PAM Action Commands

Discovery, rotation and service account management of PAM Resources

Action Rotate command

Triggers an on-demand credential rotation through the Keeper Gateway for a single vault record, or for all pamUser records in shared folders matching a UID or title pattern. This schedules a gateway job; it does not configure rotation schedules (use pam-rotation edit for that). Requires the enterprise enforcement that allows credential rotation.

DotNet CLI

Command: pam-action rotate

Alias: pam-act rotate / pam-act r

Parameters:

Parameter	Description
--record-uid, -r	Record UID to rotate
--folder, -f	Shared folder UID or title regex pattern; rotates all pamUser records in matching folders
--dry-run, -n	Folder mode only: report how many folders/records would rotate, without scheduling jobs

*Either --record-uid or --folder is required.

Examples:

My Vault> pam-action rotate --record-uid <RECORD_UID>
My Vault> pam-action rotate -r <RECORD_UID>
My Vault> pam-action rotate --folder <SHARED_FOLDER_UID>
My Vault> pam-action rotate -f "Prod.*" --dry-run
My Vault> pam-act r -r <RECORD_UID>

DotNet SDK

Function:

using KeeperSecurity.Plugins.PAM;

// Single-record on-demand rotate
var rotateResult = await ActionUtils.RotateAsync(vault, new PamRotateOptions
{
    RecordUid = "<RECORD_UID>"
});

if (rotateResult.RecordResult?.IsScheduled == true)
{
    var jobId = rotateResult.RecordResult.ConversationId;
    var gatewayUid = rotateResult.RecordResult.GatewayUid;
    Console.WriteLine($"Scheduled action id: {jobId}");

    var job = await ActionUtils.GetJobInfoAsync(vault.Auth, jobId, gatewayUid);
    if (job.JobInfo != null)
    {
        Console.WriteLine($"Status: {job.JobInfo.Status}");
        Console.WriteLine($"Duration: {job.JobInfo.Duration}");
        Console.WriteLine($"Message: {job.JobInfo.ResponseMessage}");
    }
}

// Folder-mode dry run (pamUser records only)
var folderPreview = await ActionUtils.RotateAsync(vault, new PamRotateOptions
{
    Folder = "<SHARED_FOLDER_UID_OR_TITLE_PATTERN>",
    DryRun = true
});
Console.WriteLine(
    $"Folders: {folderPreview.FolderResult.FolderCount}, Records: {folderPreview.FolderResult.RecordCount}");

// Folder-mode live rotate
var folderLive = await ActionUtils.RotateAsync(vault, new PamRotateOptions
{
    Folder = "<SHARED_FOLDER_UID_OR_TITLE_PATTERN>",
    DryRun = false
});

Power Commander

Command: Invoke-KeeperPamActionRotate

Alias: pam-action-rotate Parameters:

Parameter	Description
-RecordUid, -r	PAM user record UID to rotate
-Folder, -f	Shared folder UID or title pattern (rotates pamUser records)
-DryRun, -n	Folder only — list selection without rotating

Examples:

PS > Invoke-KeeperPamActionRotate -RecordUid "32gU_yrxxWdOCqkiWW4gRw"
Scheduled action id: <conversation-id>
The action has been scheduled, use command 'Get-KeeperPamActionJobInfo -JobId "<conversation-id>"' to get status of the scheduled action

PS > Invoke-KeeperPamActionRotate -Folder "tVjvRq_gbPBRF5kO3noYGw" -DryRun
Selected for rotation - folders: 1, records: 7

PS > pam-action-rotate -r "32gU_yrxxWdOCqkiWW4gRw"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Action Job-info command

Queries the status of a previously scheduled PAM gateway job (for example after pam-action rotate). Quote job IDs that contain /. When more than one gateway is running, pass --gateway.

DotNet CLI

Command: pam-action job-info

Alias: pam-act job-info / pam-act ji

Parameters:

Parameter	Description
<job_id> (positional)	Conversation / job id returned by rotate (or another gateway action)
--gateway, -g	Gateway UID when multiple gateways are available

Examples:

My Vault> pam-action job-info "<JOB_ID>"
My Vault> pam-action job-info "<JOB_ID>" --gateway <GATEWAY_UID>
My Vault> pam-act ji "<JOB_ID>" -g <GATEWAY_UID>

DotNet SDK

Function:

    public static Dictionary<string, TypedRecord> GetConfigurationRecords(VaultOnline vault)
    {
      if (vault == null)
      {
        return new Dictionary<string, TypedRecord>();
      }

      return vault.KeeperRecords
        .OfType<TypedRecord>()
        .Where(x => PamRecordTypes.Configuration.Contains(x.TypeName ?? ""))
        .ToDictionary(x => x.Uid, x => x);
    }

Power Commander

Command: Get-KeeperPamActionJobInfo

Alias: pam-action-job-info

Parameters:

Parameter	Description
-JobId, -j	Scheduled action / conversation id (quote if it contains /)
-Gateway, -g	Gateway UID when multiple gateways exist

Examples:

PS > Get-KeeperPamActionJobInfo -JobId "<conversation-id>"
Job id to check [<conversation-id>]
Execution Details
-------------------------
        Status              : finished
        Duration            : 00:00:12
        Response Message    : ...

PS > pam-action-job-info -j "<conversation-id>" -Gateway "9uUuUYaQThmhKSjQ8foCdw"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon