> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands.md). # KeeperPAM Commands ### Overview KeeperPAM functionality including discovery, password rotation, PAM Configuration, Keeper Gateway configuration can be controlled and operated through Python SDK using the `pam` command and sub-commands. ### **pam Command** **command:** `pam` **Detail:** Perform KeeperPAM controls. **Sub Commands** * [gateway](/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands.md#sub-command-gateway) * [config](/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands.md#sub-command-config) * [action](/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands.md#sub-command-action) * [rotation](/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands.md#sub-command-rotation) * [connection](/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands.md#sub-command-connection) * [rbi](/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands.md#sub-command-rbi) *** ### **Sub-Command: gateway** View, create and remove Keeper Gateway services. To learn more about the Keeper Gateway ### list **Command**: `pam gateway list` Lists all gateways accessible by the user. This includes: * Gateways directly accessible by the user in their vault. * Gateways registered under any managed node from the user's role. **Parameters**: ``` --force -f Force retrieval of gateways --verbose -v Verbose output -format {table,json} Output format (table, json) ``` ### **new** Command: pam gateway new **Command**: `pam gateway new` **Parameters:** ``` --name, -n GATEWAY_NAME Name of the Gateway --application, -a KSM_APP KSM Application name or UID. Use command `sm app list` to view available KSM Applications. --token-expires-in-min, -e TOKEN_EXPIRE_IN_MIN Time for the one time token to expire. Maximum 1440 minutes (24 hrs). Default: 60 --return_value, -r Return value from the command for automation purposes ``` ### edit Allows updating the gateway's name or registered node. Equivalent actions can be performed in the Admin Console, under Secrets Manager → Gateways. **Command**: `pam gateway` edit **Parameters**: ``` --gateway, -g GATEWAY Gateway UID or Name --name, -n GATEWAY_NAME Name of the Gateway --node-id, -i NODE_ID Node ID ``` ### **remove** Removes a gateway. The user executing this command must have admin rights on the gateway's parent application to perform this action. **Command**: `pam gateway remove` **Parameters**: `--gateway, -g GATEWAY` UID of the Gateway ### set-max-instances Defines maximum gateway pool instances. **Command**: `pam gateway set-max-instances` **Parameters:** `--gateway, -g GATEWAY` Gateway UID or Name `--max-instances, -m MAX_INSTANCES` Maximum number of gateway instances (must be >= 1) *** ### **Sub-Command: config** View, create, edit and remove Keeper PAM Configurations #### list **Command**: `pam config list` **Parameters** `--config, -c PAM_CONFIGURATION` Specific PAM Configuration UID `--verbose, -v` Verbose `--format {table,json}` Output format (table, json) #### new Command: `pam config new` **Parameters:** ``` --environment, -env {local,aws,azure,gcp,domain,oci} PAM Configuration Type --title, -t TITLE Title of the PAM Configuration --gateway, -g GATEWAY_UID Gateway UID or Name --shared-folder, -sf SHARED_FOLDER_UID Share Folder where this PAM Configuration is stored. Should be one of the folders to which the gateway has access to. --schedule, -sc DEFAULT_SCHEDULE Default Schedule: Use CRON syntax --port-mapping, -pm PORT_MAPPING Port Mapping --identity-provider, -idp IDENTITY_PROVIDER_UID Identity Provider UID --connections, -c {on,off,default} Set connections permissions --tunneling, -u {on,off,default} Set tunneling permissions --rotation, -r {on,off,default} Set rotation permissions --remote-browser-isolation, -rbi {on,off,default} Set remote browser isolation permissions --connections-recording, -cr {on,off,default} Set recording connections permissions for the resource --typescript-recording, -tr {on,off,default} Set TypeScript recording permissions for the resource --ai-threat-detection {on,off,default} Set AI threat detection permissions --ai-terminate-session-on-detection {on,off,default} Set AI session termination on threat detection permissions network: Local network configuration --network-id NETWORK_ID Network ID --network-cidr NETWORK_CIDR Network CIDR aws: AWS configuration --aws-id AWS_ID AWS ID --access-key-id ACCESS_KEY_ID Access Key Id --access-secret-key ACCESS_SECRET_KEY Access Secret Key --region-name REGION_NAMES Region Names azure: Azure configuration --azure-id AZURE_ID Azure Id --client-id CLIENT_ID Client Id --client-secret CLIENT_SECRET Client Secret --subscription_id SUBSCRIPTION_ID Subscription Id --tenant-id TENANT_ID Tenant Id --resource-group RESOURCE_GROUPS Resource Group domain: Domain configuration --domain-id DOMAIN_ID Domain ID --domain-hostname DOMAIN_HOSTNAME Domain hostname --domain-port DOMAIN_PORT Domain port --domain-use-ssl {true,false} Domain use SSL flag --domain-scan-dc-cidr {true,false} Domain scan DC CIDR flag --domain-network-cidr DOMAIN_NETWORK_CIDR Domain Network CIDR --domain-admin DOMAIN_ADMINISTRATIVE_CREDENTIAL Domain administrative credential oci: OCI configuration --oci-id OCI_ID OCI ID --oci-admin-id OCI_ADMIN_ID OCI Admin ID --oci-admin-public-key OCI_ADMIN_PUBLIC_KEY OCI admin public key --oci-admin-private-key OCI_ADMIN_PRIVATE_KEY OCI admin private key --oci-tenancy OCI_TENANCY OCI tenancy --oci-region OCI_REGION OCI region gcp: GCP configuration --gcp-id GCP_ID GCP Id --service-account-key SERVICE_ACCOUNT_KEY Service Account Key (JSON format) --google-admin-email GOOGLE_ADMIN_EMAIL Google Workspace Administrator Email Address --gcp-region REGION_NAMES GCP Region Names ``` #### edit **Command:** `pam config edit` **Parameters:** ``` --environment, -env {local,aws,azure,gcp,domain,oci} PAM Configuration Type --title, -t TITLE Title of the PAM Configuration --gateway, -g GATEWAY_UID Gateway UID or Name --shared-folder, -sf SHARED_FOLDER_UID Share Folder where this PAM Configuration is stored. Should be one of the folders to which the gateway has access to. --schedule, -sc DEFAULT_SCHEDULE Default Schedule: Use CRON syntax --port-mapping, -pm PORT_MAPPING Port Mapping --identity-provider, -idp IDENTITY_PROVIDER_UID Identity Provider UID --remove-resource-record, -rrr REMOVE_RECORDS Resource Record UID to remove --connections, -c {on,off,default} Set connections permissions --tunneling, -u {on,off,default} Set tunneling permissions --rotation, -r {on,off,default} Set rotation permissions --remote-browser-isolation, -rbi {on,off,default} Set remote browser isolation permissions --connections-recording, -cr {on,off,default} Set recording connections permissions for the resource --typescript-recording, -tr {on,off,default} Set TypeScript recording permissions for the resource network: Local network configuration --network-id NETWORK_ID Network ID --network-cidr NETWORK_CIDR Network CIDR aws: AWS configuration --aws-id AWS_ID AWS ID --access-key-id ACCESS_KEY_ID Access Key Id --access-secret-key ACCESS_SECRET_KEY Access Secret Key --region-name REGION_NAMES Region Names azure: Azure configuration --azure-id AZURE_ID Azure Id --client-id CLIENT_ID Client Id --client-secret CLIENT_SECRET Client Secret --subscription_id SUBSCRIPTION_ID Subscription Id --tenant-id TENANT_ID Tenant Id --resource-group RESOURCE_GROUPS Resource Group domain: Domain configuration --domain-id DOMAIN_ID Domain ID --domain-hostname DOMAIN_HOSTNAME Domain hostname --domain-port DOMAIN_PORT Domain port --domain-use-ssl {true,false} Domain use SSL flag --domain-scan-dc-cidr {true,false} Domain scan DC CIDR flag --domain-network-cidr DOMAIN_NETWORK_CIDR Domain Network CIDR --domain-admin DOMAIN_ADMINISTRATIVE_CREDENTIAL Domain administrative credential oci: OCI configuration --oci-id OCI_ID OCI ID --oci-admin-id OCI_ADMIN_ID OCI Admin ID --oci-admin-public-key OCI_ADMIN_PUBLIC_KEY OCI admin public key --oci-admin-private-key OCI_ADMIN_PRIVATE_KEY OCI admin private key --oci-tenancy OCI_TENANCY OCI tenancy --oci-region OCI_REGION OCI region gcp: GCP configuration --gcp-id GCP_ID GCP Id --service-account-key SERVICE_ACCOUNT_KEY Service Account Key (JSON format) --google-admin-email GOOGLE_ADMIN_EMAIL Google Workspace Administrator Email Address --gcp-region REGION_NAMES GCP Region Names ``` #### remove **Command**: `pam config remove` **Parameters**: `--gateway, -g GATEWAY` UID of the Gateway *** ### **Sub-Command: action** Discovery, rotation and service account management of PAM Resources #### gateway-info **Command**: `pam action gateway-info` **Parameters**: `--gateway, -g GATEWAY_UID` Gateway UID `--verbose, -v` Verbose Output #### rotate Issue a credential rotation on the specific resource, folder of resources, or pattern in the resource title. **Command**: `pam action rotate` **Parameters**: ``` --record-uid, -r RECORD_UID Record UID to rotate --folder, -f FOLDER Shared folder UID or title pattern to rotate --dry-run, -n Enable dry-run mode --self-destruct [(m)inutes|(h)ours|(d)ays] Create a one-time share link that expires after a duration --email-config EMAIL_CONFIG Email configuration name to use for sending (required with --send-email) --send-email SEND_EMAIL Email address to send credentials after rotation --email-message EMAIL_MESSAGE Custom message to include in email ``` #### job-info Display information about the running job **Command**: `pam action job-info` **Parameters**: `--gateway, -g GATEWAY_UID` Gateway UID. Needed only if there are more than one gateway running #### job-cancel Cancel a running job **Command**: `pam action job-cancel` **Parameters:** `--gateway, -g GATEWAY_UID` Gateway UID. Needed only if there are more than one gateway running #### discover start Start a discovery job **Command**: `pam action discover start` **Parameters:** ``` --gateway, -g GATEWAY Gateway name of UID. --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --resource, -r RESOURCE_UID UID of the resource record. Set to discover specific resource. --lang LANGUAGE Language --include-machine-dir-users Include directory users found on the machine. --inc-azure-aadds Include Azure Active Directory Domain Service. --skip-rules Skip running the rule engine. --skip-machines Skip discovering machines. --skip-databases Skip discovering databases. --skip-directories Skip discovering directories. --skip-cloud-users Skip discovering cloud users. ``` #### discover status Display the status of a discovery job **Command**: `pam action discover status` **Parameters**: ``` --gateway, -g GATEWAY Show only discovery jobs from a specific gateway. --job-id, -j JOB_ID Detailed information for a specific discovery job. --history Show history --configuration-uid, -c CONFIGURATION_UID PAM configuration UID is using --history ``` #### discover remove Stop a running discovery job **Command**: `pam action discover remove` **Parameters:** `--job-id, -j JOB_ID` Discovery job id. #### discover process Process the findings of a discovery job **Command**: `pam action discover process` **Parameters:** ``` --job-id, -j JOB_ID Discovery job to process. --add-all Respond with ADD for all prompts. --preview Preview the results --debug-gs-level DEBUG_LEVEL GraphSync debug level. Default is 0 ``` #### discover rule add Add a discovery rule **Command**: `pam action discover rule add` **Parameters:** ``` --gateway, -g GATEWAY Gateway name of UID. --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --action, -a {add,ignore,prompt} Action to take if rule matches --priority, -p PRIORITY Rule execute priority --name, -n NAME Rule name --ignore-case Ignore value case. Rule value must be in lowercase. --shared-folder-uid SHARED_FOLDER_UID Folder to place record. --admin-uid ADMIN_UID Admin record UID to use for resource. --statement, -s STATEMENT Rule statement ``` #### discover rule list **Command**: `pam action discover rule list` **Parameters:** ``` --gateway, -g GATEWAY Gateway name of UID. --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --search, -s SEARCH Search for rules. ``` #### discover rule remove **Command**: `pam action discover rule remove` **Parameters:** ``` --gateway, -g GATEWAY Gateway name of UID. --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --rule-id, -i RULE_ID Identifier for the rule --remove-all Remove all the rules ``` #### discover rule update **Command**: `pam action discover rule update` **Parameters:** ``` --gateway, -g GATEWAY Gateway name of UID. --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --rule-id, -i RULE_ID Identifier for the rule --action, -a {add,ignore,prompt} Update the action to take if rule matches --priority, -p PRIORITY Update the rule execute priority --name, -n NAME Rule name --ignore-case Update the rule to ignore case --no-ignore-case Update the rule to not ignore case --shared-folder-uid SHARED_FOLDER_UID Update the folder to place record. --admin-uid ADMIN_UID Admin record UID to use for resource. --clear-shared-folder-uid Clear shared folder UID, use default. --clear-admin-uid Clear admin UID --statement, -s STATEMENT Update the rule statement --active Enable rule. --disable Disable rule. ``` #### service list Display the services and scheduled tasks associated to a specific Keeper Gateway **Command**: `pam action service list` **Parameters:** ``` --gateway, -g GATEWAY Gateway name or UID --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. ``` #### service add Add an association for a service to a specific Keeper Gateway and PAM Machine. Once associated, Keeper will update the credentials for that service, on the specific PAM Machine, and restart the service (if running). **Command**: `pam action service add` **Parameters:** ``` --gateway, -g GATEWAY Gateway name or UID --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --machine-uid, -m MACHINE_UID The UID of the Windows Machine record --user-uid, -u USER_UID The UID of the User record --type, -t {service,task,iis} Relationship to add [service, task, iis] ``` #### service remove Remove an association for a service on a specific PAM Machine. **Command**: `pam action service remove` **Parameters**: ``` --gateway, -g GATEWAY Gateway name or UID --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --machine-uid, -m MACHINE_UID The UID of the Windows Machine record --user-uid, -u USER_UID The UID of the User record --type, -t {service,task,iis} Relationship to remove [service, task, iis] ``` #### saas config **Command**: `pam action saas config` **Parameters**: ``` --gateway, -g GATEWAY Gateway name or UID --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --list, -l List available SaaS rotations. --plugin, -p PLUGIN Plugin name --info Get information about a plugin or plugins being used. --create Create a SaaS Plugin config record. --update-config-uid, -u DO_UPDATE Update an existing SaaS configuration. --shared-folder-uid, -s SHARED_FOLDER_UID Shared folder to store SaaS configuration. ``` #### saas set **Command**: `pam action saas set` **Parameters**: ``` --user-uid, -u USER_UID The UID of the User record --config-record-uid, -c CONFIG_RECORD_UID The UID of the record that has SaaS configuration --resource-uid, -r RESOURCE_UID The UID of the Resource record, if needed. ``` #### saas remove **Command**: `pam action saas remove` **Parameters:** ``` --user-uid, -u USER_UID The UID of the User record --resource-uid, -r RESOURCE_UID The UID of the Resource record, if needed. ``` #### saas user **Command**: `pam action saas user` **Parameters:** ``` --user-record-uid, -u USER_UID The UID of the User record ``` #### saas update **Command**: `pam action saas update` **Parameters:** ``` --gateway, -g GATEWAY Gateway name of UID. --configuration-uid CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --all, -a Update all configurations. --config-record-uid, -c CONFIG_UID Update a specific configuration. --dry-run Dry run. Do not save any changes. ``` #### debug info **Command**: `pam action debug info` **Parameters**: `--record-uid, -i RECORD_UID.` Keeper PAM record UID. #### debug gateway **Command**: `pam action debug gateway` **Parameters**: ``` --gateway, -g GATEWAY Gateway name or UID --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. ``` #### debug graph **Command**: `pam action debug graph` **Parameters**: ``` --gateway, -g GATEWAY Gateway name or UID. --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --type, -t {infra,rl,service,jobs} Graph type --raw Render raw graph. Will render corrupt graphs. --list List items in a list. --render Render a graph --file, -f FILEPATH Base name for the graph file. --format {raw,dot,twopi,patchwork} The format of the graph. --debug-gs-level DEBUG_LEVEL GraphSync debug level. Default is 0 ``` #### debug acl **Command**: `pam action debug acl` **Parameters**: ``` --gateway, -g GATEWAY Gateway name or UID. --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --user-uid, -u USER_UID User UID. --parent-uid, -r PARENT_UID Resource or Configuration UID. --debug-gs-level DEBUG_LEVEL GraphSync debug level. Default is 0 ``` #### debug link **Command**: `pam action debug link` **Parameters**: ``` --gateway, -g GATEWAY Gateway name or UID. --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --resource-uid, -r RESOURCE_UID Resource record UID. --debug-gs-level DEBUG_LEVEL GraphSync debug level. Default is 0 ``` #### debug rs-reset **Command**: `pam action debug rs-reset` **Parameters:** ``` --noop User is part of a No Operation. --force Force reset of the rotation settings. --dry-run Do not create or update anything. PAM resource record UID. --resource-record-uid, -r RESOURCE_RECORD_UID PAM configuration record UID. --configuration-record-uid, -c CONFIGURATION_RECORD_UID PAM user record UID. --user-record-uid, -i USER_RECORD_UID ``` #### debug vertex **Command**: `pam action debug vertex` **Parameters**: ``` --gateway, -g GATEWAY Gateway name or UID --configuration-uid, -c CONFIGURATION_UID PAM configuration UID, if gateway has multiple. --vertex, -i VERTEX_UID Vertex in infrastructure graph ``` ### Sub-Command: rotation View and create Keeper Rotation configuration for records. #### list Display a list of all resources configured for rotation **Command**: `pam rotation list` **Parameters** `--verbose, -v` Verbose output #### info Display information about the rotation settings for a particular resource. **Command**: pam rotation info **Parameters:** `--record-uid, -r RECORD_UID`. Record UID to rotate #### edit **Command**: `pam rotation edit` **Parameters:** ``` --record, -r RECORD_NAME Record UID, name, or pattern to be rotated manually or via schedule --folder, -fd FOLDER_NAME Used for bulk rotation setup. The folder UID or name that holds records to be configured --force, -f Do not ask for confirmation --config, -c CONFIG UID or path of the configuration record. --iam-aad-config, -iac IAM_AAD_CONFIG_UID UID of a PAM Configuration. Used for an IAM or Azure AD user in place of --resource. --rotation-profile, -rp {general,iam_user,scripts_only} Rotation profile type: general (resource-based), iam_user (IAM/Azure user), scripts_only (run PAM scripts only) --resource, -rs RESOURCE UID or path of the resource record. --schedulejson, -sj SCHEDULE_JSON_DATA JSON of the scheduler. Example: -sj '{"type": "WEEKLY", "utcTime": "15:44", "weekday": "SUNDAY", "intervalCount": 1}' --schedulecron, -sc SCHEDULE_CRON_DATA Cron tab string of the scheduler. Example: to run job daily at 5:56PM UTC enter following cron -sc "56 17 * * *" --on-demand, -od Schedule On Demand --schedule-config, -sf Schedule from Configuration --schedule-only, -so Only update the rotation schedule without changing other settings --complexity, -x PWD_COMPLEXITY Password complexity: length, upper, lower, digits, symbols. Ex. 32,5,5,5,5[,SPECIAL CHARS] --admin-user, -a ADMIN UID or path for the PAMUser record to configure the admin credential on the PAM Resource as the Admin when rotating --enable, -e Enable rotation --disable, -d Disable rotation ``` #### script list **Command**: `pam rotation script list` **Parameters:** ``` --format {table,csv,json} format of output --output OUTPUT path to resulting output file (ignored for "table" format) ``` #### script add **Command**: `pam rotation script add` **Parameters:** ``` --script SCRIPT Script file name --add-credential ADD_CREDENTIAL Record with rotation credential --script-command SCRIPT_COMMAND Script command ``` #### script edit **Command**: `pam rotation script edit` **Parameters:** ``` --script SCRIPT Script UID or name -ac, --add-credential ADD_CREDENTIAL Add a record with rotation credential -rc, --remove-credential REMOVE_CREDENTIAL Remove a record with rotation credential --script-command SCRIPT_COMMAND Script command ``` #### script delete **Command**: `pam rotation script delete` **Parameters**: `--script SCRIPT` Script UID or name *** ### Sub-Command: connection This command will edit the connection parameters and user accounts that are attached to PAM Machine and PAM Database records. The process can also be done in bulk with the **run-batch** command. #### connection edit **Command**: `pam connection edit` **Parameters:** ``` --configuration, -c CONFIG The PAM Configuration UID or path to use for connections. Use command `pam config list` to view available PAM Configurations. --admin-user, -a ADMIN The record path or UID of the PAM User record to configure the admin credential on the PAM Resource --launch-user, -lu LAUNCH_USER The record path or UID of the PAM User record to configure as the launch credential on the PAM Resource --protocol, -p {,http,kubernetes,mysql,postgresql,rdp,sql-server,ssh,telnet,vnc} Set connection protocol --connections, -cn {on,off,default} Set connections permissions --connections-recording, -cr {on,off,default} Set recording connections permissions for the resource --typescript-recording, -tr {on,off,default} Set TypeScript recording permissions for the resource --connections-override-port, -cop CONNECTIONS_OVERRIDE_PORT Port to use for connections. If not provided, the port from the record will be used. --key-events, -k {on,off,default} Toggle Key Events settings --silent, -s Silent mode - don't print PAM User, PAM Config etc. ``` *** ### Sub-Command: rbi This command provides the ability to edit remote browser isolation settings for a record. #### rbi edit **Command**: `pam rbi edit` **Parameters:** ``` --record, -r RECORD The record UID or path of the RBI record. --configuration, -c CONFIG The PAM Configuration UID or path to use for connections. Use command `pam config list` to view available PAM Configurations. --remote-browser-isolation, -rbi {on,off,default} Set RBI permissions --connections-recording, -cr {on,off,default} Set recording connections permissions for the resource --key-events, -k {on,off,default} Toggle Key Events settings --allow-url-navigation, -nav {on,off,default} Allow navigation via direct URL manipulation (on/off/default) --ignore-server-cert, -isc {on,off,default} Ignore server certificate errors (on/off/default) --allowed-urls, -au ALLOWED_URLS Allowed URL patterns (can specify multiple times) --allowed-resource-urls, -aru ALLOWED_RESOURCE_URLS Allowed resource URL patterns (can specify multiple times) --autofill-credentials, -a AUTOFILL The record UID or path of the RBI Autofill Credentials record. --autofill-targets, -at AUTOFILL_TARGETS Autofill target selectors (can specify multiple times) --allow-copy, -cpy {on,off,default} Allow copying to clipboard (on/off/default) --allow-paste, -p {on,off,default} Allow pasting from clipboard (on/off/default) --disable-audio, -da {on,off,default} Disable audio for RBI sessions (on/off/default) --audio-channels, -ac AUDIO_CHANNELS Number of audio channels (e.g., 1 for mono, 2 for stereo) --audio-bit-depth, -bd {8,16} Audio bit depth (8 or 16) --audio-sample-rate, -sr AUDIO_SAMPLE_RATE Audio sample rate in Hz (e.g., 44100, 48000) --silent, -s Silent mode - don't print PAM User, PAM Config etc. ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://newdocs.keeper.io/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.