PAM Workflow Commands

Manage Just-In-Time (JIT) privileged access workflows for PAM resources. Workflows enforce approval-based access control with optional check-in/check-out, MFA verification and time-based access window

Sub Commands

• Configuration

  • create

  • read

  • update

  • delete

  • add-approver

  • remove-approver

• Approver Actions

  • pending

  • approve

  • deny

• Requester Actions

  • request

  • start

  • end

• State Inspection

  • state

  • my-access

PAM Workflow create

Create a workflow configuration for a PAM record. At least one approver must be added if approvals are required.

DotNet CLI

Command: pam-workflow create

Alias: pam-wf c

Parameters:

Parameter	Description
<record>	Record UID or record name/title. Required.
-n, --approvals-needed <int>	Number of approvals required before access is granted. Default: 1. Must be >= 0; 0 means no approval required.
--checkout	Flag. Enables check-in/check-out requirement (session must be explicitly checked out and later checked in).
--start-on-approval	Flag. Starts the access timer when the request is approved, instead of when the user checks out.
--require-reason	Flag. Requires the requester to supply a reason when requesting access.
--require-ticket	Flag. Requires the requester to supply an external ticket/reference number.
--require-mfa	Flag. Requires MFA verification before access is granted.
-d, --duration <string>	Access duration, e.g. "2h", "30m", "1d". A bare number is treated as minutes. Default: "1d".
--allowed-days <string>	Comma-separated allowed days, e.g. "mon,tue,wed,thu,fri". Restricts when access can be used.
--time-range <string>	Same-day allowed time window in HH:MM-HH:MM format, e.g. "09:00-17:00". End must be after start.
-u, --user <email>	Approver's user email. Can be passed multiple times for multiple approvers.
--approver <email>	Alias of --user for approver email (used interchangeably with -u/--user). Can be passed multiple times.
--format <table|json>	Output format. Default: table.

Examples:

My Vault> pam-workflow create 0bEtV6M9nah78at9UicRzH2gSS7A --checkout --approvals-needed 1 --approver [e-mail]

Workflow created successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9nah78at9UicRzH2gSS7A )
Approvals needed: 1
Check-in/out: Yes
Duration: 1 day
Approvers: [e-mail]

DotNet SDK

Function:

    public static async Task CreateWorkflowConfigAsync(IAuthentication auth, WorkflowParameters parameters)
    {
      if (parameters == null)
      {
        throw new ArgumentNullException(nameof(parameters));
      }

      await PostToRouterAsync(auth, CreateWorkflowConfigPath, parameters);
    }

Power Commander

Command: New-KeeperPamWorkflow

Alias: pam-workflow-new

Parameters:

Parameter	Description
-Record, -r	PAM resource record UID or title
-ApprovalsNeeded, -n	Number of approvals required. Use 0 when no approvers are required. Default is 1.
-Checkout, -co	Enables single-user check-in/check-out mode.
-StartOnApproval, -sa	Starts the access timer when approval completes instead of when the resource is checked out.
-RequireReason, -rr	Requires the requester to provide a reason.
-RequireTicket, -rt	Requires the requester to provide a ticket number.
-RequireMfa, -rm	Requires MFA verification.
-Duration, -d	Access duration, such as 30m, 2h, or 1d. Default is 1d.
-AllowedDays	Comma-separated days: mon,tue,wed,thu,fri,sat,sun.
-TimeRange	Same-day time range in HH:MM-HH:MM format.
-User, -u	User email to add as an approver.
-Approver	Compatibility option for approver email addresses. Can be repeated.
-Team, -t	Team UID or unique team name to add as an approver.
-Format	Output format: table or json.
-Help, -h	Displays command help.

Examples:

PS > New-KeeperPamWorkflow `
    -Record "OZiyGTEO_KrBxG8mvMJNWw" `
    -Approver "[e-mail]" `
    -ApprovalsNeeded 1 `
    -Checkout `
    -StartOnApproval `
    -RequireReason `
    -RequireTicket `
    -RequireMfa `
    -Duration "1d" `
    -AllowedDays "mon,tue,wed,thu,fri" `
    -TimeRange "09:00-17:00"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow update

Updates selected workflow settings while preserving values that were not supplied.

DotNet CLI

Command: pam-workflow update

Alias: pam-wf u

Parameters:

Param	Explanation
<record>	Record UID or record name/title. Required. Workflow must already exist.
-n, --approvals-needed <int>	New number of approvals required. Must be >= 0.
--checkout <true|false>	Enable/disable check-in/check-out requirement.
--start-on-approval <true|false>	Toggle whether the access timer starts on approval vs. on check-out.
--require-reason <true|false>	Toggle requirement for a reason on access requests.
--require-ticket <true|false>	Toggle requirement for a ticket number on access requests.
--require-mfa <true|false>	Toggle requirement for MFA verification.
-d, --duration <string>	New access duration, e.g. "2h", "30m", "1d".
--allowed-days <string>	New comma-separated allowed days.
--time-range <string>	New allowed time window (HH:MM-HH:MM).
--format <table|json>	Output format. Default: table.

Examples:

My Vault> pam-workflow update 0bEtV6nah65142M9t9UicRzH2gSS7A --checkout --approvals-needed 2                                            

Workflow updated successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6nah65142M9t9UicRzH2gSS7A )

DotNet SDK

Function:

public static async Task UpdateWorkflowConfigAsync(IAuthentication auth, WorkflowParameters parameters)
    {
      if (parameters == null)
      {
        throw new ArgumentNullException(nameof(parameters));
      }

      await PostToRouterAsync(auth, UpdateWorkflowConfigPath, parameters);
    }

Power Commander

Command: Update-KeeperPamWorkflow

Alias: pam-workflow-edit

Parameters:

Parameter	Description
-Record, -r	PAM resource record UID or title.
-ApprovalsNeeded, -n	Number of approvals required. Use 0 when no approvers are required.
-Checkout, -co	Enables or disables check-in/check-out mode.
-StartOnApproval, -sa	Controls whether the timer starts on approval.
-RequireReason, -rr	Enables or disables the reason requirement.
-RequireTicket, -rt	Enables or disables the ticket requirement.
-RequireMfa, -rm	Enables or disables MFA verification.
-Duration, -d	Access duration, such as 30m, 2h, or 1d.
-AllowedDays	Comma-separated allowed days.
-TimeRange	Same-day time range in HH:MM-HH:MM format.
-Format	Output format: table or json.

Examples:

PS > Update-KeeperPamWorkflow `
    -Record "OZiyGTrf_KrBxG8mvMJNWw" `
    -ApprovalsNeeded 2 `
    -Checkout $true `
    -StartOnApproval $true `
    -RequireReason $true `
    -RequireTicket $true `
    -RequireMfa $true `
    -Duration "2h"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow read

Reads the workflow configuration for a PAM resource record.

DotNet CLI

Command: pam-workflow read

Alias: pam-wf r

Parameters:

Param	Explanation
<record>	Record UID or record name/title. Required.
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-workflow read 0bEtV6M9t9nahyt6a7wUicRzH2gSS7A--format json
{
 "record_uid": "0bEtV6M9t9nahyt6a7wUicRzH2gSS7A",
 "record_name": "Dotnet-Gateway-14thJuly - VNC Machine",
 "parameters": {
   "approvals_needed": 2,
   "checkout_needed": true,
   "start_access_on_approval": false,
   "require_reason": false,
   "require_ticket": false,
   "require_mfa": false,
   "access_duration": "1 day",
   "allowed_times": null
  },
 "approvers": [
   {
    "escalation": false,
    "type": "user",
    "email": "[e-mail]"
   }
  ]
}

DotNet SDK

Function:

    public static async Task<WorkflowConfig> ReadWorkflowConfigAsync(
      IAuthentication auth,
      string recordUid,
      string recordName = null)
    {
      var refMsg = CreateRecordRef(recordUid, recordName);
      var config = await auth.ExecuteRouter<WorkflowConfig>(ReadWorkflowConfigPath, refMsg);

      if (config == null
          || (config.Parameters == null && config.Approvers.Count == 0 && config.CreatedOn == 0))
      {
        return null;
      }

      return config;
    }

Power Commander

Command: Get-KeeperPamWorkflow

Alias: pam-workflow-read

Parameters:

Parameter	Description
-Record, -r	PAM resource record UID or title.
-Format	Output format: table or json.

