PAM Rotation Commands

View and create Keeper Rotation configuration for records.

Rotation List command

Display a list of all resources configured for rotation

DotNet CLI

Command: pam-rotation list

Alias: pam-rot list / pam-rot l

Parameters:

Parameter	Description
--verbose, -v	Include Gateway UID and PAM Configuration UID columns

Examples:

My Vault> pam-rotation list
Syncing PAM data...
Record UID              Record Title                      Record Type  Schedule           Gateway      PAM Configuration (Type)                   
----------------------  --------------------------------  -----------  -----------------  -----------  -------------------------------------------
2fImoc1puL7wyhsynV0Mu8ydkRQ  NG1 - MySQL Rotation User         pamUser      [Manual Rotation]  NG1 Gateway  NG1 Configuration (pamNetworkConfiguration)
YYR3C5lzHG0ndheoZfUVJc8zw2A  NG1 - SSH Admin with Password     pamUser      [Manual Rotation]  NG1 Gateway  NG1 Configuration (pamNetworkConfiguration)

DotNet SDK

Function:

    public static async Task<PamProto.PAMRotationSchedulesResponse> GetRotationSchedulesAsync(IAuthentication auth)
    {
      if (auth == null)
      {
        throw new ArgumentNullException(nameof(auth));
      }

      var request = new PamProto.PAMGenericUidsRequest();
      return await auth.ExecuteRouter<PamProto.PAMRotationSchedulesResponse>(
        GetRotationSchedulesPath,
        request);
    }

Power Commander

Command: Get-KeeperPamRotationList

Alias: pam-rotation-list / pam-rot-list

Parameters:

Parameter	Description
-VerboseOutput, -v	Include Gateway UID and PAM Configuration UID columns

Examples:

PS > Get-KeeperPamRotationList                           
Syncing PAM data...

Record UID             Record Title                       Record Type Schedule          Gateway       PAM Configuration (Type)
----------             ------------                       ----------- --------          -------       ------------------------
ah2zcniqasGsnAAOhZJzV83zeQ Gate1 - MySQL Rotation User        pamUser     [Manual Rotation] Gate1 Gateway Gate1 Configuration (pamNetworkConfiguration)
eYxj7nsyufYf27jr19_sr1aKDQ Gate1 - SSH Admin with Password    pamUser     [Manual Rotation] Gate1 Gateway Gate1 Configuration (pamNetworkConfiguration)
pP0ivRkEARiuatg5jpNydPOGKA Gate1 - SSH Admin with Private Key pamUser     [Manual Rotation] Gate1 Gateway Gate1 Configuration (pamNetworkConfiguration)

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Rotation Info command

Display information about the rotation settings for a particular resource.

DotNet CLI

Command: pam-rotation info

Alias: pam-rot info / pam-rot i

Parameters:

Parameter	Description
--record, -r	Record UID, name, or title
--record-uid	Record UID alias for --record
--format {table,json}	Output format. Default: table

* One of --record or --record-uid is required.

Examples:

My Vault> pam-rotation info --record 2fImoc1puL7nV0Mu8ydkRQ
Rotation Status: Ready to rotate (RrsOnline)
PAM Config UID: R1dgEDZZ00ez02vY2njudgnB7Qg
Node ID: 894448414289341228482
Gateway Name: NG1 Gateway
Gateway UID: ygE7xsutS0ndhau555eiqZEIGZ-33qfQ
Admin Resource Uid: 4orXZIfikFwnahuSFOnj-Q0PM4KMA
Password Complexity: PRpTItpnjdyehwywio-wjwuwnjj2_WUD6DLlriG4x1WT8J3woK_otiTgYx588ID3hEl21-70Ue1Z-1JC07-04b5WZKYZUkdisXy0qK5JvppAvgXtDqJBW5a_ab8wAm6N3CiAbi
Password Complexity Data: 20,4,4,4,4,!@#$%^?();',.=+[]<>{}-_/\*&:"`~|
Is Rotation Disabled: True
Schedule: Manual Rotation

DotNet SDK

Function:

    public static async Task<RouterProto.RouterRotationInfo> GetRotationInfoAsync(
      IAuthentication auth,
      string recordUid)
    {
      if (auth == null)
      {
        throw new ArgumentNullException(nameof(auth));
      }

      if (string.IsNullOrWhiteSpace(recordUid))
      {
        throw new ArgumentException("Record UID is required", nameof(recordUid));
      }

      var request = new PamProto.PAMGenericUidRequest
      {
        Uid = ByteString.CopyFrom(recordUid.Trim().Base64UrlDecode()),
      };

      var response = await auth.ExecuteAuthRest(
        GetRotationInfoEndpoint,
        request,
        typeof(RouterProto.RouterRotationInfo));

      if (response is not RouterProto.RouterRotationInfo rotationInfo)
      {
        throw new InvalidOperationException(
          $"Unexpected response type from {GetRotationInfoEndpoint}: {response?.GetType().Name ?? "null"}");
      }

      return rotationInfo;
    }

Power Commander

Command: Get-KeeperPamRotationInfo

Alias: pam-rotation-info / pam-rot-info

Parameters:

Parameter	Description
-Record, -r	Record UID, name, or title
-RecordUid	Record UID alias for -Record
-Format {table,csv,json}	Output format. Default: table

* One of -Record or -RecordUid is required.

Examples:

PS > Get-KeeperPamRotationInfo -Record qzG2zuiq23cGsnAAOhZJzV83zeQ
Rotation Status: Ready to rotate (RrsOnline)
PAM Config UID: r0GEhsnhyaXL8fQaY3f_cyy_--w
Node ID: 8944484109127814228482
Gateway Name: Gate1 Gateway
Gateway UID: UorQhjoelaoauTNGA4rRzcNd-fQ
Admin Resource Uid: r0GEhsnhyaXL8fQaY3f_cyy_jaahy
Password Complexity: IQwBdlnCE9vj9nshsui6Fk3Gt45AUdXBMP4OM1ple1_p2pEhgyjsnjsuL8tt8QiLqDv7GUAmAZ-AX5KJGyWDwRE3EdDkuc3BrwAUjnUl-oCxFiMOnbWnTUO5qJEAlJS
Password Complexity Data: Length: 20; Lowercase: 4; Uppercase: 4; Digits: 4; Symbols: 4; Special Characters: !@#$%^?();',.=+[]<>{}-_/\*&:"`~|
Is Rotation Disabled: False
Schedule: Manual Rotation

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Rotation Edit command

Create or update PAM record rotation configuration. Use --record for a single record, or --folder for bulk setup.

DotNet CLI

Command: pam-rotation edit

Alias: pam-rot edit / pam-rot e / pam-rotation new / pam-rot new

Parameters:

Parameter	Description
--record, -r	Record UID, name, or pattern
--folder	Folder UID or name for bulk rotation setup
--force, -f	Skip confirmation prompts
--config, -c	PAM configuration UID or title
--iam-aad-config	IAM/Azure AD PAM configuration UID (instead of --resource)
--resource	Admin resource record UID or title
--rotation-profile	Rotation profile: general, iam_user, scripts_only, saas
--saas-config-uid	SaaS configuration UID (for saas profile)
--schedule-json	Rotation schedule JSON
--schedule-cron	Rotation schedule CRON expression
--on-demand	Configure manual (on-demand) rotation
--schedule-config	Inherit schedule from PAM configuration
--schedule-only	Only update rotation schedule
--complexity, -x	Password complexity CSV: length,upper,lower,digits,symbols[,chars]
--complexity-json	Password complexity rules as JSON
--admin-user, -a	PAM user record UID to set as admin credential on resource
--enable, -e	Enable rotation
--disable, -d	Disable rotation

* One of --record or --folder is required (not both).

* Do not combine --resource and --iam-aad-config, or --enable and --disable.

Examples:

My Vault> pam-rotation edit -r "<record-uid>" -c "<configuration-uid>" --resource "<resource-uid>" --on-demand
Syncing PAM data...
Selected 1 PAM record(s) for rotation

The following record(s) will be updated:
Record UID              Record Title                 Enabled  Configuration UID       Resource UID            Schedule   Complexity                                 
----------------------  ---------------------------  -------  ----------------------  ----------------------  ---------  -------------------------------------------
cGsnAAsbsgayOhZJzV83zeQ  Gate1 - MySQL Rotation User  X        8i8quwtfQaY3f_cyy_--w  TmBY8772ataddJ7BgO978nw  On-Demand  20,4,4,4,4,!@#$%^?();',.=+[]<>{}-_/\*&:"`~|


Do you want to update password rotation? [Y/n]: y

DotNet SDK

Function:

    public static async Task SetRecordRotationAsync(IAuthentication auth, RouterProto.RouterRecordRotationRequest request)
    {
      if (auth == null)
      {
        throw new ArgumentNullException(nameof(auth));
      }

      if (request == null)
      {
        throw new ArgumentNullException(nameof(request));
      }

      if (auth.Endpoint is not KeeperEndpoint keeperEndpoint)
      {
        throw new InvalidOperationException("Endpoint must be KeeperEndpoint to use SetRecordRotationAsync");
      }

      await keeperEndpoint.ExecuteRouterRest(
        SetRecordRotationPath,
        auth.AuthContext.SessionToken,
        request.ToByteArray());
    }

Power Commander

Command: Set-KeeperPamRotation

Alias: pam-rotation-edit / pam-rot-edit / pam-rotation-new / pam-rot-new

Parameters:

Parameter	Description
-Record, -r	Record UID, name, or pattern
-Folder, -fd	Folder UID or name for bulk rotation setup
-Force, -f	Skip confirmation prompts
-Config, -c	PAM configuration UID or title
-IamAadConfig, -iac	IAM/Azure AD PAM configuration UID
-Resource, -rs	Admin resource record UID or title
-RotationProfile, -rp	general, iam_user, scripts_only, saas
-SaasConfigUid	SaaS configuration UID (for saas profile)
-ScheduleJson, -sj	Rotation schedule JSON
-ScheduleCron, -sc	Rotation schedule CRON expression
-OnDemand, -od	Configure manual on-demand rotation
-ScheduleConfig, -sf	Inherit schedule from PAM configuration
-ScheduleOnly, -so	Only update rotation schedule
-Complexity, -x	Password complexity CSV
-ComplexityJson	Password complexity rules as JSON
-AdminUser, -a	PAM user record UID for admin credential
-Enable, -e	Enable rotation
-Disable, -d	Disable rotation

* One of -Record or -Folder is required (not both).

Examples:

PS >  Set-KeeperPamRotation -Record "My PAM User" -Config "AWS Config" -Resource "My Server" -OnDemand
Selected 1 PAM record(s) for rotation

The following record(s) will be updated:
Record UID              Record Title                 Enabled  Configuration UID       Resource UID            Schedule   Complexity                                 
----------------------  ---------------------------  -------  ----------------------  ----------------------  ---------  -------------------------------------------
cGsnAAsbsgayOhZJzV83zeQ  Gate1 - MySQL Rotation User  X        8i8quwtfQaY3f_cyy_--w  TmBY8772ataddJ7BgO978nw  On-Demand  20,4,4,4,4,!@#$%^?();',.=+[]<>{}-_/\*&:"`~|


Do you want to update password rotation? [Y/n]: y

PS >

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Rotation Script list command

This command is used to List post-rotation scripts attached to PAM records.

DotNet CLI

Command: pam-rotation script list

Alias: pam-rot script list / pam-rot script l

Parameters:

Parameter	Description
--pattern	Record UID or title filter
--record, -r	Same as --pattern (record filter)
<filter> (positional)	Record UID/title filter

Examples:

My Vault> pam-rotation script list                                                                                                                                                        
Record UID              Title                     Record Type  Script UID              Script Name  Records  Command                    
----------------------  ------------------------  -----------  ----------------------  -----------  -------  ---------------------------
qdWnshsutT6khktOWSFJng  Gate1 - MySQL Admin User  pamUser      BK3wndhuSeSk1BUNwI7r_g  rotate.ps1            powershell -File rotate.ps1

DotNet SDK

Function:

foreach (var keeperRecord in vault.KeeperRecords.OfType<TypedRecord>())
{
    var fields = keeperRecord.Fields
        .OfType<TypedField<FieldScript>>()
        .Where(f =>
            string.Equals(f.FieldName, "script", StringComparison.Ordinal)
            || string.Equals(f.FieldLabel, "rotationScripts", StringComparison.Ordinal));
    foreach (var field in fields)
    {
        foreach (var script in field.Values.Where(s => !string.IsNullOrEmpty(s?.FileRef)))
        {
            Console.WriteLine($"{keeperRecord.Uid} | {script.FileRef} | {script.Command}");
        }
    }
}

Power Commander

Command: Get-KeeperPamRotationScript

Alias: pam-rotation-script-list / pam-rot-script-list

Parameters:

