also

• opschain docs cli/security-roles-review-confirm
• opschain docs cli/security-roles-review-revoke