Skip to content
Prudai Platform

IRMA CLI reference

This page is generated from irma --help of version 0.2.0. Help texts are in English, like the CLI; the values IRMA returns (severity, status) are Dutch.

Commands under /v1 task layer belong to the task layer and work with the token of a signed-in user. Commands under /agent/v1 work with a service token. Where to start: IRMA for developers: quickstart. Which endpoint a command calls, with every parameter and field: IRMA API reference (Prudai staff only, sign-in required).

Every write is a dry run until you pass --no-dry-run --yes. Exit codes: 0 ok, 2 your input, a refusal, a missing credential or no permission, 1 unknown (network, server error): check before you repeat a write.

Overview

Section titled “Overview”
irma 0.2.0 — command line for IRMA (Prudai's GRC/ISMS platform).


Reads freely; every write is a DRY RUN unless you pass --no-dry-run --yes.
Coding agent? Run `irma guide` first.


Usage: irma <command> [flags]   ·   irma <command> --help


/v1 task layer — user token:
  context                Who you are in IRMA: organization, roles, read scope, modules, frameworks and counts
  risks list             Compact risk list with filters, sorting, paging and a correct total
  risks get              One risk, compact; --include adds scenario, controls, versions or tags
  risks history          Field-level change history of one risk (versions + audit trail), with who changed it (user, assistant, agent, import)
  risk-profile compare   What changed in the risk register between two moments: added, removed, changed
  simulations list       Stored Monte Carlo / VaR runs (newest first) with a 'still current?' verdict per run
  simulations get        One run: parameters, percentiles, top contributors and included risks with their share
  simulations compare    Compare two stored runs: risks only in A or B, shifts, percentile deltas
  simulations preview    Which risks a simulation would include (and why others are excluded)
  simulations run        [write] Start a stored run
  compliance coverage    Coverage and certification readiness of one framework, with the open requirements
  audit checks           Rule-based audit checks per subject (control, risk, requirement, organization)
  audit summary          Completeness score of the audit checks, with the formula, the weights and the count per check
  search                 Search all registers by name (or exact id); typed hits
  registers list         The organization's own registers (Register Builder)
  registers schema       Column definition of one own register
  registers rows         Rows of one own register, paged
  incidents list         The incident register, compact (task layer, user token)
  taxonomy               Id ↔ name of risk areas, categories, tags, departments, projects and document folders


/agent/v1 machine plane — service token irma_sk_…:
  whoami                 Check the service token: organization, token name, scopes
  incident create        [write] Report an incident into IRMA's incident register
  incident list          Incidents visible to the service token (machine plane)
  incident show          One incident with its links (machine plane)


local, no network:
  auth set               Store a token from stdin in the config file (mode 0600)
  auth status            Which API URL and which credentials apply, and where they come from (masked; no network)
  auth unset             Remove one stored token from the config file
  guide                  The contract for coding agents: doors, credentials, write gate, exit codes


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command


Exit codes: 0 ok · 2 your input, a refusal, a missing credential or permission · 1 unknown (network/5xx).

The guide for agents (irma guide)

Section titled “The guide for agents (irma guide)”

An agent reads this first. It is the contract and always matches the installed version.

irma 0.2.0 — guide for coding agents


IRMA is Prudai's GRC/ISMS platform: risks, controls, compliance frameworks, incidents,
registers. It holds real customer data. Read freely; write deliberately.


1. TWO DOORS, TWO CREDENTIALS (never mixed)
   /agent/v1  machine plane, LIVE. Service token irma_sk_… minted by an IRMA admin under
              Beheer → Service-tokens, scoped (incidents:read, incidents:write, …).
              Commands: whoami, incident create|list|show.
   /v1        task layer, LIVE. For now a Keycloak USER access token, the same identity
              and IRMA role as the web app. Service tokens are refused on /v1 today;
              service-token scopes for /v1 (object:verb + bundles, intersected with the
              IRMA role) are coming. Commands: context, risks, risk-profile, simulations,
              compliance, audit, search, registers, incidents, taxonomy.
   Credentials: env IRMA_TOKEN (service) / IRMA_USER_TOKEN (user), or
     printf %s "$TOKEN" | irma auth set --stdin      (file mode 0600)
   NEVER pass a token as a flag (shell history). Check with: irma auth status.
   API origin: https://api.irma.prudai.com (override: IRMA_API_URL or --api-url).


2. START WITH THE DOOR YOU USE
   Incident intake (live): `irma whoami` checks the service token and its scopes.
   /v1: start every task with `irma context --json`. It tells you the organization,
   your roles, your READ SCOPE and what modules exist. readScope beperkt or geen means you
   see less than the organization has: an empty list then does NOT mean nothing exists.
   Say so in your answer. Some routes (simulations, audit checks) refuse a limited read
   scope with 403 scope_te_smal.


3. READ THE ENVELOPE, NOT JUST data
   Every /v1 answer is { data, context, completeness, notIncluded, provenance, next }.
   completeness  returned vs total; truncated; nextOffset; excluded[] with reasons.
                 Never present a page as the whole set. Page with --offset <nextOffset>.
   notIncluded   what this answer does NOT contain and which call has it. Use it.
   provenance    stored data, an engine result (runId/seed/iterations) or a derived
                 comparison. Quote numbers with their provenance; never invent a
                 percentile or a P90 that no run produced.
   next          the logical follow-up calls. Prefer them over guessing endpoints.


4. WRITES ARE DRY RUNS UNLESS --no-dry-run --yes
   Run once, read the plan, then re-run with both flags. Do not add the gate by reflex.
   Agents do not change IRMA's registers directly: what an agent proposes is meant to
   become a DRAFT a human accepts (draft routes are coming; until then, write proposals
   down for a human instead). Incident intake (`irma incident create`) is the exception:
   it files directly, because a monitoring signal must not wait. `irma simulations run`
   stores a calculation result and changes no register.
   The fingerprint deduplicates: the same fingerprint bumps the occurrence count
   instead of creating a duplicate. Derive it from your alert rule, not from the time.
   Per-tool human approval (`x-prudai-approval`) is coming; until then the dry run is
   the only preview you get.


5. EVERYTHING YOU DO IS ATTRIBUTED
   An incident filed with a service token records which token filed it. Changes to risks
   carry their origin (user, assistant, agent, import): `irma risks history <id>` shows it
   per field. Starting a simulation run is written to IRMA's audit trail. Act as if a
   human auditor reads all of it.


6. --json
   stdout = exactly one JSON document: the envelope (or a dry-run plan); on an API error or
   an unexpected response {error,status,message?}; on a local refusal or bad input
   {error,exit,message}. Progress,
   hints and warnings go to stderr. Human mode prints tables.


7. EXIT CODES
   0  fine.
   2  you got it wrong or were refused: bad flags, unknown id (404), invalid input
      (400/409/422), missing credential, 401/403, an unconfirmed write. The message on
      stderr says what. Do not retry unchanged.
   1  something else broke (network, 5xx, unexpected response). Unknown state: check
      before retrying a write.


8. WHAT YOU MAY NOT DO
   A 403 is the design (role, read scope or token scope), not a bug: do not work around
   it and do not ask for a broader credential to get past one command. Do not copy
   customer content into tickets, commits or chat; describe at metadata level (counts,
   status, ids).


Per-command flags: irma <command> --help. Docs: https://docs.prudai.com/en/irma-developers

Per command

Section titled “Per command”

irma context

Section titled “irma context”
irma context


Who you are in IRMA: organization, roles, read scope, modules, frameworks and counts. Call this first.


Usage: irma context
Calls: /v1 task layer — user token


Examples:
  irma context --json


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma risks list

Section titled “irma risks list”
irma risks list


Compact risk list with filters, sorting, paging and a correct total.


Usage: irma risks list [filters]
Calls: /v1 task layer — user token


Flags:
  --q <text>                case-insensitive search in the title
  --status <s>              open | mitigate | accept | avoid | transfer
  --sort <key>              createdAt | title | -grossScore | -netScore | -finImpactVerwacht | -updatedAt
  --fields <a,b>            only these fields (id always stays)
  --detail <concise|full>   full adds description, taxonomy ids, department, controls count
  --include counts          counts per area/category/tag/department/status/level over the filtered set
  --mine                    only risks linked to departments/projects you are a member of (?scope=mijn)
  --bron <b>                provenance: assistent | agent | import | handmatig
  --linked-to <kind:uuid>   afdeling:<uuid> or project:<uuid>
  --risicogebied <uuid>     risk area id
  --risicocategorie <uuid>  risk category id
  --tag <uuid>              risk tag id
  --afdeling <uuid>         owning department id
  --limit <n>               rows per page (default 50, max 200)
  --offset <n>              skip n rows; `completeness.nextOffset` says where the next page starts


Examples:
  irma risks list --sort -netScore --limit 10
  irma risks list --include counts --json


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma risks get

Section titled “irma risks get”
irma risks get


One risk, compact; --include adds scenario, controls, versions or tags.


Usage: irma risks get <id> [--include scenario,maatregelen,versions,tags]
Calls: /v1 task layer — user token


Flags:
  --include <a,b>  scenario | maatregelen | versions | tags


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma risks history

Section titled “irma risks history”
irma risks history


Field-level change history of one risk (versions + audit trail), with who changed it (user, assistant, agent, import).


Usage: irma risks history <id>
Calls: /v1 task layer — user token


Flags:
  --limit <n>   rows per page (default 50, max 200)
  --offset <n>  skip n rows; `completeness.nextOffset` says where the next page starts


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma risk-profile compare

Section titled “irma risk-profile compare”
irma risk-profile compare


What changed in the risk register between two moments: added, removed, changed. --from import = since the first import.


Usage: irma risk-profile compare --from <YYYY-MM-DD|ISO|import> [--to <…>]
Calls: /v1 task layer — user token


Flags:
  --from <moment>  YYYY-MM-DD (end of that day, UTC), ISO datetime, or `import` (required)
  --to <moment>    same forms; omitted = now
  --limit <n>      rows per page (default 50, max 200)
  --offset <n>     skip n rows; `completeness.nextOffset` says where the next page starts


Examples:
  irma risk-profile compare --from import


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma simulations list

Section titled “irma simulations list”
irma simulations list


Stored Monte Carlo / VaR runs (newest first) with a 'still current?' verdict per run.


Usage: irma simulations list [--status bezig|klaar|mislukt]
Calls: /v1 task layer — user token


Flags:
  --status <s>  bezig | klaar | mislukt
  --limit <n>   rows per page (default 50, max 200)
  --offset <n>  skip n rows; `completeness.nextOffset` says where the next page starts


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma simulations get

Section titled “irma simulations get”
irma simulations get


One run: parameters, percentiles, top contributors and included risks with their share.


Usage: irma simulations get <id> [--detail full]
Calls: /v1 task layer — user token


Flags:
  --detail <concise|full>  full adds the histogram
  --limit <n>              rows per page (default 50, max 200)
  --offset <n>             skip n rows; `completeness.nextOffset` says where the next page starts


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma simulations compare

Section titled “irma simulations compare”
irma simulations compare


Compare two stored runs: risks only in A or B, shifts, percentile deltas. Does not recompute.


Usage: irma simulations compare <a> <b>
Calls: /v1 task layer — user token


Flags:
  --limit <n>   rows per page (default 50, max 200)
  --offset <n>  skip n rows; `completeness.nextOffset` says where the next page starts


Examples:
  irma simulations compare 1f0c… 9a2e…


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma simulations preview

Section titled “irma simulations preview”
irma simulations preview


Which risks a simulation would include (and why others are excluded). Stores nothing, but needs write rights on risk management (403 otherwise).


Usage: irma simulations preview [scope filter]
Calls: /v1 task layer — user token


Flags:
  --risiconiveau <a,b>        strategisch | tactisch | operationeel
  --risicogebied <uuid,…>     risk area ids (see `irma taxonomy`)
  --risicocategorie <uuid,…>  risk category ids
  --afdeling <uuid,…>         department ids
  --tag <uuid,…>              risk tag ids (any of)
  --risk <uuid,…>             explicit risk ids
  --limit <n>                 rows per page (default 50, max 200)
  --offset <n>                skip n rows; `completeness.nextOffset` says where the next page starts


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma simulations run

Section titled “irma simulations run”
irma simulations run   [write — dry run unless --no-dry-run --yes]


Start a stored run. Dry run by default: shows the preview and the exact request; nothing is stored until --no-dry-run --yes. Both need write rights on risk management (403 otherwise).


Usage: irma simulations run [--iterations n] [--seed n] [scope filter] [--no-dry-run --yes]
Calls: /v1 task layer — user token


Flags:
  --iterations <n>            number of iterations (the server clamps to its allowed range)
  --seed <n>                  fixed seed for reproducibility; empty = random but recorded
  --risiconiveau <a,b>        strategisch | tactisch | operationeel
  --risicogebied <uuid,…>     risk area ids (see `irma taxonomy`)
  --risicocategorie <uuid,…>  risk category ids
  --afdeling <uuid,…>         department ids
  --tag <uuid,…>              risk tag ids (any of)
  --risk <uuid,…>             explicit risk ids


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma compliance coverage

Section titled “irma compliance coverage”
irma compliance coverage


Coverage and certification readiness of one framework, with the open requirements.


Usage: irma compliance coverage <framework>
Calls: /v1 task layer — user token


Flags:
  --limit <n>   rows per page (default 50, max 200)
  --offset <n>  skip n rows; `completeness.nextOffset` says where the next page starts


Examples:
  irma compliance coverage iso27001-2022


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma audit checks

Section titled “irma audit checks”
irma audit checks


Rule-based audit checks per subject (control, risk, requirement, organization). Read-only; needs a full read scope.


Usage: irma audit checks [--framework <key>] [--outcome fout,waarschuwing] [--subject-type <t>] [--check <id>] [--control <uuid>]
Calls: /v1 task layer — user token


Flags:
  --framework <key>   framework library key (default iso27001-2022)
  --outcome <a,b>     ok | waarschuwing | fout | nvt (comma-separated; only matching checks stay)
  --subject-type <t>  control | risk | requirement | organization
  --check <id>        one check id or family, e.g. maatregel.bewijs-norm
  --control <uuid>    only this control
  --limit <n>         rows per page (default 50, max 200)
  --offset <n>        skip n rows; `completeness.nextOffset` says where the next page starts


Examples:
  irma audit checks --outcome fout --limit 20
  irma audit checks --subject-type control --json


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma audit summary

Section titled “irma audit summary”
irma audit summary


Completeness score of the audit checks, with the formula, the weights and the count per check. Read-only; needs a full read scope.


Usage: irma audit summary [--framework <key>]
Calls: /v1 task layer — user token


Flags:
  --framework <key>  framework library key (default iso27001-2022)


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command
Section titled “irma search”
irma search


Search all registers by name (or exact id); typed hits.


Usage: irma search <text> [--type <t>]
Calls: /v1 task layer — user token


Flags:
  --type <t>  limit to one hit type


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma registers list

Section titled “irma registers list”
irma registers list


The organization's own registers (Register Builder).


Usage: irma registers list
Calls: /v1 task layer — user token


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma registers schema

Section titled “irma registers schema”
irma registers schema


Column definition of one own register.


Usage: irma registers schema <id>
Calls: /v1 task layer — user token


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma registers rows

Section titled “irma registers rows”
irma registers rows


Rows of one own register, paged.


Usage: irma registers rows <id>
Calls: /v1 task layer — user token


Flags:
  --limit <n>   rows per page (default 50, max 200)
  --offset <n>  skip n rows; `completeness.nextOffset` says where the next page starts


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma incidents list

Section titled “irma incidents list”
irma incidents list


The incident register, compact (task layer, user token). For machine intake use `irma incident create`.


Usage: irma incidents list [--status s] [--severity s] [--from ISO] [--to ISO]
Calls: /v1 task layer — user token


Flags:
  --status <s>    nieuw | in_behandeling | afgehandeld
  --severity <s>  laag | middel | hoog | kritiek
  --from <ISO>    occurredAt ≥ from (ISO datetime with offset)
  --to <ISO>      occurredAt ≤ to
  --limit <n>     rows per page (default 50, max 200)
  --offset <n>    skip n rows; `completeness.nextOffset` says where the next page starts


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma taxonomy

Section titled “irma taxonomy”
irma taxonomy


Id ↔ name of risk areas, categories, tags, departments, projects and document folders.


Usage: irma taxonomy
Calls: /v1 task layer — user token


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma whoami

Section titled “irma whoami”
irma whoami


Check the service token: organization, token name, scopes.


Usage: irma whoami
Calls: /agent/v1 machine plane — service token irma_sk_…


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma incident create

Section titled “irma incident create”
irma incident create   [write — dry run unless --no-dry-run --yes]


Report an incident into IRMA's incident register. Dry run by default; the fingerprint deduplicates repeats.


Usage: irma incident create --title <t> --severity <s> --description <d> [options] [--no-dry-run --yes]
Calls: /agent/v1 machine plane — service token irma_sk_…


Flags:
  --title <t>            (alias --titel) required
  --severity <s>         (alias --ernst) laag | middel | hoog | kritiek — required
  --description <d>      (alias --beschrijving) required
  --source-kind <k>      (alias --bron-kind) agent | vps | status-page | manual | other (default agent)
  --source-name <n>      (alias --bron-naam) default: $HOSTNAME or cli
  --source-ref <url|id>  (alias --bron-ref) link back to your ticket/alert
  --fingerprint <key>    dedup key; default sha256(source-name|title|day), 32 hex
  --impact <text>        impact
  --remediation <text>   (alias --remediatie) what has been done already
  --occurred <ISO>       (alias --opgetreden) when it happened, date-time with time zone (default now)


Examples:
  irma incident create --title "Backup failed on db-01" --severity hoog --description "Nightly backup exit 1" --source-kind vps --source-name db-01 --fingerprint backup-db-01-2026-10-24
    # read the dry run, then repeat with --no-dry-run --yes


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma incident list

Section titled “irma incident list”
irma incident list


Incidents visible to the service token (machine plane).


Usage: irma incident list [--status nieuw|in_behandeling|afgehandeld]
Calls: /agent/v1 machine plane — service token irma_sk_…


Flags:
  --status <s>  nieuw | in_behandeling | afgehandeld


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma incident show

Section titled “irma incident show”
irma incident show


One incident with its links (machine plane).


Usage: irma incident show <id>
Calls: /agent/v1 machine plane — service token irma_sk_…


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma auth set

Section titled “irma auth set”
irma auth set


Store a token from stdin in the config file (mode 0600). Never pass a token as a flag.


Usage: irma auth set --stdin [--kind service|user] [--api-url <url>] [--active-org <uuid>]
Calls: local, no network


Flags:
  --stdin                read the token from stdin (required)
  --kind <service|user>  irma_sk_… is detected as service, a JWT as user; pass it when in doubt


Examples:
  printf %s "$TOKEN" | irma auth set --stdin


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma auth status

Section titled “irma auth status”
irma auth status


Which API URL and which credentials apply, and where they come from (masked; no network).


Usage: irma auth status
Calls: local, no network


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma auth unset

Section titled “irma auth unset”
irma auth unset


Remove one stored token from the config file.


Usage: irma auth unset --kind service|user
Calls: local, no network


Flags:
  --kind <service|user>  which one


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command

irma guide

Section titled “irma guide”
irma guide


The contract for coding agents: doors, credentials, write gate, exit codes.


Usage: irma guide
Calls: local, no network


Global flags:
  --json               machine output: stdout is exactly one JSON document (the full envelope); progress and hints go to stderr
  --api-url <url>      API origin (default https://api.irma.prudai.com; env IRMA_API_URL)
  --active-org <uuid>  /v1 only: act in this organization (X-Irma-Active-Org; env IRMA_ACTIVE_ORG)
  --no-dry-run --yes   both required to execute a write; without them a write only shows its plan
  -h, --help           help for the command