Shared Folder Commands

This page documents commands related to shared folder

Overview

This page catalogs and provides detailed information about shared folders lists and teams.

1. List-Share-Folder

2. Share Folder

3. Share Folder - Change Record Permissions Command

Command

List Share Folder Command

Lists the shared folders within a specified folder or the current directory in your Keeper vault.

DotNet CLI

Command: sf-list

Example:

My Vault> sf-list
  #  Shared Folder UID       Name                             # Records  # Users
---  ----------------------  -------------------------------  ---------  -------
  1  shared_folder_uid       Test-Shared-Folder                11         1      

DotNet SDK

Function:

var sharedFolders = vault.SharedFolders;

Power Commander

Command: Get-KeeperSharedFolder

Flag:

• -Uid : Uid of the Shared Folder

• -Filter : Used to filter the shared folders.

Example:

PS> Get-KeeperSharedFolder

Uid                    Name                            DefaultManageRecords DefaultManageUsers DefaultCanEdit DefaultCanShare UserCount RecordCount
---                    ----                            -------------------- ------------------ -------------- --------------- --------- -----------
shared_folder_uid      example_new_shared_folder       True                 True               True           True                    1           1

Python CLI

Command: list-sf

Options:

• pattern : Pattern of the title or UID of the shared folder.

• -h, --help : show this help message and exit

• --format : Specifies the output format of the list-sf command. The available options are:

  • table: The Output will be displayed in table format. By default, the output will be in table format.

    • Example: --format table

  • csv: The Output will be displayed in csv format.

    • Example: --format csv

  • json : The Output will be displayed in json format.

    • Example: --format json

• --output : Users can use this flag to store the output in a file. This flag should not be used when the output format is set to table (--format table).

  • Example: --output <file_name>

• --verbose, -v : verbose output

Example:

My Vault> list-sf
  #  Shared Folder UID       Name
---  ----------------------  -----------------------------------------
  1  shared_folder_uid       Test Example Folder

Python SDK

Function: find_shared_folders

find_shared_folders(self, criteria: str) -> Iterable[vault_types.SharedFolderInfo]

Example:

shared_folders = vault.vault_data.find_shared_folders(criteria=pattern)

Share Folder Command

Changes sharing permissions on classic shared folders. Use it to grant or remove users, teams, and records.

Notes:

• Classic shared folders only. Not NSF or Keeper Drive nested folders.

• Invitations: If a user has no Keeper account, the SDK sends an invite. Share again after they accept.

• Chunking: The CLI chunks large user and record sets at 999 per batch. The SDK send_requests call chunks at 999 requests per API call.

Python CLI

Command: share-folder [options] <folder> [<folder> ...]

Alias: sf

Positional parameter:

• folder : Required. Accepts one or more shared folder paths, names, or UIDs. Use * to target all shared folders in the vault.

Action:

• -a, --action : grant or remove. Default is grant.

  • grant adds or updates access.

  • remove revokes user, team, or record access.

Users and teams:

• -e, --email : Repeatable. Accepts:

  • [e-mail] to grant or remove a user.

  • <team_name> or <team_uid> to grant or remove a team.

  • @existing or @current to target all users and teams already in the folder.

  • * to update default folder account permissions.

Records:

• -r, --record : Repeatable. Accepts:

  • Record title or UID.

  • @existing or @current to target all records in the folder.

  • * to update default record permissions.

Account permissions:

• -p, --manage-records : on or off. Lets the user or team add, remove, or edit records in the folder.

• -o, --manage-users : on or off. Lets the user or team add or remove other users and teams.

Record permissions:

• -d, --can-edit : on or off. Lets shared records be edited.

• -s, --can-share : on or off. Lets shared records be re-shared.

Expiration:

• --expire-at : never or an ISO datetime in yyyy-MM-dd or yyyy-MM-dd hh:mm:ss format.

