> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands/pam-rotation-commands.md).

# PAM Rotation Commands

View and create Keeper Rotation configuration for records.

### Rotation List command

Display a list of all resources configured for rotation

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-rotation list`

**Alias**: `pam-rot list` / `pam-rot l`

**Parameters**:

| Parameter         | Description                                           |
| ----------------- | ----------------------------------------------------- |
| `--verbose`, `-v` | Include Gateway UID and PAM Configuration UID columns |

Examples:

{% code expandable="true" %}

```csharp
My Vault> pam-rotation list
Syncing PAM data...
Record UID              Record Title                      Record Type  Schedule           Gateway      PAM Configuration (Type)                   
----------------------  --------------------------------  -----------  -----------------  -----------  -------------------------------------------
2fImoc1puL7wyhsynV0Mu8ydkRQ  NG1 - MySQL Rotation User         pamUser      [Manual Rotation]  NG1 Gateway  NG1 Configuration (pamNetworkConfiguration)
YYR3C5lzHG0ndheoZfUVJc8zw2A  NG1 - SSH Admin with Password     pamUser      [Manual Rotation]  NG1 Gateway  NG1 Configuration (pamNetworkConfiguration)
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
    public static async Task<PamProto.PAMRotationSchedulesResponse> GetRotationSchedulesAsync(IAuthentication auth)
    {
      if (auth == null)
      {
        throw new ArgumentNullException(nameof(auth));
      }

      var request = new PamProto.PAMGenericUidsRequest();
      return await auth.ExecuteRouter<PamProto.PAMRotationSchedulesResponse>(
        GetRotationSchedulesPath,
        request);
    }
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamRotationList`

**Alias**: `pam-rotation-list` / `pam-rot-list`

**Parameters**:

| Parameter              | Description                                           |
| ---------------------- | ----------------------------------------------------- |
| `-VerboseOutput`, `-v` | Include Gateway UID and PAM Configuration UID columns |

Examples:

{% code expandable="true" %}

```powershell
PS > Get-KeeperPamRotationList                           
Syncing PAM data...

Record UID             Record Title                       Record Type Schedule          Gateway       PAM Configuration (Type)
----------             ------------                       ----------- --------          -------       ------------------------
ah2zcniqasGsnAAOhZJzV83zeQ Gate1 - MySQL Rotation User        pamUser     [Manual Rotation] Gate1 Gateway Gate1 Configuration (pamNetworkConfiguration)
eYxj7nsyufYf27jr19_sr1aKDQ Gate1 - SSH Admin with Password    pamUser     [Manual Rotation] Gate1 Gateway Gate1 Configuration (pamNetworkConfiguration)
pP0ivRkEARiuatg5jpNydPOGKA Gate1 - SSH Admin with Private Key pamUser     [Manual Rotation] Gate1 Gateway Gate1 Configuration (pamNetworkConfiguration)

```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Rotation Info command

Display information about the rotation settings for a particular resource.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-rotation info`

**Alias**: `pam-rot info` / `pam-rot i`

**Parameters**:

| Parameter               | Description                     |
| ----------------------- | ------------------------------- |
| `--record`, `-r`        | Record UID, name, or title      |
| `--record-uid`          | Record UID alias for `--record` |
| `--format {table,json}` | Output format. Default: `table` |

\* One of `--record` or `--record-uid` is required.

**Examples**:

{% code expandable="true" %}

```csharp
My Vault> pam-rotation info --record 2fImoc1puL7nV0Mu8ydkRQ
Rotation Status: Ready to rotate (RrsOnline)
PAM Config UID: R1dgEDZZ00ez02vY2njudgnB7Qg
Node ID: 894448414289341228482
Gateway Name: NG1 Gateway
Gateway UID: ygE7xsutS0ndhau555eiqZEIGZ-33qfQ
Admin Resource Uid: 4orXZIfikFwnahuSFOnj-Q0PM4KMA
Password Complexity: PRpTItpnjdyehwywio-wjwuwnjj2_WUD6DLlriG4x1WT8J3woK_otiTgYx588ID3hEl21-70Ue1Z-1JC07-04b5WZKYZUkdisXy0qK5JvppAvgXtDqJBW5a_ab8wAm6N3CiAbi
Password Complexity Data: 20,4,4,4,4,!@#$%^?();',.=+[]<>{}-_/\*&:"`~|
Is Rotation Disabled: True
Schedule: Manual Rotation
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
    public static async Task<RouterProto.RouterRotationInfo> GetRotationInfoAsync(
      IAuthentication auth,
      string recordUid)
    {
      if (auth == null)
      {
        throw new ArgumentNullException(nameof(auth));
      }

      if (string.IsNullOrWhiteSpace(recordUid))
      {
        throw new ArgumentException("Record UID is required", nameof(recordUid));
      }

      var request = new PamProto.PAMGenericUidRequest
      {
        Uid = ByteString.CopyFrom(recordUid.Trim().Base64UrlDecode()),
      };

      var response = await auth.ExecuteAuthRest(
        GetRotationInfoEndpoint,
        request,
        typeof(RouterProto.RouterRotationInfo));

      if (response is not RouterProto.RouterRotationInfo rotationInfo)
      {
        throw new InvalidOperationException(
          $"Unexpected response type from {GetRotationInfoEndpoint}: {response?.GetType().Name ?? "null"}");
      }

      return rotationInfo;
    }
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamRotationInfo`

**Alias**: `pam-rotation-info` / `pam-rot-info`

**Parameters**:

| Parameter                  | Description                     |
| -------------------------- | ------------------------------- |
| `-Record`, `-r`            | Record UID, name, or title      |
| `-RecordUid`               | Record UID alias for `-Record`  |
| `-Format {table,csv,json}` | Output format. Default: `table` |

\* One of `-Record` or `-RecordUid` is required.

**Examples**:

{% code expandable="true" %}

```powershell
PS > Get-KeeperPamRotationInfo -Record qzG2zuiq23cGsnAAOhZJzV83zeQ
Rotation Status: Ready to rotate (RrsOnline)
PAM Config UID: r0GEhsnhyaXL8fQaY3f_cyy_--w
Node ID: 8944484109127814228482
Gateway Name: Gate1 Gateway
Gateway UID: UorQhjoelaoauTNGA4rRzcNd-fQ
Admin Resource Uid: r0GEhsnhyaXL8fQaY3f_cyy_jaahy
Password Complexity: IQwBdlnCE9vj9nshsui6Fk3Gt45AUdXBMP4OM1ple1_p2pEhgyjsnjsuL8tt8QiLqDv7GUAmAZ-AX5KJGyWDwRE3EdDkuc3BrwAUjnUl-oCxFiMOnbWnTUO5qJEAlJS
Password Complexity Data: Length: 20; Lowercase: 4; Uppercase: 4; Digits: 4; Symbols: 4; Special Characters: !@#$%^?();',.=+[]<>{}-_/\*&:"`~|
Is Rotation Disabled: False
Schedule: Manual Rotation
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Rotation Edit command

Create or update PAM record rotation configuration. Use `--record` for a single record, or `--folder` for bulk setup.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-rotation edit`

**Alias**: `pam-rot edit` / `pam-rot e` / `pam-rotation new` / `pam-rot new`

**Parameters**:

<table data-search="false"><thead><tr><th width="288">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--record</code>, <code>-r</code></td><td>Record UID, name, or pattern</td></tr><tr><td><code>--folder</code></td><td>Folder UID or name for bulk rotation setup</td></tr><tr><td><code>--force</code>, <code>-f</code></td><td>Skip confirmation prompts</td></tr><tr><td><code>--config</code>, <code>-c</code></td><td>PAM configuration UID or title</td></tr><tr><td><code>--iam-aad-config</code></td><td>IAM/Azure AD PAM configuration UID (instead of <code>--resource</code>)</td></tr><tr><td><code>--resource</code></td><td>Admin resource record UID or title</td></tr><tr><td><code>--rotation-profile</code></td><td>Rotation profile: <code>general</code>, <code>iam_user</code>, <code>scripts_only</code>, <code>saas</code></td></tr><tr><td><code>--saas-config-uid</code></td><td>SaaS configuration UID (for <code>saas</code> profile)</td></tr><tr><td><code>--schedule-json</code></td><td>Rotation schedule JSON</td></tr><tr><td><code>--schedule-cron</code></td><td>Rotation schedule CRON expression</td></tr><tr><td><code>--on-demand</code></td><td>Configure manual (on-demand) rotation</td></tr><tr><td><code>--schedule-config</code></td><td>Inherit schedule from PAM configuration</td></tr><tr><td><code>--schedule-only</code></td><td>Only update rotation schedule</td></tr><tr><td><code>--complexity</code>, <code>-x</code></td><td>Password complexity CSV: <code>length,upper,lower,digits,symbols[,chars]</code></td></tr><tr><td><code>--complexity-json</code></td><td>Password complexity rules as JSON</td></tr><tr><td><code>--admin-user</code>, <code>-a</code></td><td>PAM user record UID to set as admin credential on resource</td></tr><tr><td><code>--enable</code>, <code>-e</code></td><td>Enable rotation</td></tr><tr><td><code>--disable</code>, <code>-d</code></td><td>Disable rotation</td></tr></tbody></table>

\* One of `--record` or `--folder` is required (not both).

\* Do not combine `--resource` and `--iam-aad-config`, or `--enable` and `--disable`.

**Examples**:

{% code expandable="true" %}

```csharp
My Vault> pam-rotation edit -r "<record-uid>" -c "<configuration-uid>" --resource "<resource-uid>" --on-demand
Syncing PAM data...
Selected 1 PAM record(s) for rotation

The following record(s) will be updated:
Record UID              Record Title                 Enabled  Configuration UID       Resource UID            Schedule   Complexity                                 
----------------------  ---------------------------  -------  ----------------------  ----------------------  ---------  -------------------------------------------
cGsnAAsbsgayOhZJzV83zeQ  Gate1 - MySQL Rotation User  X        8i8quwtfQaY3f_cyy_--w  TmBY8772ataddJ7BgO978nw  On-Demand  20,4,4,4,4,!@#$%^?();',.=+[]<>{}-_/\*&:"`~|


Do you want to update password rotation? [Y/n]: y
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
    public static async Task SetRecordRotationAsync(IAuthentication auth, RouterProto.RouterRecordRotationRequest request)
    {
      if (auth == null)
      {
        throw new ArgumentNullException(nameof(auth));
      }

      if (request == null)
      {
        throw new ArgumentNullException(nameof(request));
      }

      if (auth.Endpoint is not KeeperEndpoint keeperEndpoint)
      {
        throw new InvalidOperationException("Endpoint must be KeeperEndpoint to use SetRecordRotationAsync");
      }

      await keeperEndpoint.ExecuteRouterRest(
        SetRecordRotationPath,
        auth.AuthContext.SessionToken,
        request.ToByteArray());
    }
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Set-KeeperPamRotation`

**Alias**: `pam-rotation-edit` / `pam-rot-edit` / `pam-rotation-new` / `pam-rot-new`

**Parameters**:

<table data-search="false"><thead><tr><th>Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record</code>, <code>-r</code></td><td>Record UID, name, or pattern</td></tr><tr><td><code>-Folder</code>, <code>-fd</code></td><td>Folder UID or name for bulk rotation setup</td></tr><tr><td><code>-Force</code>, <code>-f</code></td><td>Skip confirmation prompts</td></tr><tr><td><code>-Config</code>, <code>-c</code></td><td>PAM configuration UID or title</td></tr><tr><td><code>-IamAadConfig</code>, <code>-iac</code></td><td>IAM/Azure AD PAM configuration UID</td></tr><tr><td><code>-Resource</code>, <code>-rs</code></td><td>Admin resource record UID or title</td></tr><tr><td><code>-RotationProfile</code>, <code>-rp</code></td><td><code>general</code>, <code>iam_user</code>, <code>scripts_only</code>, <code>saas</code></td></tr><tr><td><code>-SaasConfigUid</code></td><td>SaaS configuration UID (for <code>saas</code> profile)</td></tr><tr><td><code>-ScheduleJson</code>, <code>-sj</code></td><td>Rotation schedule JSON</td></tr><tr><td><code>-ScheduleCron</code>, <code>-sc</code></td><td>Rotation schedule CRON expression</td></tr><tr><td><code>-OnDemand</code>, <code>-od</code></td><td>Configure manual on-demand rotation</td></tr><tr><td><code>-ScheduleConfig</code>, <code>-sf</code></td><td>Inherit schedule from PAM configuration</td></tr><tr><td><code>-ScheduleOnly</code>, <code>-so</code></td><td>Only update rotation schedule</td></tr><tr><td><code>-Complexity</code>, <code>-x</code></td><td>Password complexity CSV</td></tr><tr><td><code>-ComplexityJson</code></td><td>Password complexity rules as JSON</td></tr><tr><td><code>-AdminUser</code>, <code>-a</code></td><td>PAM user record UID for admin credential</td></tr><tr><td><code>-Enable</code>, <code>-e</code></td><td>Enable rotation</td></tr><tr><td><code>-Disable</code>, <code>-d</code></td><td>Disable rotation</td></tr></tbody></table>

\* One of `-Record` or `-Folder` is required (not both).