Examples:

PS > Get-KeeperPamWorkflow `
    -Record "OZirfTEO_KrBxG8mvMJNWw"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow delete

Deletes the workflow configuration from a PAM resource record.

DotNet CLI

Command: pam-workflow delete

Alias: pam-wf d

Parameters:

Param	Explanation
<record>	Record UID or record name/title. Required.
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-wf d 0bEtV6M9nahu78791t9UicRzH2gSS7A

Workflow deleted successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9nahu78791t9UicRzH2gSS7A)

DotNet SDK

Function:

    public static async Task DeleteWorkflowConfigAsync(
      IAuthentication auth,
      string recordUid,
      string recordName = null)
    {
      var refMsg = CreateRecordRef(recordUid, recordName);
      await PostToRouterAsync(auth, DeleteWorkflowConfigPath, refMsg);
    }

Power Commander

Command: Remove-KeeperPamWorkflow

Alias: pam-workflow-delete

Parameters:

Parameter	Description
-Record, -r	PAM resource record UID or title.
-Format	Output format: table or json.
-Confirm	Confirms deletion without an interactive prompt.

Examples:

PS > Remove-KeeperPamWorkflow `
    -Record "OZfgGTEO_KrBxG8mvMJNWw" `
    -Confirm:$false

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow add-approver

Adds users or teams as workflow approvers.

DotNet CLI

Command: pam-workflow add-approver

Alias: pam-wf aa

Parameters:

Param	Explanation
<record>	Record UID or record name/title. Required.
-u, --user <email>	User email to add as an approver. Repeatable.
--approver <email>	Alias of --user. Repeatable.
-t, --team <name|uid>	Team name or team UID to add as an approver. Repeatable.
-e, --escalation	Flag. Marks the added approver(s) as escalation approvers (only invoked if the primary approval flow is escalated).
--escalation-after <string>	Time before this approver's escalation kicks in, e.g. "30m", "1h". Requires --escalation.
--format <table|json>	Output format. Default: table.

(At least one of --user/--approver or --team is required.)

Example:

My Vault> pam-wf aa 0bEtV6M9tanhqy679UicRzH2gSS7A --approver [e-mail]                                           

Approvers added successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9tanhqy679UicRzH2gSS7A )
Added 1 approver(s)c#

DotNet SDK

Function:

    public static async Task AddWorkflowApproversAsync(
      IAuthentication auth,
      string recordUid,
      string recordName,
      IEnumerable<string> users = null,
      IEnumerable<string> teamUids = null,
      bool isEscalation = false,
      long escalationAfterMs = 0)
    {
      var config = BuildApproverConfig(recordUid, recordName, users, teamUids, isEscalation, escalationAfterMs);
      if (config.Approvers.Count == 0)
      {
        return;
      }

      await PostToRouterAsync(auth, AddWorkflowApproversPath, config);
    }

Power Commander

Command: Add-KeeperPamWorkflowApprover

Alias: pam-workflow-add-approver

Parameters:

Parameter	Description
-Record, -r	PAM resource record UID or title.
-User, -u	User email to add as an approver. Can be repeated.
-Approver	Compatibility option for approver email addresses.
-Team, -t	Team UID or unique team name. Can be repeated.
-Escalation, -e	Marks the supplied approvers as escalation approvers.
-EscalationAfter	Escalation delay, such as 30m, 2h, or 1d. Requires -Escalation.
-Format	Output format: table or json.

Examples:

PS > Add-KeeperPamWorkflowApprover `
    -Record "OZiyGTEO_KffgG8mvMJNWw" `
    -User "[e-mail]" `
    -Team "TestTeam"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow remove-approver

Removes users or teams from the workflow approver list.

DotNet CLI

Command: pam-workflow remove-approver

Alias: pam-wf ra

Parameters:

Param	Explanation
<record>	Record UID or record name/title. Required.
-u, --user <email>	User email to remove from approvers. Repeatable.
--approver <email>	Alias of --user. Repeatable.
-t, --team <name|uid>	Team name or team UID to remove from approvers. Repeatable.
--format <table|json>	Output format. Default: table.

(At least one of --user/--approver or --team is required.)

Example:

My Vault> pam-wf ra 0bEtV6M9t9Unah87icRzH2gSS7A --approver [e-mail]

Approvers removed successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9t9Unah87icRzH2gSS7A )
Removed 1 approver(s)

DotNet SDK

Function:

public static async Task DeleteWorkflowApproversAsync(
      IAuthentication auth,
      string recordUid,
      string recordName,
      IEnumerable<string> users = null,
      IEnumerable<string> teamUids = null)
    {
      var config = BuildApproverConfig(recordUid, recordName, users, teamUids);
      if (config.Approvers.Count == 0)
      {
        return; 
      }

      await PostToRouterAsync(auth, DeleteWorkflowApproversPath, config);
    }

Power Commander

Command: Remove-KeeperPamWorkflowApprover

Alias: pam-workflow-remove-approver

Parameters:

Parameter	Description
-Record, -r	PAM resource record UID or title.
-User, -u	User email to remove. Can be repeated.
-Approver	Compatibility option for approver email addresses.
-Team, -t	Team UID or unique team name to remove.
-Format	Output format: table or json.

Examples:

PS > Remove-KeeperPamWorkflowApprover `
    -Record "OZiyGrfO_KrBxG8mvMJNWw" `
    -User "[e-mail]"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow pending

List all pending workflow approval requests assigned to the current user.

DotNet CLI

Command: pam-workflow pending

Alias: pam-wf p

Parameters:

Param	Explanation
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-wf p  0bEtV6M9tnajaut9UicRzH2gSS7A                                            

Record Name                            Record UID              Flow UID                Requested By                            Reason  Ticket  Started  Expires  Duration
-------------------------------------  ----------------------  ----------------------  --------------------------------------  ------  ------  -------  -------  --------
Dotnet-Gateway-14thJuly - RDP Machine  0nahay67wd7s9NnujjRMyGA  v2UD_gpdAW_HJvEN57SH2g  [e-mail]                                            

DotNet SDK

Function:

    public static async Task<ApprovalRequests> GetApprovalRequestsAsync(IAuthentication auth)
    {
      return await auth.ExecuteRouter<ApprovalRequests>(GetApprovalRequestsPath);
    }

Power Commander

Command: Get-KeeperPamWorkflowPending

Alias: pam-workflow-pending

Example:

PS > Get-KeeperPamWorkflowPending
PS > pam-workflow-pending

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow approve

Approve a pending workflow access request using the flow UID from the pending command.

DotNet CLI

Command: pam-workflow approve

Alias: pam-wf a

Parameters:

Param	Explanation
<flow_uid>	The flow UID of the pending request (obtained from pending). Required.
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-wf a v2UD_gpdAW_HJvEN5nahudyr7SH2g

Access request approved

Flow UID: v2UD_gpdAW_HJvEN5nahudyr7SH2g

DotNet SDK

Function:

   public static async Task ApproveWorkflowAccessAsync(IAuthentication auth, byte[] flowUidBytes)
    {
      await ApproveOrDenyWorkflowAccessAsync(auth, flowUidBytes, deny: false, denialReasonEncrypted: null);
    }

Power Commander

Command: Approve-KeeperPamWorkflowAccess

Alias: pam-workflow-approve

Parameters:

Param	Explanation
-FlowUid <string>	Flow UID of the pending request (obtained from Get-KeeperPamWorkflowPending). Mandatory, positional (0).

Examples:

PS > Approve-KeeperPamWorkflowAccess -FlowUid "<flow-uid>"
PS > pam-workflow-approve "<flow-uid>"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow deny

Deny a pending workflow access request

DotNet CLI

Command: pam-workflow deny

Alias: pam-wf dn

Parameters:

Param	Explanation
<flow_uid>	The flow UID of the pending request. Required.
-r, --reason <string>	Optional reason for denial. Encrypted and shown to the requester if encryption succeeds; otherwise the denial proceeds without a visible reason.
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-wf dn <flow_UID>

DotNet SDK

Function:

    public static async Task DenyWorkflowAccessAsync(
      IAuthentication auth,
      byte[] flowUidBytes,
      ByteString denialReasonEncrypted = null)
    {
      await ApproveOrDenyWorkflowAccessAsync(auth, flowUidBytes, deny: true, denialReasonEncrypted);
    }

Power Commander

Command: Deny-KeeperPamWorkflowAccess

Alias: pam-workflow-deny

Parameters:

Param	Explanation
-FlowUid <string>	Flow UID of the pending request. Mandatory, positional (0).
-Reason <string>	Optional reason shown to the requester. Encrypted for the requester; if encryption fails, a warning is shown and the denial proceeds without a visible reason.

Examples:

PS > Deny-KeeperPamWorkflowAccess -FlowUid "<flow-uid>" -Reason "Not authorized"
PS > pam-workflow-deny "<flow-uid>" -r "Not authorized"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow request

Request access to a workflow-protected PAM resource. Supports escalation of pending requests and cancellation of active requests.

DotNet CLI

Command: pam-workflow request

Alias: pam-wf rq

Parameters:

Param	Explanation
<record>	Record UID or record name/title. Required.
-r, --reason <string>	Reason for the access request. Cannot be combined with --cancel.
--ticket <string>	External ticket/reference number tied to the request. Cannot be combined with --cancel.
--escalate	Flag. Escalates an existing pending request to escalation approvers, instead of submitting a new request. Mutually exclusive with --cancel.
-c, --cancel	Flag. Cancels an active/pending workflow request for the record instead of submitting one. Mutually exclusive with --escalate, --reason, --ticket.
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-workflow request 0bEtV6M9t9UnahticRzH2gSS7A

Access request sent

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9najaytt9UicRzH2gSS7A)

Approvers have been notified.

DotNet SDK

Function:

    public static async Task RequestWorkflowAccessAsync(
      IAuthentication auth,
      string recordUid,
      string recordName,
      byte[] recordKey,
      string reason = null,
      string ticket = null)
    {
      var needsEncrypted = !string.IsNullOrEmpty(reason) || !string.IsNullOrEmpty(ticket);
      if (needsEncrypted && (recordKey == null || recordKey.Length == 0))
      {
        throw new InvalidOperationException(
          "Record key not available — cannot encrypt reason/ticket. " +
          "You do not have sufficient access to this record to send encrypted parameters.");
      }

      var accessRequest = new WorkflowAccessRequest
      {
        Resource = CreateRecordRef(recordUid, recordName),
      };
      if (!string.IsNullOrEmpty(reason))
      {
        accessRequest.Reason = ByteString.CopyFrom(
          CryptoUtils.EncryptAesV2(System.Text.Encoding.UTF8.GetBytes(reason), recordKey));
      }

      if (!string.IsNullOrEmpty(ticket))
      {
        accessRequest.Ticket = ByteString.CopyFrom(
          CryptoUtils.EncryptAesV2(System.Text.Encoding.UTF8.GetBytes(ticket), recordKey));
      }

      await PostToRouterAsync(auth, RequestWorkflowAccessPath, accessRequest);
    }

Power Commander

Command: Request-KeeperPamWorkflowAccess

Alias: pam-workflow-request

Parameters:

Param	Explanation
-Record <string>	PAM resource record UID or title. Mandatory, positional (0).
-Reason <string>	Reason for the access request. Cannot be combined with -Cancel.
-Ticket <string>	External ticket/reference number. Cannot be combined with -Cancel.
-Escalate	Switch. Escalates an already-pending request to escalation approvers instead of submitting a new request. Cannot be combined with -Cancel.
-Cancel	Switch. Cancels your own pending/active workflow request for the record. Cannot be combined with -Escalate, -Reason, or -Ticket.

Notes: Record owners and approvers are exempt from workflow restrictions and get an "exempt" message instead of submitting a request.

Example:

PS > Request-KeeperPamWorkflowAccess -Record "<uid>" -Reason "Need access to investigate an incident"
PS > Request-KeeperPamWorkflowAccess -Record "<uid>" -Escalate
PS > Request-KeeperPamWorkflowAccess -Record "<uid>" -Cancel
PS > pam-workflow-request "<uid>" -re "reason text"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow start

Start a workflow session (check-out). This is required before connecting to the resource when check-in/check-out is enabled.

DotNet CLI

Command: pam-workflow start

Alias: pam-wf s

Parameters:

Param	Explanation
<record_or_flow_uid>	Record UID/name, or a flow UID if the record isn't resolvable locally. Required.
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-wf start 0bEtV6M9t9UicRzH2gSS7A

Workflow started (checked out)

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9t9UicRzH2gSS7A)

DotNet SDK

Function:

   public static async Task StartWorkflowAsync(IAuthentication auth, WorkflowState state)
    {
      if (state == null)
      {
        throw new ArgumentNullException(nameof(state));
      }

      await PostToRouterAsync(auth, StartWorkflowPath, state);
    }

Power Commander

Command: Start-KeeperPamWorkflow

Alias: pam-workflow-start

Parameters:

Param	Explanation
-Uid <string>	Record UID, record title, or Flow UID. Mandatory, positional (0). If not resolvable as a record, it's treated as a flow UID.

Example:

PS > Start-KeeperPamWorkflow -Uid "<record-or-flow-uid>"
PS > pam-workflow-start "<uid>"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow end

End a workflow session (check-in). Credentials may be rotated after check-in.

DotNet CLI

Command: pam-workflow end

Alias: pam-wf e

Parameters:

Param	Explanation
<record_or_flow_uid>	Record UID/name, or flow UID. Required.
-f, --force	Flag. Force checks-in another user's active session for this record/flow (administrative override).
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-wf end 0bEtV6M9t9UicRzH2gSS7A  

DotNet SDK

Function:

   public static async Task EndWorkflowAsync(IAuthentication auth, GraphSyncRef flowOrResourceRef)
    {
      if (flowOrResourceRef == null)
      {
        throw new ArgumentNullException(nameof(flowOrResourceRef));
      }

      await PostToRouterAsync(auth, EndWorkflowPath, flowOrResourceRef);
    }

Power Commander

Command: Stop-KeeperPamWorkflow

Alias: pam-workflow-end

Parameters:

Param	Explanation
-Uid <string>	Record UID, record title, or Flow UID. Mandatory, positional (0).
-Force	Switch. Force checks-in another user's active session on behalf of another user when single-user checkout is enabled (requires approver/admin rights).

Example:

PS > Stop-KeeperPamWorkflow -Uid "<record-or-flow-uid>"
PS > Stop-KeeperPamWorkflow -Uid "<uid>" -Force
PS > pam-workflow-end "<uid>"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow state

Returns the current workflow state for a PAM resource record.

DotNet CLI

Command: pam-workflow state

Alias: pam-wf st

Parameters:

Param	Explanation
<record>	Record UID or record name/title. Required.
--format <table|json>	Output format. Default: table.

Example:

My Vault> pam-wf state 0bEtV6M9t9UicRzH2gSS7A 

You are exempt from workflow restrictions on this record.
As a record owner or approver, you can access this resource directly.

DotNet SDK

Function:

    public static async Task<WorkflowState> GetWorkflowStateByRecordAsync(
      IAuthentication auth,
      string recordUid,
      string recordName = null)
    {
      var request = new WorkflowState
      {
        Resource = CreateRecordRef(recordUid, recordName),
      };
      return await auth.ExecuteRouter<WorkflowState>(GetWorkflowStatePath, request);
    }

Power Commander

Command: Get-KeeperPamWorkflowState

Alias: pam-workflow-state

Parameters:

Parameter	Description
-Record, -r	PAM resource record UID or title.
-Format	Output format: table or json.

Examples:

PS > Get-KeeperPamWorkflowState `
    -Record "OZiyGTrf_KrBxG8mvMJNWw"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

PAM Workflow my-access

Lists the current user’s active workflow access states.

DotNet CLI

Command: pam-workflow my-access

Alias: pam-wf ma

Parameters:

Param	Explanation
--format <table|json>	Output format. Default: table

Example:

My Vault> pam-wf my-access                   

No active workflows

DotNet SDK

Function:

    public static async Task<UserAccessState> GetUserAccessStateAsync(IAuthentication auth)
    {
      return await auth.ExecuteRouter<UserAccessState>(GetUserAccessStatePath);
    }

Power Commander

Command: Get-KeeperPamWorkflowMyAccess

Alias: pam-workflow-my-access

Parameters:

Parameter	Description
-Format	Output format: table or json.

Examples:

PS > Get-KeeperPamWorkflowMyAccess

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon