KeeperPAM Commands

Management of KeeperPAM functionality including Discovery, Rotation, Connections and Tunnels

Overview

KeeperPAM functionality including discovery, password rotation, PAM Configuration, Keeper Gateway configuration can be controlled and operated through Python SDK using the pam command and sub-commands.

pam Command

command: pam

Detail: Perform KeeperPAM controls.

Sub Commands

• gateway

• config

• action

• rotation

• connection

• rbi

---

Sub-Command: gateway

View, create and remove Keeper Gateway services. To learn more about the Keeper Gateway

list

Command: pam gateway list

Lists all gateways accessible by the user. This includes:

• Gateways directly accessible by the user in their vault.

• Gateways registered under any managed node from the user's role.

Parameters:

--force -f 
        Force retrieval of gateways
--verbose -v 
        Verbose output
-format {table,json}  
        Output format (table, json)

new

Command: pam gateway new

Command: pam gateway new

Parameters:

--name, -n GATEWAY_NAME 
        Name of the Gateway
--application, -a KSM_APP 
        KSM Application name or UID. Use command `sm app list` to view available            KSM Applications.
--token-expires-in-min, -e TOKEN_EXPIRE_IN_MIN 
        Time for the one time token to expire. Maximum 1440 minutes (24 hrs). Default: 60
--return_value, -r    
        Return value from the command for automation purposes

edit

Allows updating the gateway's name or registered node. Equivalent actions can be performed in the Admin Console, under Secrets Manager → Gateways.

Command: pam gateway edit

Parameters:

--gateway, -g 
                GATEWAY Gateway UID or Name
--name, -n 
                GATEWAY_NAME Name of the Gateway
 --node-id, -i NODE_ID  
                 Node ID

remove

Removes a gateway. The user executing this command must have admin rights on the gateway's parent application to perform this action.

Command: pam gateway remove

Parameters:

--gateway, -g GATEWAY UID of the Gateway

set-max-instances

Defines maximum gateway pool instances.

Command: pam gateway set-max-instances

Parameters:

--gateway, -g GATEWAY Gateway UID or Name

--max-instances, -m MAX_INSTANCES Maximum number of gateway instances (must be >= 1)

---

Sub-Command: config

View, create, edit and remove Keeper PAM Configurations

list

Command: pam config list

Parameters

--config, -c PAM_CONFIGURATION Specific PAM Configuration UID

--verbose, -v Verbose

--format {table,json} Output format (table, json)

new

Command: pam config new

Parameters:

 --environment, -env {local,aws,azure,gcp,domain,oci}  PAM Configuration Type
  --title, -t TITLE     
                        Title of the PAM Configuration
  --gateway, -g GATEWAY_UID 
                        Gateway UID or Name
  --shared-folder, -sf 
                        SHARED_FOLDER_UID Share Folder where this PAM Configuration is stored. Should be one of the folders to which the gateway has access to.
  --schedule, -sc 
                        DEFAULT_SCHEDULE  Default Schedule: Use CRON syntax
  --port-mapping, -pm PORT_MAPPING
                        Port Mapping
  --identity-provider, -idp IDENTITY_PROVIDER_UID
                        Identity Provider UID
  --connections, -c {on,off,default}
                        Set connections permissions
  --tunneling, -u {on,off,default}
                        Set tunneling permissions
  --rotation, -r {on,off,default}
                        Set rotation permissions
  --remote-browser-isolation, -rbi {on,off,default}
                        Set remote browser isolation permissions
  --connections-recording, -cr {on,off,default}
                        Set recording connections permissions for the resource
  --typescript-recording, -tr {on,off,default}
                        Set TypeScript recording permissions for the resource
  --ai-threat-detection {on,off,default}
                        Set AI threat detection permissions
  --ai-terminate-session-on-detection {on,off,default}
                        Set AI session termination on threat detection permissions

network:
  Local network configuration

  --network-id NETWORK_ID
                        Network ID
  --network-cidr NETWORK_CIDR
                        Network CIDR

aws:
  AWS configuration

  --aws-id AWS_ID       AWS ID
  --access-key-id ACCESS_KEY_ID
                        Access Key Id
  --access-secret-key ACCESS_SECRET_KEY
                        Access Secret Key
  --region-name REGION_NAMES
                        Region Names

azure:
  Azure configuration

  --azure-id AZURE_ID   Azure Id
  --client-id CLIENT_ID
                        Client Id
  --client-secret CLIENT_SECRET
                        Client Secret
  --subscription_id SUBSCRIPTION_ID
                        Subscription Id
  --tenant-id TENANT_ID
                        Tenant Id
  --resource-group RESOURCE_GROUPS
                        Resource Group

domain:
  Domain configuration

  --domain-id DOMAIN_ID
                        Domain ID
  --domain-hostname DOMAIN_HOSTNAME
                        Domain hostname
  --domain-port DOMAIN_PORT
                        Domain port
  --domain-use-ssl {true,false}
                        Domain use SSL flag
  --domain-scan-dc-cidr {true,false}
                        Domain scan DC CIDR flag
  --domain-network-cidr DOMAIN_NETWORK_CIDR
                        Domain Network CIDR
  --domain-admin DOMAIN_ADMINISTRATIVE_CREDENTIAL
                        Domain administrative credential

oci:
  OCI configuration

  --oci-id OCI_ID       OCI ID
  --oci-admin-id OCI_ADMIN_ID
                        OCI Admin ID
  --oci-admin-public-key OCI_ADMIN_PUBLIC_KEY
                        OCI admin public key
  --oci-admin-private-key OCI_ADMIN_PRIVATE_KEY
                        OCI admin private key
  --oci-tenancy OCI_TENANCY
                        OCI tenancy
  --oci-region OCI_REGION
                        OCI region

gcp:
  GCP configuration

  --gcp-id GCP_ID       GCP Id
  --service-account-key SERVICE_ACCOUNT_KEY
                        Service Account Key (JSON format)
  --google-admin-email GOOGLE_ADMIN_EMAIL
                        Google Workspace Administrator Email Address
  --gcp-region REGION_NAMES
                        GCP Region Names

edit

Command: pam config edit

Parameters:

--environment, -env {local,aws,azure,gcp,domain,oci}
                        PAM Configuration Type
  --title, -t TITLE     Title of the PAM Configuration
  --gateway, -g GATEWAY_UID
                        Gateway UID or Name
  --shared-folder, -sf SHARED_FOLDER_UID
                        Share Folder where this PAM Configuration is stored. Should be one of the folders to which the gateway has access to.
  --schedule, -sc DEFAULT_SCHEDULE
                        Default Schedule: Use CRON syntax
  --port-mapping, -pm PORT_MAPPING
                        Port Mapping
  --identity-provider, -idp IDENTITY_PROVIDER_UID
                        Identity Provider UID
  --remove-resource-record, -rrr REMOVE_RECORDS
                        Resource Record UID to remove
  --connections, -c {on,off,default}
                        Set connections permissions
  --tunneling, -u {on,off,default}
                        Set tunneling permissions
  --rotation, -r {on,off,default}
                        Set rotation permissions
  --remote-browser-isolation, -rbi {on,off,default}
                        Set remote browser isolation permissions
  --connections-recording, -cr {on,off,default}
                        Set recording connections permissions for the resource
  --typescript-recording, -tr {on,off,default}
                        Set TypeScript recording permissions for the resource

network:
  Local network configuration

  --network-id NETWORK_ID
                        Network ID
  --network-cidr NETWORK_CIDR
                        Network CIDR

aws:
  AWS configuration

  --aws-id AWS_ID       AWS ID
  --access-key-id ACCESS_KEY_ID
                        Access Key Id
  --access-secret-key ACCESS_SECRET_KEY
                        Access Secret Key
  --region-name REGION_NAMES
                        Region Names

azure:
  Azure configuration

  --azure-id AZURE_ID   Azure Id
  --client-id CLIENT_ID
                        Client Id
  --client-secret CLIENT_SECRET
                        Client Secret
  --subscription_id SUBSCRIPTION_ID
                        Subscription Id
  --tenant-id TENANT_ID
                        Tenant Id
  --resource-group RESOURCE_GROUPS
                        Resource Group

domain:
  Domain configuration

  --domain-id DOMAIN_ID
                        Domain ID
  --domain-hostname DOMAIN_HOSTNAME
                        Domain hostname
  --domain-port DOMAIN_PORT
                        Domain port
  --domain-use-ssl {true,false}
                        Domain use SSL flag
  --domain-scan-dc-cidr {true,false}
                        Domain scan DC CIDR flag
  --domain-network-cidr DOMAIN_NETWORK_CIDR
                        Domain Network CIDR
  --domain-admin DOMAIN_ADMINISTRATIVE_CREDENTIAL
                        Domain administrative credential

oci:
  OCI configuration

  --oci-id OCI_ID       OCI ID
  --oci-admin-id OCI_ADMIN_ID
                        OCI Admin ID
  --oci-admin-public-key OCI_ADMIN_PUBLIC_KEY
                        OCI admin public key
  --oci-admin-private-key OCI_ADMIN_PRIVATE_KEY
                        OCI admin private key
  --oci-tenancy OCI_TENANCY
                        OCI tenancy
  --oci-region OCI_REGION
                        OCI region

gcp:
  GCP configuration

  --gcp-id GCP_ID       GCP Id
  --service-account-key SERVICE_ACCOUNT_KEY
                        Service Account Key (JSON format)
  --google-admin-email GOOGLE_ADMIN_EMAIL
                        Google Workspace Administrator Email Address
  --gcp-region REGION_NAMES
                        GCP Region Names

remove

Command: pam config remove

Parameters:

--gateway, -g GATEWAY UID of the Gateway

---

Sub-Command: action

Discovery, rotation and service account management of PAM Resources

gateway-info

Command: pam action gateway-info

Parameters:

--gateway, -g GATEWAY_UID Gateway UID

--verbose, -v Verbose Output

rotate

Issue a credential rotation on the specific resource, folder of resources, or pattern in the resource title.

Command: pam action rotate

Parameters:

--record-uid, -r RECORD_UID
                        Record UID to rotate
  --folder, -f FOLDER   Shared folder UID or title pattern to rotate
  --dry-run, -n         Enable dry-run mode
  --self-destruct <NUMBER>[(m)inutes|(h)ours|(d)ays]
                        Create a one-time share link that expires after a duration
  --email-config EMAIL_CONFIG
                        Email configuration name to use for sending (required with --send-email)
  --send-email SEND_EMAIL
                        Email address to send credentials after rotation
  --email-message EMAIL_MESSAGE
                        Custom message to include in email

job-info

Display information about the running job

Command: pam action job-info

Parameters:

--gateway, -g GATEWAY_UID Gateway UID. Needed only if there are more than one gateway running

job-cancel

Cancel a running job

Command: pam action job-cancel

Parameters:

--gateway, -g GATEWAY_UID Gateway UID. Needed only if there are more than one gateway running

discover start

Start a discovery job

Command: pam action discover start

Parameters:

--gateway, -g GATEWAY
                        Gateway name of UID.
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --resource, -r RESOURCE_UID
                        UID of the resource record. Set to discover specific resource.
  --lang LANGUAGE       Language
  --include-machine-dir-users
                        Include directory users found on the machine.
  --inc-azure-aadds     Include Azure Active Directory Domain Service.
  --skip-rules          Skip running the rule engine.
  --skip-machines       Skip discovering machines.
  --skip-databases      Skip discovering databases.
  --skip-directories    Skip discovering directories.
  --skip-cloud-users    Skip discovering cloud users.

discover status

Display the status of a discovery job

Command: pam action discover status

Parameters:

--gateway, -g GATEWAY
                        Show only discovery jobs from a specific gateway.
  --job-id, -j JOB_ID   Detailed information for a specific discovery job.
  --history             Show history
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID is using --history

discover remove

Stop a running discovery job

Command: pam action discover remove

Parameters:

--job-id, -j JOB_ID Discovery job id.

discover process

Process the findings of a discovery job

Command: pam action discover process

Parameters:

--job-id, -j JOB_ID   Discovery job to process.
--add-all             Respond with ADD for all prompts.
--preview             Preview the results
--debug-gs-level DEBUG_LEVEL
                        GraphSync debug level. Default is 0

discover rule add

Add a discovery rule

Command: pam action discover rule add

Parameters:

 --gateway, -g GATEWAY
                        Gateway name of UID.
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --action, -a {add,ignore,prompt}
                        Action to take if rule matches
  --priority, -p PRIORITY
                        Rule execute priority
  --name, -n NAME       Rule name
  --ignore-case         Ignore value case. Rule value must be in lowercase.
  --shared-folder-uid SHARED_FOLDER_UID
                        Folder to place record.
  --admin-uid ADMIN_UID
                        Admin record UID to use for resource.
  --statement, -s STATEMENT
                        Rule statement

discover rule list

Command: pam action discover rule list

Parameters:

--gateway, -g GATEWAY
                        Gateway name of UID.
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --search, -s SEARCH   Search for rules.

discover rule remove

Command: pam action discover rule remove

Parameters:

--gateway, -g GATEWAY
                        Gateway name of UID.
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --rule-id, -i RULE_ID
                        Identifier for the rule
  --remove-all          Remove all the rules

discover rule update

Command: pam action discover rule update

Parameters:

--gateway, -g GATEWAY
                        Gateway name of UID.
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --rule-id, -i RULE_ID
                        Identifier for the rule
  --action, -a {add,ignore,prompt}
                        Update the action to take if rule matches
  --priority, -p PRIORITY
                        Update the rule execute priority
  --name, -n NAME       Rule name
  --ignore-case         Update the rule to ignore case
  --no-ignore-case      Update the rule to not ignore case
  --shared-folder-uid SHARED_FOLDER_UID
                        Update the folder to place record.
  --admin-uid ADMIN_UID
                        Admin record UID to use for resource.
  --clear-shared-folder-uid
                        Clear shared folder UID, use default.
  --clear-admin-uid     Clear admin UID
  --statement, -s STATEMENT
                        Update the rule statement
  --active              Enable rule.
  --disable             Disable rule.

service list

Display the services and scheduled tasks associated to a specific Keeper Gateway

Command: pam action service list

Parameters:

 --gateway, -g GATEWAY
                        Gateway name or UID
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.

service add

Add an association for a service to a specific Keeper Gateway and PAM Machine. Once associated, Keeper will update the credentials for that service, on the specific PAM Machine, and restart the service (if running).

Command: pam action service add

Parameters:

--gateway, -g GATEWAY
                        Gateway name or UID
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --machine-uid, -m MACHINE_UID
                        The UID of the Windows Machine record
  --user-uid, -u USER_UID
                        The UID of the User record
  --type, -t {service,task,iis}
                        Relationship to add [service, task, iis]

service remove

Remove an association for a service on a specific PAM Machine.

Command: pam action service remove

Parameters:

--gateway, -g GATEWAY
                        Gateway name or UID
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --machine-uid, -m MACHINE_UID
                        The UID of the Windows Machine record
  --user-uid, -u USER_UID
                        The UID of the User record
  --type, -t {service,task,iis}
                        Relationship to remove [service, task, iis]

saas config

Command: pam action saas config

Parameters:

--gateway, -g GATEWAY
                        Gateway name or UID
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --list, -l            List available SaaS rotations.
  --plugin, -p PLUGIN   Plugin name
  --info                Get information about a plugin or plugins being used.
  --create              Create a SaaS Plugin config record.
  --update-config-uid, -u DO_UPDATE
                        Update an existing SaaS configuration.
  --shared-folder-uid, -s SHARED_FOLDER_UID
                        Shared folder to store SaaS configuration.

saas set

Command: pam action saas set

Parameters:

--user-uid, -u USER_UID
                        The UID of the User record
  --config-record-uid, -c CONFIG_RECORD_UID
                        The UID of the record that has SaaS configuration
  --resource-uid, -r RESOURCE_UID
                        The UID of the Resource record, if needed.

saas remove

Command: pam action saas remove

Parameters:

--user-uid, -u USER_UID
                        The UID of the User record
  --resource-uid, -r RESOURCE_UID
                        The UID of the Resource record, if needed.

saas user

Command: pam action saas user

Parameters:

--user-record-uid, -u USER_UID
                                The UID of the User record

saas update

Command: pam action saas update

Parameters:

--gateway, -g GATEWAY
                        Gateway name of UID.
  --configuration-uid CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --all, -a             Update all configurations.
  --config-record-uid, -c CONFIG_UID
                        Update a specific configuration.
  --dry-run             Dry run. Do not save any changes.

debug info

Command: pam action debug info

Parameters:

--record-uid, -i RECORD_UID. Keeper PAM record UID.

debug gateway

Command: pam action debug gateway

Parameters:

--gateway, -g GATEWAY
                        Gateway name or UID
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.

debug graph

Command: pam action debug graph

Parameters:

--gateway, -g GATEWAY
                        Gateway name or UID.
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --type, -t {infra,rl,service,jobs}
                        Graph type
  --raw                 Render raw graph. Will render corrupt graphs.
  --list                List items in a list.
  --render              Render a graph
  --file, -f FILEPATH   Base name for the graph file.
  --format {raw,dot,twopi,patchwork}
                        The format of the graph.
  --debug-gs-level DEBUG_LEVEL
                        GraphSync debug level. Default is 0

debug acl

Command: pam action debug acl

Parameters:

--gateway, -g GATEWAY
                        Gateway name or UID.
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --user-uid, -u USER_UID
                        User UID.
  --parent-uid, -r PARENT_UID
                        Resource or Configuration UID.
  --debug-gs-level DEBUG_LEVEL
                        GraphSync debug level. Default is 0

debug link

Command: pam action debug link

Parameters:

--gateway, -g GATEWAY
                        Gateway name or UID.
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --resource-uid, -r RESOURCE_UID
                        Resource record UID.
  --debug-gs-level DEBUG_LEVEL
                        GraphSync debug level. Default is 0

debug rs-reset

Command: pam action debug rs-reset

Parameters:

--noop                User is part of a No Operation.
  --force               Force reset of the rotation settings.
  --dry-run             Do not create or update anything.
                        PAM resource record UID.
  --resource-record-uid, -r RESOURCE_RECORD_UID
                        PAM configuration record UID.
  --configuration-record-uid, -c CONFIGURATION_RECORD_UID
                        PAM user record UID.
 --user-record-uid, -i USER_RECORD_UID

debug vertex

Command: pam action debug vertex

Parameters:

--gateway, -g GATEWAY
                        Gateway name or UID
  --configuration-uid, -c CONFIGURATION_UID
                        PAM configuration UID, if gateway has multiple.
  --vertex, -i VERTEX_UID
                        Vertex in infrastructure graph

Sub-Command: rotation

View and create Keeper Rotation configuration for records.

list

Display a list of all resources configured for rotation

Command: pam rotation list

Parameters

--verbose, -v Verbose output

info

Display information about the rotation settings for a particular resource.

Command: pam rotation info

Parameters:

--record-uid, -r RECORD_UID. Record UID to rotate

edit

Command: pam rotation edit

Parameters:

--record, -r RECORD_NAME
                        Record UID, name, or pattern to be rotated manually or via schedule
  --folder, -fd FOLDER_NAME
                        Used for bulk rotation setup. The folder UID or name that holds records to be configured
  --force, -f           Do not ask for confirmation
  --config, -c CONFIG   UID or path of the configuration record.
  --iam-aad-config, -iac IAM_AAD_CONFIG_UID
                        UID of a PAM Configuration. Used for an IAM or Azure AD user in place of --resource.
  --rotation-profile, -rp {general,iam_user,scripts_only}
                        Rotation profile type: general (resource-based), iam_user (IAM/Azure user), scripts_only (run PAM scripts only)
  --resource, -rs RESOURCE
                        UID or path of the resource record.
  --schedulejson, -sj SCHEDULE_JSON_DATA
                        JSON of the scheduler. Example: -sj '{"type": "WEEKLY", "utcTime": "15:44", "weekday": "SUNDAY", "intervalCount": 1}'
  --schedulecron, -sc SCHEDULE_CRON_DATA
                        Cron tab string of the scheduler. Example: to run job daily at 5:56PM UTC enter following cron -sc "56 17 * * *"
  --on-demand, -od      Schedule On Demand
  --schedule-config, -sf
                        Schedule from Configuration
  --schedule-only, -so  Only update the rotation schedule without changing other settings
  --complexity, -x PWD_COMPLEXITY
                        Password complexity: length, upper, lower, digits, symbols. Ex. 32,5,5,5,5[,SPECIAL CHARS]
  --admin-user, -a ADMIN
                        UID or path for the PAMUser record to configure the admin credential on the PAM Resource as the Admin when rotating
  --enable, -e          Enable rotation
  --disable, -d         Disable rotation

script list

Command: pam rotation script list

Parameters:

--format {table,csv,json}
                        format of output
  --output OUTPUT       path to resulting output file (ignored for "table" format)

script add

Command: pam rotation script add

Parameters:

 --script SCRIPT       Script file name
  --add-credential ADD_CREDENTIAL
                        Record with rotation credential
  --script-command SCRIPT_COMMAND
                        Script command

script edit

Command: pam rotation script edit

Parameters:

 --script SCRIPT       Script UID or name
  -ac, --add-credential ADD_CREDENTIAL
                        Add a record with rotation credential
  -rc, --remove-credential REMOVE_CREDENTIAL
                        Remove a record with rotation credential
  --script-command SCRIPT_COMMAND
                        Script command

script delete

Command: pam rotation script delete

Parameters:

--script SCRIPT Script UID or name

---

Sub-Command: connection

This command will edit the connection parameters and user accounts that are attached to PAM Machine and PAM Database records. The process can also be done in bulk with the run-batch command.

connection edit

Command: pam connection edit

Parameters:

--configuration, -c CONFIG
                        The PAM Configuration UID or path to use for connections. Use command `pam config list` to view available PAM Configurations.
  --admin-user, -a ADMIN
                        The record path or UID of the PAM User record to configure the admin credential on the PAM Resource
  --launch-user, -lu LAUNCH_USER
                        The record path or UID of the PAM User record to configure as the launch credential on the PAM Resource
  --protocol, -p {,http,kubernetes,mysql,postgresql,rdp,sql-server,ssh,telnet,vnc}
                        Set connection protocol
  --connections, -cn {on,off,default}
                        Set connections permissions
  --connections-recording, -cr {on,off,default}
                        Set recording connections permissions for the resource
  --typescript-recording, -tr {on,off,default}
                        Set TypeScript recording permissions for the resource
  --connections-override-port, -cop CONNECTIONS_OVERRIDE_PORT
                        Port to use for connections. If not provided, the port from the record will be used.
  --key-events, -k {on,off,default}
                        Toggle Key Events settings
  --silent, -s          Silent mode - don't print PAM User, PAM Config etc.

---

Sub-Command: rbi

This command provides the ability to edit remote browser isolation settings for a record.

rbi edit

Command: pam rbi edit

Parameters:

--record, -r RECORD   The record UID or path of the RBI record.
  --configuration, -c CONFIG
                        The PAM Configuration UID or path to use for connections. Use command `pam config list` to view available PAM Configurations.
  --remote-browser-isolation, -rbi {on,off,default}
                        Set RBI permissions
  --connections-recording, -cr {on,off,default}
                        Set recording connections permissions for the resource
  --key-events, -k {on,off,default}
                        Toggle Key Events settings
  --allow-url-navigation, -nav {on,off,default}
                        Allow navigation via direct URL manipulation (on/off/default)
  --ignore-server-cert, -isc {on,off,default}
                        Ignore server certificate errors (on/off/default)
  --allowed-urls, -au ALLOWED_URLS
                        Allowed URL patterns (can specify multiple times)
  --allowed-resource-urls, -aru ALLOWED_RESOURCE_URLS
                        Allowed resource URL patterns (can specify multiple times)
  --autofill-credentials, -a AUTOFILL
                        The record UID or path of the RBI Autofill Credentials record.
  --autofill-targets, -at AUTOFILL_TARGETS
                        Autofill target selectors (can specify multiple times)
  --allow-copy, -cpy {on,off,default}
                        Allow copying to clipboard (on/off/default)
  --allow-paste, -p {on,off,default}
                        Allow pasting from clipboard (on/off/default)
  --disable-audio, -da {on,off,default}
                        Disable audio for RBI sessions (on/off/default)
  --audio-channels, -ac AUDIO_CHANNELS
                        Number of audio channels (e.g., 1 for mono, 2 for stereo)
  --audio-bit-depth, -bd {8,16}
                        Audio bit depth (8 or 16)
  --audio-sample-rate, -sr AUDIO_SAMPLE_RATE
                        Audio sample rate in Hz (e.g., 44100, 48000)
  --silent, -s          Silent mode - don't print PAM User, PAM Config etc.