• --expire-in : never or <N>[(y)ears|(mo)nths|(d)ays|(h)ours|(mi)nutes].

• Expiration only applies with --action grant.

• If omitted, the share does not expire.

Rotate on expiration:

• -roe, --rotate-on-expiration : Rotates pamUser passwords when share access expires.

Other:

• -f, --force : Declared on the command. It ignores default folder permissions on initial share. It is not wired into the current SDK CLI execute logic.

Examples:

share-folder -e [e-mail] -a grant "My Shared Folder"
share-folder -e [e-mail] -d on -s off -a grant IQ_folderUid
share-folder -e "Dev Team" -p on -o off -a grant IQ_folderUid
share-folder -e [e-mail] -r "Server Login" -r IQ_recordUid -a grant IQ_folderUid
share-folder -e @existing -p on -a grant IQ_folderUid
share-folder -e '*' -p on -o off -r '*' -d on -s off -a grant IQ_folderUid
share-folder -e [e-mail] --expire-in 7d -a grant IQ_folderUid
share-folder -e [e-mail] --expire-in 7d -roe -a grant IQ_folderUid
share-folder -e [e-mail] -a remove IQ_folderUid
share-folder -e [e-mail] -r IQ_recordUid -a remove IQ_folderUid
share-folder -e [e-mail] -a grant '*'

Python SDK

Example:

import sqlite3

from keepersdk.vault import (
    sqlite_storage,
    vault_online,
    shares_management,
    share_management_utils,
)


def build_shared_folder_info(vault, shared_folder_uid: str) -> dict:
    sh_fol = vault.vault_data.load_shared_folder(shared_folder_uid)
    if not sh_fol:
        raise ValueError(f'Shared folder not found: {shared_folder_uid}')

    sf_entity = vault.vault_data.storage.shared_folders.get_entity(shared_folder_uid)
    sf_key = vault.vault_data.get_shared_folder_key(shared_folder_uid=shared_folder_uid)
    if not sf_key:
        raise ValueError(f'Could not resolve shared folder key: {shared_folder_uid}')

    return {
        'shared_folder_uid': shared_folder_uid,
        'users': sh_fol.user_permissions,
        'teams': [],
        'records': [{'record_uid': r.record_uid} for r in sh_fol.record_permissions],
        'shared_folder_key_unencrypted': sf_key,
        'default_manage_users': sh_fol.default_manage_users,
        'default_manage_records': sh_fol.default_manage_records,
        'revision': sf_entity.revision if sf_entity else 0,
    }


def share_folder(
    keeper_auth_context,
    *,
    shared_folder_uid: str,
    users: list[str] | None = None,
    teams: list[str] | None = None,
    record_uids: list[str] | None = None,
    action: str = 'grant',              # -a grant|remove
    manage_records: str | None = 'on',    # -p on|off
    manage_users: str | None = 'off',     # -o on|off
    can_edit: str | None = 'on',          # -d on|off
    can_share: str | None = 'off',        # -s on|off
    default_account: bool = False,        # -e '*'
    default_record: bool = False,         # -r '*'
    expire_at: str | None = None,         # --expire-at
    expire_in: str | None = '7d',         # --expire-in
    rotate_on_expiration: bool = False,   # -roe
):
    """
    SDK equivalent of keepercli share-folder.

    CLI example:
      share-folder -e [e-mail] -p on -o off -d on -s off \
        --expire-in 7d -roe -a grant IQ_folderUid
    """
    conn = sqlite3.Connection('file::memory:', uri=True)
    vault_storage = sqlite_storage.SqliteVaultStorage(
        lambda: conn,
        vault_owner=bytes(keeper_auth_context.auth_context.username, 'utf-8'),
    )
    vault = vault_online.VaultOnline(keeper_auth_context, vault_storage)
    vault.sync_down()

    try:
        share_expiration = None
        if action == shares_management.ShareAction.GRANT.value:
            share_expiration = share_management_utils.get_share_expiration(
                expire_at=expire_at,
                expire_in=expire_in,
            )

        if rotate_on_expiration:
            share_management_utils.validate_rotate_on_expiration(
                share_expiration, rotate_on_expiration
            )
            if action != shares_management.ShareAction.GRANT.value:
                raise share_management_utils.ShareValidationError(
                    '--rotate-on-expiration is only valid with --action grant'
                )
            share_management_utils.validate_folder_shares_rotate_on_expiration(
                vault, [shared_folder_uid], rotate_on_expiration
            )

        sf_info = build_shared_folder_info(vault, shared_folder_uid)

        request = shares_management.FolderShares.prepare_request(
            vault=vault,
            kwargs={
                'action': action,
                'manage_records': manage_records,
                'manage_users': manage_users,
                'can_edit': can_edit,
                'can_share': can_share,
            },
            curr_sf=sf_info,
            users=users or [],
            teams=teams or [],
            rec_uids=record_uids or [],
            default_record=default_record,
            default_account=default_account,
            share_expiration=share_expiration,
            rotate_on_expiration=rotate_on_expiration,
        )

        success, failed = shares_management.FolderShares.send_requests(vault, [[request]])
        print('Success:', success)
        print('Failed:', failed)
        vault.sync_down()
        return success, failed

    except share_management_utils.ShareValidationError as err:
        print(f'Validation error: {err}')
        raise
    finally:
        vault.close()
        keeper_auth_context.close()


# --- Usage examples ---

# Basic grant
# share_folder(auth, shared_folder_uid='IQ_...', users=['[e-mail]'])

# Grant with ROE
# share_folder(
#     auth,
#     shared_folder_uid='IQ_...',
#     users=['[e-mail]'],
#     expire_in='7d',
#     rotate_on_expiration=True,
# )

# Grant team + specific records
# share_folder(
#     auth,
#     shared_folder_uid='IQ_...',
#     teams=['IQ_teamUid'],
#     record_uids=['IQ_recordUid1', 'IQ_recordUid2'],
#     manage_records='on',
#     can_edit='on',
#     can_share='off',
# )

# Remove user
# share_folder(
#     auth,
#     shared_folder_uid='IQ_...',
#     users=['[e-mail]'],
#     action='remove',
# )

# Set default folder permissions (-e '*' -r '*')
# share_folder(
#     auth,
#     shared_folder_uid='IQ_...',
#     default_account=True,
#     default_record=True,
#     manage_records='on',
#     manage_users='off',
#     can_edit='on',
#     can_share='off',
# )

JavaScript SDK

Function: listSharedFolders

function listSharedFolders(
    storage: InMemoryStorage,
    options: ListSharedFoldersOptions = {}
): ListSharedFolderRow[] {
    const { pattern, includeDetails = false } = options
    const sharedFolders: DSharedFolder[] = pattern
        ? findSharedFolders(storage, pattern)
        : storage.getAll<DSharedFolder>(FolderKind.SharedFolder)
    return sharedFolders.map((sharedFolder) => {
        const shared_folder_uid = sharedFolder.uid
        const name = sharedFolderDisplayName(sharedFolder)
        const row: ListSharedFolderRow = { shared_folder_uid, name }
        if (includeDetails) {
            row.record_count = countRecordsForFolder(storage, shared_folder_uid)
            row.user_count = countUsersForFolder(storage, shared_folder_uid)
            row.team_count = countTeamsForFolder(storage, shared_folder_uid)
            row.default_manage_records = sharedFolder.defaultManageRecords
            row.default_manage_users = sharedFolder.defaultManageUsers
            row.default_can_edit = sharedFolder.defaultCanEdit
            row.default_can_share = sharedFolder.defaultCanShare
        }
        return row
    })
}

Shared Folder - Change Record Permissions Command

Allows users to change the permissions of records within a shared folder. Users can add or revoke permissions for individual records as needed.

DotNet CLI

Command: sf-record

Flag:

• -r, --record : The record name or record UID of the item that needs to be shared within the shared folder.

• -s, --can-share : A Boolean value (true or false). If true, the user has share permission. If false, the edit permission will be removed.

• -e, --can-edit : A Boolean value (true or false). If true, the user has edit permission. If false, the edit permission will be removed.

• --expire-at : Expire share at ISO time: YYYY-MM-DD HH🇲🇲SS

• --expire-in : Expire share in period: [N]mi|h|d|mo (Minutes / hours / days / months)

• --help : Display this help screen.

• --version : Display version information.

• folder name (pos. 0) : Required. folder name

Example:

My Vault> sf-record record_uid
  #  Record Title   Record UID              Can Edit  Can Share  Expiration
---  -------------  ----------------------  --------  ---------  ----------
  1  ABC            record_uid              X         X
  2  Gmail Account  record_uid              X         X
  3  Gmail Account  record_uid              X         X

My Vault> sf-record folder_uid --record=record_uid --expire-in=30mi

My Vault> sf-record BRvqCEzmFM9rVqkmpeGs6A
  #  Record Title   Record UID              Can Edit  Can Share  Expiration
---  -------------  ----------------------  --------  ---------  ----------------
  1  ABC            record_uid              X         X          03-11-2025 18:08
  2  Gmail Account  record_uid              X         X
  3  Gmail Account  record_uid              X         X

DotNet SDK

Function: ChangeRecordInSharedFolder

public async Task ChangeRecordInSharedFolder(string sharedFolderUid, string recordUid, IRecordShareOptions options)

Example:

await context.Vault.ChangeRecordInSharedFolder(sf.Uid, recordUid, shareOptions);

Power Commander

Command : Set-KeeperSharedFolderRecordPermission

Alias: ksfr

Flags:

• -SharedFolder : UID, name, or object containing the shared folder UID/name.

• -Record : UID or object containing the record UID.

• -CanEdit : Whether shared-folder members can edit the record. Accepts true, false, 1, or 0.

• -CanShare : Whether shared-folder members can re-share the record. Accepts true, false, 1, or 0.

• -ExpireIn : Sets the record permission expiration relative to the current time, such as 30d or 1h.

• -ExpireAt : Sets an absolute expiration date and time.

• -RotateOnExpiration : Rotates the record password when the permission expires. Requires an expiration and a shared folder containing a configured pamUser rotation record.

• -WhatIf : Previews the permission change without making changes.

• -Confirm : Requests confirmation before changing permissions.

Example:

PS> Set-KeeperSharedFolderRecordPermission -SharedFolder "shared_folder_uid" -Record "record_uid" -CanEdit false -CanShare true

Python CLI

Command: record-permission

Parameters:

• -a, --action Grant or Revoke (required)

• folder Shared folder uid to which the changes need to be applied (required)

Options:

• --dry-run Display the permissions changes without committing them

• --force Apply permission changes without any confirmation

• -R, --recursive Apply permission changes to all sub-folders

• --share-record Change a records sharing permissions

• --share-folder Change a folders sharing permissions

• -s, --can-share Set record permission: can be shared

• -d, --can-edit Set record permission: can be edited

  • --can-edit or --can-share is required

• Example:

My Vault> record-permission -a grant --share-record -s -d shared_folder_uid

Request to GRANT "Can Edit" & "Can Share" permission(s) in "my_share" folder only

Python SDK

Command :

from keepersdk.vault import share_management_utils
​
result = share_management_utils.update_record_permissions(
            vault=vault,
            action=action,
            can_share=can_share,
            can_edit=can_edit,
            folder_uid_or_path=folder_uid_or_path,
            recursive=recursive,
            share_record=share_record,
            share_folder=share_folder,
            dry_run=dry_run,
            sync_after=sync_after,
        )

Add user or team to Share Folder Command

Add a user or team to a shared folder with specified access permissions.

DotNet CLI

Command: Coming soon.

DotNet SDK

Function:

    public bool PutUserToSharedFolder(string sharedFolderUid, string userId, UserType userType, IUserShareOptions options = null)
    {
        if (!TryGetFolderByUid(sharedFolderUid, out var f))
        {
            BatchLogger?.Invoke(Severity.Warning, $"Folder UID \"{sharedFolderUid}\" not found");
            return false;
        }

        switch (f.FolderType)
        {
            case FolderType.UserFolder:
                BatchLogger?.Invoke(Severity.Warning, $"Folder UID \"{sharedFolderUid}\" is not a shared folder");
                return false;
            case FolderType.SharedFolderFolder:
                BatchLogger?.Invoke(Severity.Information, $"Folder UID \"{sharedFolderUid}\" is a shared subfolder folder. Selecting a parent shared folder.");
                sharedFolderUid = f.SharedFolderUid;
                if (!TryGetFolderByUid(sharedFolderUid, out f))
                {
                    BatchLogger?.Invoke(Severity.Warning, $"Folder UID \"{sharedFolderUid}\" not found");
                }
                if (f.FolderType != FolderType.SharedFolder)
                {
                    BatchLogger?.Invoke(Severity.Warning, $"Folder UID \"{sharedFolderUid}\" is not a shared folder");
                }
                break;
        }

        SharedFolderMember pendingMembership = null;

        if (_sharedFolderMembership.TryGetValue(sharedFolderUid, out var currentSharedFolder))
        {
            currentSharedFolder.TryGetValue(userId, out pendingMembership);
        }

        if (pendingMembership != null)
        {
            pendingMembership.IsRemove = false;
            pendingMembership.Options = options;
            return true;
        }

        pendingMembership = new SharedFolderMember
        {
            UserId = userId,
            UserType = userType,
            IsRemove = false,
            Options = options,
        };
        if (currentSharedFolder == null)
        {
            currentSharedFolder = new Dictionary<string, SharedFolderMember>();
            _sharedFolderMembership.Add(sharedFolderUid, currentSharedFolder);
        }
        currentSharedFolder.Add(userId, pendingMembership);
        return true;
    }

Power Commander

Command: Grant-KeeperSharedFolderAccess -SharedFolder <String> [-User <String>] [-Team <String>] [-ManageUsers <Boolean>] [-ManageRecords <Boolean>] [-TransferRecords <Boolean>] [-AllowShareFullVault <Boolean>] [-WhatIf] [-Confirm]

Flag:

• -SharedFolder : Shared folder UID or name to which access will be granted.

• -User : Email or user UID to grant access to. Either -User or -Team must be specified.

• -Team : Team UID or name to grant access to. Either -User or -Team must be specified.

• -ManageUsers : Grant permission to manage users in the shared folder.

• -ManageRecords : Grant permission to manage records in the shared folder.

• -TransferRecords : Grant permission to transfer record ownership within the shared folder.

• -AllowShareFullVault : Grant permission to share records from the full vault (not just shared folder).

• -WhatIf : Shows what would happen if the cmdlet runs without actually executing.

• -Confirm : Prompts for confirmation before executing the cmdlet.

Example:

PS> Grant-KeeperSharedFolderAccess -SharedFolder "Marketing" -User "[e-mail]"

PS> Grant-KeeperSharedFolderAccess -SharedFolder "Finance" -User "[e-mail]" 
    -ManageUsers $true -ManageRecords $true

Python CLI

Command: coming Soon

Python SDK

Function: Coming soon

Remove user or team from Share Folder Command

Remove a user or team from a shared folder.

DotNet CLI

Command: Coming soon.

DotNet SDK

Function:

        public async Task RemoveUserFromSharedFolder(string sharedFolderUid, string userId, UserType userType)
        {
            var sharedFolder = this.GetSharedFolder(sharedFolderUid);
            var perm = sharedFolder.UsersPermissions.FirstOrDefault(x => x.UserType == userType &&
            (string.Equals(x.Uid, userId, StringComparison.InvariantCulture) || string.Equals(x.Name, userId, StringComparison.InvariantCultureIgnoreCase)));

            if (perm == null)
            {
                return;
            }

            var request = new SharedFolderUpdateV3Request
            {
                SharedFolderUid = ByteString.CopyFrom(sharedFolder.Uid.Base64UrlDecode()),
                EncryptedSharedFolderName = ByteString.CopyFrom(CryptoUtils.EncryptAesV1(Encoding.UTF8.GetBytes(sharedFolder.Name), sharedFolder.SharedFolderKey)),
                ForceUpdate = true,

            };
            {
                var ap = this.ResolveSharedFolderAccessPath(Auth.Username, sharedFolderUid, true);
                if (ap != null && ap.UserType == UserType.Team)
                {
                    request.FromTeamUid = ByteString.CopyFrom(perm.Uid.Base64UrlDecode());
                }
            }

            if (userType == UserType.User)
            {
                request.SharedFolderRemoveUser.Add(perm.Name);
            }
            else
            {
                request.SharedFolderRemoveTeam.Add(ByteString.CopyFrom(perm.Uid.Base64UrlDecode()));
            }

            var response = await Auth.ExecuteAuthRest<SharedFolderUpdateV3Request, SharedFolderUpdateV3Response>("vault/shared_folder_update_v3", request);
            foreach (var arr in (new[] { response.SharedFolderRemoveUserStatus }))
            {
                var failed = arr?.FirstOrDefault(x => x.Status != "success");
                if (failed != null)
                {
                    throw new VaultException($"Remove User \"{failed.Username}\" from Shared Folder \"{sharedFolder.Name}\" error: {failed.Status}");
                }
            }

            foreach (var arr in (new[] { response.SharedFolderRemoveTeamStatus }))
            {
                var failed = arr?.FirstOrDefault(x => x.Status != "success");
                if (failed != null)
                {
                    var uid = failed.TeamUid.ToArray().Base64UrlEncode();
                    throw new VaultException($"Remove Team \"{uid}\" from Shared Folder \"{sharedFolder.Name}\" error: {failed.Status}");
                }
            }

            await SyncDown();
        }

Power Commander

Command: Revoke-KeeperSharedFolderAccess -SharedFolder <String> [-User <String>] [-Team <String>] [-Force] [-WhatIf] [-Confirm]

Flag:

• -SharedFolder : Shared folder UID or name to which access will be granted.

• -User : Email or user UID to grant access to. Either -User or -Team must be specified.

• -Team : Team UID or name to grant access to. Either -User or -Team must be specified.

• -Force : Revoke access without confirmation prompt.

• -WhatIf : Shows what would happen if the cmdlet runs without actually executing.

• -Confirm : Prompts for confirmation before executing the cmdlet.

Example:

PS> Grant-KeeperSharedFolderAccess -SharedFolder "Marketing" -User "[e-mail]"

PS> Grant-KeeperSharedFolderAccess -SharedFolder "Finance" -User "[e-mail]" 
    -ManageUsers $true -ManageRecords $true

Python CLI

Command: coming Soon

Python SDK

Function: Coming soon

JavaScript SDK

Function: shareFolder

function shareFolder(
    auth: Auth,
    storage: InMemoryStorage,
    input: ShareFolderInput
): Promise<ShareFolderResult> {
    const resolved = resolveFolder(storage, input.folder)
    if (!resolved) {
        throw new KeeperSdkError(`Folder "${input.folder}" was not found.`, 'folder_not_found')
    }
    if (resolved.kind === FolderKind.UserFolder) {
        throw new KeeperSdkError(
            `"${resolved.displayName}" is a personal folder. Only shared folders can be shared.`,
            'not_a_shared_folder'
        )
    }
    r