**Examples**:

{% code expandable="true" %}

```powershell
PS >  Set-KeeperPamRotation -Record "My PAM User" -Config "AWS Config" -Resource "My Server" -OnDemand
Selected 1 PAM record(s) for rotation

The following record(s) will be updated:
Record UID              Record Title                 Enabled  Configuration UID       Resource UID            Schedule   Complexity                                 
----------------------  ---------------------------  -------  ----------------------  ----------------------  ---------  -------------------------------------------
cGsnAAsbsgayOhZJzV83zeQ  Gate1 - MySQL Rotation User  X        8i8quwtfQaY3f_cyy_--w  TmBY8772ataddJ7BgO978nw  On-Demand  20,4,4,4,4,!@#$%^?();',.=+[]<>{}-_/\*&:"`~|


Do you want to update password rotation? [Y/n]: y

PS >
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Rotation Script list command

This command is used to List post-rotation scripts attached to PAM records.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-rotation script list`

**Alias**: `pam-rot script list` / `pam-rot script l`

**Parameters**:

<table><thead><tr><th width="248">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--pattern</code></td><td>Record UID or title filter</td></tr><tr><td><code>--record</code>, <code>-r</code></td><td>Same as <code>--pattern</code> (record filter)</td></tr><tr><td><code>&#x3C;filter></code> (positional)</td><td>Record UID/title filter</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
My Vault> pam-rotation script list                                                                                                                                                        
Record UID              Title                     Record Type  Script UID              Script Name  Records  Command                    
----------------------  ------------------------  -----------  ----------------------  -----------  -------  ---------------------------
qdWnshsutT6khktOWSFJng  Gate1 - MySQL Admin User  pamUser      BK3wndhuSeSk1BUNwI7r_g  rotate.ps1            powershell -File rotate.ps1

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
foreach (var keeperRecord in vault.KeeperRecords.OfType<TypedRecord>())
{
    var fields = keeperRecord.Fields
        .OfType<TypedField<FieldScript>>()
        .Where(f =>
            string.Equals(f.FieldName, "script", StringComparison.Ordinal)
            || string.Equals(f.FieldLabel, "rotationScripts", StringComparison.Ordinal));
    foreach (var field in fields)
    {
        foreach (var script in field.Values.Where(s => !string.IsNullOrEmpty(s?.FileRef)))
        {
            Console.WriteLine($"{keeperRecord.Uid} | {script.FileRef} | {script.Command}");
        }
    }
}
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamRotationScript`

**Alias**: `pam-rotation-script-list` / `pam-rot-script-list`

**Parameters**:

<table><thead><tr><th width="315">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Pattern</code></td><td>Record UID or title filter</td></tr><tr><td><code>-Record</code>, <code>-r</code></td><td>Same as <code>-Pattern</code></td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Get-KeeperPamRotationScript
Record UID              Title                     Record Type  Script UID              Script Name  Records  Command                    
----------------------  ------------------------  -----------  ----------------------  -----------  -------  ---------------------------
qdWnshsutT6khktOWSFJng  Gate1 - MySQL Admin User  pamUser      BK3wndhuSeSk1BUNwI7r_g  rotate.ps1            powershell -File rotate.ps1
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Rotation Script add command

This command is used to Upload a local script file and attaches it as a post-rotation script.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-rotation script add`

**Alias**: `pam-rot script add` / `pam-rot script new` / `pam-rot script a`

**Parameters**:

<table><thead><tr><th width="322">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--record</code>, <code>-r</code> / <code>&#x3C;record></code> (positional)</td><td>Record UID or title (<code>pamUser</code> / <code>pamDirectory</code>)</td></tr><tr><td><code>--script</code> / <code>&#x3C;script></code> (positional)</td><td>Local script file path to upload</td></tr><tr><td><code>--run-command</code></td><td>Command line to run the script after rotation</td></tr><tr><td><code>--script-command</code></td><td>Alias for <code>--run-command</code> (unless value is a subcommand name)</td></tr><tr><td><code>--add-credential</code></td><td>Record UID(s) with rotation credentials to link</td></tr></tbody></table>

**Examples:**

{% code expandable="true" %}

```csharp
My Vault> pam-rotation script add --record "<record-uid>" --script "C:\\Users\\AnanthReddyMandli\\Documents\\GitHub\\Temp\\rotate.ps1" --run-command "powershell -File rotate.ps1"
Script added to record 'Gate1 - MySQL Admin User' (kepo6sqdWT6khktOWSFJng).

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
var record = (TypedRecord)vault.GetKeeperRecord(recordUid);
// Ensure script field exists
var scriptField = record.Fields
    .OfType<TypedField<FieldScript>>()
    .FirstOrDefault(f =>
        string.Equals(f.FieldName, "script", StringComparison.Ordinal)
        || string.Equals(f.FieldLabel, "rotationScripts", StringComparison.Ordinal));
if (scriptField == null)
{
    scriptField = new TypedField<FieldScript>("script", "rotationScripts");
    record.Fields.Add(scriptField);
}
var facade = new TypedRecordFacade<TypedRecordFileRef>(record);
var preRefs = new HashSet<string>(
    facade.Fields.FileRef?.Values ?? Enumerable.Empty<string>(),
    StringComparer.Ordinal);
using (var uploadTask = new FileAttachmentUploadTask(filePath, isScript: true))
{
    await vault.UploadAttachment(record, uploadTask);
}
var postRefs = new HashSet<string>(
    facade.Fields.FileRef?.Values ?? Enumerable.Empty<string>(),
    StringComparer.Ordinal);
var newUids = postRefs.Except(preRefs).ToList();
if (newUids.Count != 1)
{
    throw new InvalidOperationException(
        "Failed to determine uploaded script file UID. Only the record owner can attach post-rotation scripts.");
}
// Move file out of generic fileRef into script field
facade.Fields.FileRef?.Values.Remove(newUids[0]);
scriptField.Values.Add(new FieldScript
{
    FileRef = newUids[0],
    Command = "powershell -File rotate.ps1",
    RecordRef = new[] { credentialUid },
});
await vault.UpdateRecord(record);

```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Add-KeeperPamRotationScript`

**Alias**: `pam-rotation-script-add` / `pam-rot-script-add`

**Parameters**:

<table><thead><tr><th width="278">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record</code>, <code>-r</code> / positional</td><td>Record UID or title</td></tr><tr><td><code>-RecordUid</code></td><td>Record UID alias</td></tr><tr><td><code>-Script</code> / positional</td><td>Local script file path</td></tr><tr><td><code>-RunCommand</code></td><td>Command line to run after rotation</td></tr><tr><td><code>-ScriptCommand</code></td><td>Alias for <code>-RunCommand</code></td></tr><tr><td><code>-AddCredential</code>, <code>-ac</code></td><td>Credential record UID(s) to link</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Add-KeeperPamRotationScript -Record <UID> -Script "C:\scripts\rotate.ps1" -RunCommand "powershell -File rotate.ps1"
Script added to record 'Gate1 - MySQL Admin User' (kepo6sqdWT6khktOWSFJng).
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Rotation Script edit command

This command is used to Update an existing post-rotation script on a PAM record.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-rotation script edit`

**Alias**: `pam-rot script edit` / `pam-rot script e`

**Parameters**:

| Parameter                                  | Description                        |
| ------------------------------------------ | ---------------------------------- |
| `--record`, `-r` / `<record>` (positional) | Record UID or title                |
| `--script` / `<script>` (positional)       | Script file UID or name to update  |
| `--run-command`                            | New command line to run the script |
| `--script-command`                         | Alias for `--run-command`          |
| `--add-credential`                         | Credential record UID(s) to link   |
| `--remove-credential`                      | Credential record UID(s) to unlink |

Examples:

{% code overflow="wrap" %}

```csharp
My Vault> pam-rotation script edit --record kepo6smju76qdWT6khktOWSFJng --script rotate.ps1 --run-command "powershell -File rotate.ps1"
Script updated on record 'Gate1 - MySQL Admin User' (kepo6smju76qdWT6khktOWSFJng ).
Command: powershell -File rotate.ps1
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
var record = (TypedRecord)vault.GetKeeperRecord(recordUid);
var scriptField = record.Fields
    .OfType<TypedField<FieldScript>>()
    .FirstOrDefault(f =>
        string.Equals(f.FieldName, "script", StringComparison.Ordinal)
        || string.Equals(f.FieldLabel, "rotationScripts", StringComparison.Ordinal));

FieldScript scriptValue = null;
foreach (var script in scriptField.Values)
{
    if (string.Equals(script.FileRef, scriptUidOrName, StringComparison.OrdinalIgnoreCase))
    {
        scriptValue = script;
        break;
    }

    if (vault.TryGetKeeperRecord(script.FileRef, out var fileKeeper)
        && fileKeeper is FileRecord fileRecord
        && (string.Equals(fileRecord.Title, scriptUidOrName, StringComparison.OrdinalIgnoreCase)
            || string.Equals(fileRecord.Name, scriptUidOrName, StringComparison.OrdinalIgnoreCase)))
    {
        scriptValue = script;
        break;
    }
}

var refs = new HashSet<string>(scriptValue.RecordRef ?? Array.Empty<string>(), StringComparer.Ordinal);
refs.Remove(credentialUidToRemove);
refs.Add(credentialUidToAdd);
scriptValue.RecordRef = refs.ToArray();
scriptValue.Command = "powershell -File rotate_v2.ps1";

await vault.UpdateRecord(record);
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Set-KeeperPamRotationScript`

**Alias**: `pam-rotation-script-edit` / `pam-rot-script-edit`

**Parameters**:

<table data-search="false"><thead><tr><th>Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record</code>, <code>-r</code> / positional</td><td>Record UID or title</td></tr><tr><td><code>-RecordUid</code></td><td>Record UID alias</td></tr><tr><td><code>-Script</code> / positional</td><td>Script file UID or name</td></tr><tr><td><code>-RunCommand</code></td><td>New command line to run</td></tr><tr><td><code>-ScriptCommand</code></td><td>Alias for <code>-RunCommand</code></td></tr><tr><td><code>-AddCredential</code>, <code>-ac</code></td><td>Credential record UID(s) to link</td></tr><tr><td><code>-RemoveCredential</code>, <code>-rc</code></td><td>Credential record UID(s) to unlink</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Set-KeeperPamRotationScript -Record <UID> -Script rotate.ps1 -RunCommand "powershell -File rotate.ps1"
Script updated on record 'Gate1 - MySQL Admin User' (kepo6smju76qdWT6khktOWSFJng ).
Command: powershell -File rotate.ps1
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Rotation Script delete command

This command is used to remove a post-rotation script from a PAM record.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-rotation script delete`

**Alias**: `pam-rot script delete` / `pam-rot script d`

**Parameters**:

| Parameter                                  | Description                       |
| ------------------------------------------ | --------------------------------- |
| `--record`, `-r` / `<record>` (positional) | Record UID or title               |
| `--script` / `<script>` (positional)       | Script file UID or name to remove |

Examples:

{% code overflow="wrap" %}

```csharp
My Vault>  pam-rotation script delete --record kepo6sq145uydWT6khktOWSFJng --script rotate.ps1
Script removed from record 'Gate1 - MySQL Admin User' (kepo6sq145uydWT6khktOWSFJng ).
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
var record = (TypedRecord)vault.GetKeeperRecord(recordUid);
var scriptField = record.Fields
    .OfType<TypedField<FieldScript>>()
    .FirstOrDefault(f =>
        string.Equals(f.FieldName, "script", StringComparison.Ordinal)
        || string.Equals(f.FieldLabel, "rotationScripts", StringComparison.Ordinal));

var scriptValue = scriptField.Values
    .FirstOrDefault(s => string.Equals(s.FileRef, scriptUid, StringComparison.OrdinalIgnoreCase));

scriptField.Values.Remove(scriptValue);
await vault.UpdateRecord(record);
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Remove-KeeperPamRotationScript`

**Alias**: `pam-rotation-script-delete` / `pam-rot-script-delete`

**Parameters**:

<table><thead><tr><th width="298">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record</code>, <code>-r</code> / positional</td><td>Record UID or title</td></tr><tr><td><code>-RecordUid</code></td><td>Record UID alias</td></tr><tr><td><code>-Script</code> / positional</td><td>Script file UID or name</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS >  Remove-KeeperPamRotationScript -Record <UID> -Script rotate.ps1
Script removed from record 'Gate1 - MySQL Admin User' (kepo6sq14snaha5uydWT6khktOWSFJng ).
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://newdocs.keeper.io/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands/pam-rotation-commands.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.