> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/commander-cli/command-reference/reporting-commands/resolving-record-titles.md).

# Resolving record titles

***

## Showing Record Titles in Audit Reports

By default, audit event data identifies each record by its **Record UID** rather than its title. This is a property of Keeper's zero-knowledge architecture: record titles are encrypted with keys held only by authorized users, so the backend that generates event data cannot decrypt a title to display it. The UID is the only stable record identifier the server can return.

Keeper Commander can resolve those UIDs into human-readable titles locally, where the decryption keys are available. This page describes how to generate an access report that includes the decrypted record title.

Running audit reports requires the Advanced Reporting & Alerts Module (ARAM) add-on. Resolving titles for records the reporting administrator does not own additionally requires the Compliance Reports add-on (see [Title Resolution](#title-resolution) below).

### Command

```
My Vault> audit-report --report-type raw --event-type open_record --report-format fields --max-record-details --format csv --output access.csv
```

This produces a CSV in which each `open_record` event includes the `record_uid`, the decrypted `record_title`, and the `record_url`.

### Parameters

| Parameter                  | Description                                                                                                                                                                                                                                 |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--report-type raw`        | Returns individual events rather than aggregated counts.                                                                                                                                                                                    |
| `--event-type open_record` | Filters to record-access events. Accepts the event **code**, not the console message text (see [Selecting the Event Type](#selecting-the-event-type)).                                                                                      |
| `--report-format fields`   | Breaks each event into one column per attribute. Required for titles to appear (see [Why `--columns` Does Not Work on Raw Reports](#https-app.gitbook.com-o-lo5cazoiggmcwbubw9z-s-mjxoxeifampyvnvl1to-edit-changes-2342-commander-cli-co)). |
| `--max-record-details`     | Allows retrieval of additional record-detail data (title, URL) for records not available locally in cache.                                                                                                                                  |
| `--format csv`             | Output format. One of `table`, `csv`, `json`, `pdf`.                                                                                                                                                                                        |
| `--output access.csv`      | Writes the report to the named file.                                                                                                                                                                                                        |

### Why `--columns` Does Not Work on Raw Reports

On a `raw` report, the `--columns` option is **ignored**. Adding `record_title` to `--columns` and running a raw report returns only UIDs.

For raw reports, the column layout is controlled by `--report-format`:

* `message` (the default when the flag is omitted): a single rendered-sentence column, plus the base set `created, audit_event_type, username, ip_address, keeper_version, geo_location`.
* `fields`: one column per attribute. The `record_uid` field automatically expands to also include `record_title` and `record_url`.

The `--columns` option applies only to the summarized report types (`dim`, `hour`, `day`, `week`, `month`, `span`).

### Selecting the Event Type

`--event-type` expects the event **code**, not the activity-log message. The console string "revealed password on record UID ..." is a display template. There is no `reveal_password` code; passing it returns `bad_inputs_audit_event_type`.

To list the valid event-type codes for your account, run a dimension report:

```
My Vault> audit-report --report-type dim --columns audit_event_type
```

Record-access codes most relevant to "who accessed this credential":

* `open_record` (Opened Record): the user opened the record's detail view.
* `copy_password` (Copied Password to Clipboard): the credential was copied out of the vault.

Keeper does not emit a distinct event for unmasking a password field, so `open_record` is the appropriate access signal.

### Title Resolution

Title resolution operates in two tiers:

1. **Records owned by, or shared with, the administrator running the report** resolve from the local vault cache automatically.
2. **Records the administrator does not hold** (for example, another user's records) resolve from Compliance Reports data. This path is used only when `--max-record-details` is supplied **and** the Compliance Reports add-on is enabled.

{% hint style="info" %} If the report succeeds but the `record_title` column is blank for another user's records, either `--max-record-details` was omitted or Compliance Reports is not enabled on the account. {% endhint %}

### Examples

Display all `open_record` events from the last 30 days with decrypted titles, saved as CSV:

```
My Vault> audit-report --report-type raw --event-type open_record --report-format fields --max-record-details --created last_30_days --format csv --output access.csv
```

Display every record a specific user accessed, with title and URL, forcing detail retrieval for records not held locally:

```
My Vault> audit-report --report-type raw --event-type open_record --report-format fields --max-record-details --username jvangrieken@pid-benelux.com --format table
```

Return all matching rows with no row cap:

```
My Vault> audit-report --report-type raw --event-type open_record --report-format fields --max-record-details --limit -1 --format csv --output access.csv
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/en/keeperpam/commander-cli/command-reference/reporting-commands/resolving-record-titles.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.