Parameter	Description
-Pattern	Record UID or title filter
-Record, -r	Same as -Pattern

Examples:

PS > Get-KeeperPamRotationScript
Record UID              Title                     Record Type  Script UID              Script Name  Records  Command                    
----------------------  ------------------------  -----------  ----------------------  -----------  -------  ---------------------------
qdWnshsutT6khktOWSFJng  Gate1 - MySQL Admin User  pamUser      BK3wndhuSeSk1BUNwI7r_g  rotate.ps1            powershell -File rotate.ps1

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Rotation Script add command

This command is used to Upload a local script file and attaches it as a post-rotation script.

DotNet CLI

Command: pam-rotation script add

Alias: pam-rot script add / pam-rot script new / pam-rot script a

Parameters:

Parameter	Description
--record, -r / <record> (positional)	Record UID or title (pamUser / pamDirectory)
--script / <script> (positional)	Local script file path to upload
--run-command	Command line to run the script after rotation
--script-command	Alias for --run-command (unless value is a subcommand name)
--add-credential	Record UID(s) with rotation credentials to link

Examples:

My Vault> pam-rotation script add --record "<record-uid>" --script "C:\\Users\\AnanthReddyMandli\\Documents\\GitHub\\Temp\\rotate.ps1" --run-command "powershell -File rotate.ps1"
Script added to record 'Gate1 - MySQL Admin User' (kepo6sqdWT6khktOWSFJng).

DotNet SDK

Function:

var record = (TypedRecord)vault.GetKeeperRecord(recordUid);
// Ensure script field exists
var scriptField = record.Fields
    .OfType<TypedField<FieldScript>>()
    .FirstOrDefault(f =>
        string.Equals(f.FieldName, "script", StringComparison.Ordinal)
        || string.Equals(f.FieldLabel, "rotationScripts", StringComparison.Ordinal));
if (scriptField == null)
{
    scriptField = new TypedField<FieldScript>("script", "rotationScripts");
    record.Fields.Add(scriptField);
}
var facade = new TypedRecordFacade<TypedRecordFileRef>(record);
var preRefs = new HashSet<string>(
    facade.Fields.FileRef?.Values ?? Enumerable.Empty<string>(),
    StringComparer.Ordinal);
using (var uploadTask = new FileAttachmentUploadTask(filePath, isScript: true))
{
    await vault.UploadAttachment(record, uploadTask);
}
var postRefs = new HashSet<string>(
    facade.Fields.FileRef?.Values ?? Enumerable.Empty<string>(),
    StringComparer.Ordinal);
var newUids = postRefs.Except(preRefs).ToList();
if (newUids.Count != 1)
{
    throw new InvalidOperationException(
        "Failed to determine uploaded script file UID. Only the record owner can attach post-rotation scripts.");
}
// Move file out of generic fileRef into script field
facade.Fields.FileRef?.Values.Remove(newUids[0]);
scriptField.Values.Add(new FieldScript
{
    FileRef = newUids[0],
    Command = "powershell -File rotate.ps1",
    RecordRef = new[] { credentialUid },
});
await vault.UpdateRecord(record);

Power Commander

Command: Add-KeeperPamRotationScript

Alias: pam-rotation-script-add / pam-rot-script-add

Parameters:

Parameter	Description
-Record, -r / positional	Record UID or title
-RecordUid	Record UID alias
-Script / positional	Local script file path
-RunCommand	Command line to run after rotation
-ScriptCommand	Alias for -RunCommand
-AddCredential, -ac	Credential record UID(s) to link

Examples:

PS > Add-KeeperPamRotationScript -Record <UID> -Script "C:\scripts\rotate.ps1" -RunCommand "powershell -File rotate.ps1"
Script added to record 'Gate1 - MySQL Admin User' (kepo6sqdWT6khktOWSFJng).

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Rotation Script edit command

This command is used to Update an existing post-rotation script on a PAM record.

DotNet CLI

Command: pam-rotation script edit

Alias: pam-rot script edit / pam-rot script e

Parameters:

Parameter	Description
--record, -r / <record> (positional)	Record UID or title
--script / <script> (positional)	Script file UID or name to update
--run-command	New command line to run the script
--script-command	Alias for --run-command
--add-credential	Credential record UID(s) to link
--remove-credential	Credential record UID(s) to unlink

Examples:

My Vault> pam-rotation script edit --record kepo6smju76qdWT6khktOWSFJng --script rotate.ps1 --run-command "powershell -File rotate.ps1"
Script updated on record 'Gate1 - MySQL Admin User' (kepo6smju76qdWT6khktOWSFJng ).
Command: powershell -File rotate.ps1

DotNet SDK

Function:

var record = (TypedRecord)vault.GetKeeperRecord(recordUid);
var scriptField = record.Fields
    .OfType<TypedField<FieldScript>>()
    .FirstOrDefault(f =>
        string.Equals(f.FieldName, "script", StringComparison.Ordinal)
        || string.Equals(f.FieldLabel, "rotationScripts", StringComparison.Ordinal));

FieldScript scriptValue = null;
foreach (var script in scriptField.Values)
{
    if (string.Equals(script.FileRef, scriptUidOrName, StringComparison.OrdinalIgnoreCase))
    {
        scriptValue = script;
        break;
    }

    if (vault.TryGetKeeperRecord(script.FileRef, out var fileKeeper)
        && fileKeeper is FileRecord fileRecord
        && (string.Equals(fileRecord.Title, scriptUidOrName, StringComparison.OrdinalIgnoreCase)
            || string.Equals(fileRecord.Name, scriptUidOrName, StringComparison.OrdinalIgnoreCase)))
    {
        scriptValue = script;
        break;
    }
}

var refs = new HashSet<string>(scriptValue.RecordRef ?? Array.Empty<string>(), StringComparer.Ordinal);
refs.Remove(credentialUidToRemove);
refs.Add(credentialUidToAdd);
scriptValue.RecordRef = refs.ToArray();
scriptValue.Command = "powershell -File rotate_v2.ps1";

await vault.UpdateRecord(record);

Power Commander

Command: Set-KeeperPamRotationScript

Alias: pam-rotation-script-edit / pam-rot-script-edit

Parameters:

Parameter	Description
-Record, -r / positional	Record UID or title
-RecordUid	Record UID alias
-Script / positional	Script file UID or name
-RunCommand	New command line to run
-ScriptCommand	Alias for -RunCommand
-AddCredential, -ac	Credential record UID(s) to link
-RemoveCredential, -rc	Credential record UID(s) to unlink

Examples:

PS > Set-KeeperPamRotationScript -Record <UID> -Script rotate.ps1 -RunCommand "powershell -File rotate.ps1"
Script updated on record 'Gate1 - MySQL Admin User' (kepo6smju76qdWT6khktOWSFJng ).
Command: powershell -File rotate.ps1

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Rotation Script delete command

This command is used to remove a post-rotation script from a PAM record.

DotNet CLI

Command: pam-rotation script delete

Alias: pam-rot script delete / pam-rot script d

Parameters:

Parameter	Description
--record, -r / <record> (positional)	Record UID or title
--script / <script> (positional)	Script file UID or name to remove

Examples:

My Vault>  pam-rotation script delete --record kepo6sq145uydWT6khktOWSFJng --script rotate.ps1
Script removed from record 'Gate1 - MySQL Admin User' (kepo6sq145uydWT6khktOWSFJng ).

DotNet SDK

Function:

var record = (TypedRecord)vault.GetKeeperRecord(recordUid);
var scriptField = record.Fields
    .OfType<TypedField<FieldScript>>()
    .FirstOrDefault(f =>
        string.Equals(f.FieldName, "script", StringComparison.Ordinal)
        || string.Equals(f.FieldLabel, "rotationScripts", StringComparison.Ordinal));

var scriptValue = scriptField.Values
    .FirstOrDefault(s => string.Equals(s.FileRef, scriptUid, StringComparison.OrdinalIgnoreCase));

scriptField.Values.Remove(scriptValue);
await vault.UpdateRecord(record);

Power Commander

Command: Remove-KeeperPamRotationScript

Alias: pam-rotation-script-delete / pam-rot-script-delete

Parameters:

Parameter	Description
-Record, -r / positional	Record UID or title
-RecordUid	Record UID alias
-Script / positional	Script file UID or name

Examples:

PS >  Remove-KeeperPamRotationScript -Record <UID> -Script rotate.ps1
Script removed from record 'Gate1 - MySQL Admin User' (kepo6sq14snaha5uydWT6khktOWSFJng ).

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon