Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

KeeperPAM Commands

Management of KeeperPAM functionality including Discovery, Rotation, Connections and Tunneling.

Overview

KeeperPAM functionality including discovery, password rotation, PAM Configuration, Keeper Gateway configuration can be controlled and operated through Commander using the pam command and sub-commands.

PAM Record types command reference and examples are on this page

pam Command

command: pam

Detail: Perform KeeperPAM controls.

My Vault> pam
pam command [--options]

Command     Description
----------  -----------------------------------------
gateway     Manage Gateways
config      Manage PAM Configurations
cnapp       Manage Cloud Security provider configuration and remediation queue
rotation    Manage Rotations
action      Execute action on the Gateway
tunnel      Manage Tunnels
split       Split credentials from legacy PAM Machine
legacy      Switch to legacy PAM commands
connection  Manage Connections
rbi         Manage Remote Browser Isolation
project     PAM Project Import/Export
launch      Launch a connection to a PAM resource
workflow    Manage PAM Workflows

Sub Commands

Sub-Command: gateway

Detail: View, create and remove Keeper Gateway services. To learn more about the Keeper Gateway click here.

list

Lists all gateways accessible by the Commander user. This includes:

  • Gateways directly accessible by the user in their vault.

  • Gateways registered under any managed node from the user's role.

new

edit

Allows updating the gateway's name or registered node. Equivalent actions can be performed in the Admin Console, under Secrets Manager → Gateways.

remove

Removes a gateway. The user executing this command must have admin rights on the gateway's parent application to perform this action.

set-max-instances

Defines maximum gateway pool instances. Used for High Availability integrations.

Sub-Command: config

Detail: View, create, edit and remove Keeper PAM Configurations. To learn more about PAM Configurations click here.

new

edit

list

remove

Sub-Command: cnapp

Detail: Manage Cloud Security provider configuration and the remediation queue used by Keeper Router. This command supports the Cloud Security workflow used with Wiz Integration and Keeper Encrypter.

Sub Commands

Overview

Configuration commands live under pam cnapp config or pam cnapp c.

Queue commands live under pam cnapp queue or pam cnapp q.

Only wiz is currently supported as a provider keyword.

config set

Create or update the CNAPP provider configuration on a network. Credentials are validated against the provider before they are saved.

Flag
Required
Description

--network-uid, -n

Yes

Network record UID in base64url format.

--provider, -p

Yes

Provider keyword. Use wiz.

--client-id

Yes

Provider API client ID or app ID.

--client-secret

No

Provider API client secret. Omit it to keep the existing stored secret when editing an existing configuration.

--api-endpoint

Yes

Provider API endpoint URL. Example: https://api.us1.app.wiz.io/graphql.

--auth-endpoint

Yes

Provider OAuth2 token endpoint URL. Example: https://auth.app.wiz.io/oauth/token.

--config-record

Yes

UID of the vault record that holds the Encrypter URL and encryption key.

On success, the saved configuration is printed.

Use --auth-endpoint to target the correct tenant or region without a code change.

config test

Validate provider credentials without persisting anything.

Flag
Required
Description

--network-uid, -n

Yes

Network record UID in base64url format.

--provider, -p

Yes

Provider keyword. Use wiz.

--client-id

Yes

Provider API client ID.

--client-secret

Yes

Provider API client secret.

--api-endpoint

Yes

Provider API endpoint URL.

--auth-endpoint

Yes

Provider OAuth2 token endpoint URL.

Prints CNAPP credentials validated successfully. on success.

If credentials are rejected, the command returns the provider's reason.

config test-encrypter

Health-check the customer-deployed Encrypter. Keeper Router probes <url>/health.

Flag
Required
Description

--url, -u

Yes

Base URL of the Encrypter. /health is appended automatically.

Use this before config set to confirm the Encrypter is reachable.

Prints Encrypter is reachable. on success.

config read

Read the persisted CNAPP configuration for a network.

The client secret is never returned by the server.

Flag
Required
Description

--network-uid, -n

Yes

Network record UID in base64url format.

--provider, -p

Yes

Provider keyword. Use wiz.

--format

No

Output format. Default: table.

The response includes endpoints, client ID, and Encrypter record UID.

config delete

Remove the CNAPP configuration from a network.

Flag
Required
Description

--network-uid, -n

Yes

Network record UID in base64url format.

The command fails if no configuration exists on the network.

queue list

List queued CNAPP issues for a network.

By default, Commander attempts to decrypt each payload locally so it can show a readable issue summary. See Payload Decryption.

Flag
Required
Description

--network-uid, -n

Yes

Network record UID in base64url format.

--status, -s

No

Filter by status name or numeric ID. Default: all statuses. See Issue Status Values.

--provider, -p

No

Provider keyword used for config lookup. Default: wiz.

--config-record

No

Explicit Encrypter vault record UID. Overrides automatic lookup through config read.

--no-decrypt

No

Skip payload decryption and show only encrypted envelope metadata.

--format

No

Output format. Default: table.

Table output includes Queue ID, Provider, Status, Received UTC, Resolved UTC, associated Record UID, and an issue summary.

Notes

  • If no Encrypter key can be resolved, payloads are shown as <encrypted> and a warning is printed.

  • Pass --config-record <UID> if automatic lookup does not resolve the key.

  • Paging is not available yet. If hasMore is true, resolve or delete returned items to surface the rest.

queue associate

Attach a vault record to a queue item.

Association is required before remediation so the Gateway knows which credential to act on.

Flag
Required
Description

--queue-id, -q

Yes

Queue item ID from queue list.

--record-uid, -r

Yes

Vault record UID to associate, in base64url format.

queue remediate

Dispatch a remediation action to the Gateway for a queued issue.

Flag
Required
Description

--queue-id, -q

Yes

Queue item ID.

--action, -a

Yes

Remediation action. See action types below.

--provider, -p

No

Provider keyword. Optional because Keeper Router resolves it from the queue item when omitted.

--config-record

No

Configuration record UID. Required only for some actions.

--resource-ref

No

Resource reference UID for the action.

--pwd-complexity

No

Password complexity JSON for rotate_credentials.

--controller-uid

No

Override the Gateway UID.

--message-uid

No

Client-generated conversation UID for streaming responses.

--group-name

No

Group name for remove_standing_privilege only.

Action types

Action
Description

rotate_credentials

Rotate the credential associated with the issue.

manage_access

Manage access to the flagged resource.

jit_access

Grant just-in-time access.

remove_standing_privilege

Remove standing privilege. Use with --group-name.

Keeper Router currently dispatches rotate_credentials. Other actions may return an error until they are enabled server-side.

On success, the command prints the dispatched action, resulting status, and any result message.

queue set-status

Update the local status of a queue item.

Keeper Router notifies the provider on a best-effort basis.

Flag
Required
Description

--queue-id, -q

Yes

Queue item ID.

--status, -s

Yes

New status name or numeric ID. 0 or all is not allowed here.

--reason

No

Free-form reason forwarded to the provider notification.

queue delete

Delete a queue item entirely.

Flag
Required
Description

--queue-id, -q

Yes

Queue item ID to delete.

The command fails if the queue ID is unknown.

Issue Status Values

Status flags passed to --status accept either the case-insensitive name or the numeric ID.

Name
ID

pending

1

in_progress

2

resolved

3

failed

4

cancelled

5

For queue list, a status of 0 or an empty value means all statuses.

For queue set-status, 0 and all are rejected.

Payload Decryption

Each queue item payload is stored encrypted. Commander decrypts it locally so it can show a readable summary.

The flow is:

  1. The AES-256-GCM key is taken from the Encrypter record.

  2. The key comes either from --config-record or from cnappConfigRecordUid resolved through config read.

  3. The key is read from the Encrypter vault record's Encryption Key field.

  4. The field can be either a secret or note typed field.

  5. Keys must be 32 bytes and encoded as base64 or base64url.

  6. The payload is unwrapped as AES-256-GCM using nonce, ciphertext, and tag.

  7. The decrypted payload is parsed as JSON.

If the key cannot be resolved, or decryption fails, the issue still appears in the list with <encrypted> in the Issue column.

Use --no-decrypt to skip decryption and show metadata only.

Examples

Validate credentials, then save the configuration

Update an endpoint without changing the stored secret

Read the current configuration as JSON

List all queued issues

List only pending issues without decrypting payloads

List issues with an explicit Encrypter record

Remediate an issue by rotating credentials

Mark an issue resolved with a reason

Delete a queue item

Delete the configuration

Sub-Command: connection

This command will edit the connection parameters and user accounts that are attached to PAM Machine and PAM Database records. The process can also be done in bulk with the run-batch command. To launch the connection, use the Keeper vault or Desktop app.

Prerequisites: Ensure that the PAM user credential, PAM Machine or PAM Database records are staged in a shared folder. Also ensure that there is a gateway configured, and everything is tied together in a PAM Configuration.

edit

examples:

example 1: Creates an RDP connection and assigns an administrative credential and PAM configuration. Activates the connection and screen recording.

example 2: Creates an SSH connection and assigns and administrative credential and PAM configuration. Activates the connection and screen recording while running in silent mode without screen outputs.

example 3: Creates an MSSQL connection and assigns and administrative credential and PAM configuration. Activates the connection and typescript recording.

ai

examples:

example 1: Shows current AI settings on the record.

example 2: Removes all AI settings on the record.

example 3: Sets AI session termination and adds two high risk targets (one set for monitoring/allow other for termination/deny).

jit

examples:

example 1: Shows current JIT settings on the record.

example 2: Removes all JIT settings on the record.

example 3: Configures JIT settings on the record.

Sub-Command: rbi

This command provides the ability to edit remote browser isolation settings for a record.

edit

Sub-Command: rotation

Detail: View and create Keeper Rotation configuration for records.

edit

Example - Set the rotation schedule using JSON

The --schedulejson or -sj params are used to set the schedule via JSON.

Rotate the PAM User record every month, on the 1st, at 4:00AM Chicago time.

Rotate the PAM User record every week on a Saturday, at 10:00PM New York time.

The following are the valid schedule types.

ON DEMAND

The job is triggered manually on demand.

DAILY

The job is triggered every day.

  • type - DAILY

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; The number of days between triggers. Allows ability to skip days.

WEEKLY

The job is triggered every week.

  • type - WEEKLY

  • weekday - Week day name. Must be the full name, all in uppercase.

    • SUNDAY

    • MONDAY

    • TUESDAY

    • WEDNESDAY

    • THURSDAY

    • FRIDAY

    • SATURDAY

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; If set to a value greater than 1, weekday will be ignored. The job will be triggers the multiple times per week starting on Sunday. The day will be based on the value of intervalCount .

MONTHLY_BY_DAY

The job is triggered every month on a specific month day.

  • type - MONTHLY_BY_DAY

  • monthDay - Day of the month. Starts at 1 and goes to max number of days per month. Remeber that 29 can be a leap year day.

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; If set to a value greater than 1, the job will trigger on the monthDay and will re-trigger every intervalCount days.

MONTHLY_BY_WEEKDAY

The job is triggered every month on a specific week day and time.

  • type - MONTHLY_BY_WEEKDAY

  • weekday - Week day name. Must be the full name, in all uppercase.

    • SUNDAY

    • MONDAY

    • TUESDAY

    • WEDNESDAY

    • THURSDAY

    • FRIDAY

    • SATURDAY

  • occurrence - Which week to trigger. If fifth week, use LAST.

    • FIRST

    • SECOND

    • THIRD

    • FOURTH

    • LAST

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; If set, and set to value other than 1, the trigger will start on the weekday and then trigger every intervalCount weeks.

YEARLY

The job is triggered yearly on a specific month, day and time.

  • type - YEARLY

  • month - Month name. Must be the full month name, in all uppercase.

    • JANUARY

    • FEBURARY

    • MARCH

    • APRIL

    • MAY

    • JUNE

    • JULY

    • AUGUST

    • SEPTEMBER

    • OCTOBER

    • NOVEMBER

    • DECEMBER

  • monthDay - Day of the month. Starts at 1 and goes to max number of days per month. Remeber that 29 can be a leap year day.

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; If set, and set to value other than 1, every intervalCount year will be triggered.

Example - Set the password complexity for the PAM User

The --complexity or -x params are used to set the password complexity.

Set the password complexity to create a 20 character password with a minimum of 1 uppercase letter, 4 lowercase letters, 2 digits, and 2 symbols from the symbol set .=+- .

The value is a comma separated value (CSV) style value with the following parts:

  1. Overall password length

  2. Minimum number of uppercase letters.

  3. Minimum number of lowercase letters.

  4. Minimum number of digits.

  5. Minimum number of symbols.

  6. Special set. After last comma, just type the special characters you would like. You are limited to symbols in the following set. If left blank, this symbol set will be used.

list

Display a list of all resources configured for rotation

info

Display information about the rotation settings for a particular resource.

script

Manage post-rotation PAM scripts

Sub-Command: action

Detail: Discovery, rotation and service account management of PAM Resources

gateway-info

Display information about the specific Keeper Gateway.

discover

Manage Discovery jobs

discover start

Start a discovery job

discover status

Display the status of a discovery job

discover remove

Stop a running discovery job

discover process

Process the findings of a discovery job

discover rule

Manage discovery rules

discover rule add

Add a discovery rule

rotate

Issue a credential rotation on the specific resource, folder of resources, or pattern in the resource title. Optionally send an email with a one-time share link through a configured email provider.

job-info

Display information about the running job

job-cancel

Cancel a running job

service list

Display the services and scheduled tasks associated to a specific Keeper Gateway

service add

Add an association for a service to a specific Keeper Gateway and PAM Machine. Once associated, Keeper will update the credentials for that service, on the specific PAM Machine, and restart the service (if running).

service remove

Remove an association for a service on a specific PAM Machine.

Sub-Command: tunnel

Detail: View and create Keeper Tunnels from the local machine to target infrastructure.

start

Start a tunnel from the local device to the target resource

list

Display a list of all available tunnels running

stop

Stop a tunnel that is currently running

tail

Display information in the Keeper tunnel

edit

Edit the configuration of an existing Tunnel

Sub-command: split

Detail: Split a legacy PAM record into the new KeeperPAM format.

Sub-command: project

Detail: Create a KeeperPAM project (similar to the Quick Start Sandbox from the vault user interface).

The PAM Import command helps customers (such as MSPs) with thousands of managed companies to automate the creation of folders, gateways, machines, users, connections, tunnels and (optionally) rotations.

pam project import --name=project1 --filename=/path/to/import.json --dry-run

  • --name, -n → Project name (overrides "project":"" from JSON)

  • --filename, -f → JSON file to load import data from.

  • --dry-run, -d → Test import without modifying vault.

Command Variation: "extend"

The pam project extend command helps customers to create additional records after the initial import that will use same existing PAM Gateway and PAM Configuration.

Import/Extend JSON Documentation

  • A step-by-step guide to importing Windows Servers as PAM Resources from a basic list of server hostnames can be found at this page: Importing PAM Resources

  • A more detailed specification for "pam project import" templates can be found at this GitHub README Page

  • If you require assistance, contact the Commander team (commander@keepersecurity.com).

Sub-Command: launch

Detail: Launch a CLI-based KeeperPAM privileged session. This allows developers to use their preferred native terminal for connecting to a target. When "pam launch" is used, the session activity is recorded and monitored as configured by the resource.

To initiate a connection from the Commander CLI:

From the terminal, sessions can be launched outside of the Commander CLI:

Syntax:

Sub-Command: workflow

Detail: Manage Just-In-Time (JIT) privileged access workflows for PAM resources. Workflows enforce approval-based access control with optional check-in/check-out, MFA verification and time-based access windows.

Workflow configuration commands (create, update, delete, add-approver, remove-approver) require the "Can manage workflow settings" enforcement policy enabled for your role. Users without this enforcement will only see requester and approver commands.

Record owners and approvers (users on a workflow's approver list, either directly or via a team) are exempt from workflow requirements on that record and can access the resource directly.

Sub Commands

create

Create a workflow configuration for a PAM record. At least one approver must be added if approvals are required.

Examples

Create a basic workflow requiring 1 approval with a 1 day access window:

Create a workflow with check-in/check-out, MFA, and reason required:

Create a workflow with temporal access restrictions (weekdays only, business hours):

Allowed days and time ranges are stored in the admin's local IANA timezone (auto-detected when running the command). All access enforcement is performed in this timezone, regardless of where the requester is located. Override at run-time via the TZ environment variable (e.g. TZ=America/New_York pam workflow create ...).

read

Display the current workflow configuration for a record, including parameters, approvers and temporal access filters.

Example

update

Update an existing workflow configuration. Only specified fields are changed; unspecified fields retain their current values.

Example

Enable MFA and change the access duration to 4 hours:

delete

Delete the workflow configuration from a record. This removes all workflow requirements for the resource.

add-approver

Add users or teams as approvers to a workflow. Supports escalation approvers with an optional delay timer. Any user with at least view-only access to the record can be added as an approver. Enterprise administrators can add any team in the enterprise as an approver, even if they are not personally a member of that team.

Examples

Add a user and a team as approvers:

Add an escalation approver that is notified after 1 hour:

remove-approver

Remove users or teams from a workflow's approver list.

Example

pending

List all pending workflow approval requests assigned to the current user. Duplicate entries (when the user is an approver via multiple paths) are automatically filtered.

Example

approve

Approve a pending workflow access request using the flow UID from the pending command.

Example

deny

Deny a pending workflow access request. An optional reason can be provided which is encrypted with the requester's public key.

Example

request

Request access to a workflow-protected PAM resource. Supports escalation of pending requests and cancellation of active requests.

The --cancel flag cannot be used with --escalate, --reason, or --ticket.

Examples

Request access with a reason and ticket number:

Escalate a pending request to escalation approvers:

Cancel a pending or active request:

start

Start a workflow session (check-out). This is required before connecting to the resource when check-in/check-out is enabled. Accepts either a record UID/name or a flow UID.

Example

end

End a workflow session (check-in). Credentials may be rotated after check-in. The --force flag allows approvers to terminate another user's active session when single-user checkout is enabled.

Examples

End your own workflow session:

Force check-in another user's session (approver only):

state

View the current workflow state for a record. Output includes the current Stage, outstanding Conditions, who has the resource checked out, and the list of approvers who have already approved.

Example

Check workflow state by flow UID:

my-access

List all active workflow sessions for the current user across all resources.

Example

Single-User Check-In / Check-Out Mode

When a workflow is created with the --checkout (-co) flag, the resource operates in single-user check-in/check-out mode. This enforces exclusive access - only one user can have the resource checked out at a time.

How it works:

  • After a request is approved, the user must explicitly check out the resource with pam workflow start before they can connect via pam tunnel or pam launch.

  • While the resource is checked out, no other user can check it out until the current session ends.

  • When the user is done, they check in with pam workflow end, which releases the resource and may trigger credential rotation.

  • If a user's session needs to be terminated, an approver can use pam workflow end <uid> --force to forcibly check in the resource.

Without single-user check-out mode: After approval, the user must still run pam workflow start to begin the access session, unless --start-on-approval was set (which starts the access timer automatically upon approval). Multiple users can have concurrent approved access to the same resource.

Visibility: When a resource is checked out, the pam workflow state <record> command shows the Checked out by field with the current user's email.

Force check-in (--force) is only available when single-user checkout is active. It allows approvers to revoke a user's session - for example, if the user is unresponsive or the session has been left open.

Typical Workflow Lifecycle

The following describes a typical end-to-end JIT access workflow:

  1. Administrator creates a workflow on a PAM record: pam workflow create "Prod Server" -n 1 -co -rm -d 2h

  2. Administrator adds approvers: pam workflow add-approver "Prod Server" -u approver@company.com

  3. User requests access: pam workflow request "Prod Server" -r "Deploy hotfix" -t "INC-789"

  4. Approver reviews pending requests: pam workflow pending

  5. Approver approves the request: pam workflow approve xY9zA8bC7dE6

  6. User checks out the resource: pam workflow start "Prod Server"

  7. User is prompted for MFA (if --require-mfa was set), then connects via tunnel or launch: pam tunnel start "Prod Server" or pam launch "Prod Server"

  8. User checks in after completing work: pam workflow end "Prod Server"

Glossary

Term
Definition

Flow UID

Unique identifier for a workflow request instance. Generated when a user requests access; used to approve, deny, start, or end that specific request. Visible in the output of pam workflow pending and pam workflow my-access.

Stage

Current state of a workflow request: Needs Action (no request raised), Waiting (request raised, awaiting approvals or time-window), Ready to Start (approved, awaiting check-out), Started (active session).

Conditions

Outstanding requirements blocking the workflow from advancing. Possible values: Approval Required, Check-in Required, MFA Required, Time Restriction, Reason Required, Ticket Required.

Check-out

Acquiring exclusive access to a resource via pam workflow start. Required when single-user check-in/check-out mode is enabled.

Check-in

Releasing access to a resource via pam workflow end. May trigger credential rotation.

PreviousSharing CommandsNextPAM Extended Commands

Last updated

Was this helpful?