# Import Export Commands

### Overview

Keeper Commander supports several powerful CLI commands for migrating and managing vault data. These commands facilitate data import from various formats, exporting vault contents, and synchronizing shared folder permissions and custom templates.

### Commands

The following commands are supported

1. [Import Command](#import-command)
2. [Export Command](#export-command)
3. [Download Membership Command](#download-membership-command)
4. [Apply Membership Command](#apply-membership-command)
5. [Download Record Types Command](#download-record-types-command)
6. [Load Record Types Command](#load-record-types-command)

### Import Command

Import records and folders into your Keeper vault from local files or external password managers.

<details>

<summary>DotNet CLI</summary>

**Note:** The dotnet implementation of this command supports only import of json file only.

**Command:** i`mport`

**Flag:**

`filename` : this is name of the file which contains json to be imported into keeper

**Exception:**

```bash
MyVault> import <file_path.json>
```

</details>

<details>

<summary>DotNet SDK</summary>

**Note:** This function supports just json import of records.

**Function:**

```csharp
public static ImportFile LoadJsonDictionary(IDictionary<string, object> importFile)
```

**Flag:**

* `importFile` : this is dictionary of the objects which constitute individual records or folders etc.

</details>

<details>

<summary>PowerCommander</summary>

**Command :** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command** : `import`

**Parameters** :

* `name` : file name (json, csv, keepass, 1password), account name (lastpass\_lib), or URL (Thycotic)

**Options**:

* `--display-csv, -dc` : display Keeper CSV import instructions
* `--display-json, -dj` : display Keeper JSON import instructions
* `--format` : {json, csv, keepass, lastpass, 1password, bitwarden, thycotic} file format
* `--dry-run` : display records to be imported without importing them
* `--folder` : IMPORT\_INTO import into a separate folder.
* `--filter-folder` : FILTER\_FOLDER import data from the specific folder only.
* `-s, --shared` : import folders as Keeper shared folders
* `-p, --permissions` : PERMISSIONS default shared folder permissions: manage (U)sers, manage (R)ecords, can (E)dit, can (S)hare, or (A)ll, (N)one
* `--record-type` : RECORD\_TYPE Import legacy records as record type. login if empty
* `--show-skipped` : Display skipped records

**Example:**

```sh
My Vault> import /Users/user/Desktop/records.json --format json
Record "My Record" was skipped: A full record match already exists
```

</details>

<details>

<summary>Python SDK</summary>

**Class to use** :

To import json records we can use the following class

```python
class KeeperJsonImporter(import_data.BaseFileImporter, KeeperJsonMixin):
```

To import records from LastPass we can use following class

```python
class LastPassImporter(BaseImporter):
```

To import records from key pass, we can use following class

```python
class KeepassImporter(import_data.BaseFileImporter):
```

This class object can be used as importer object for following functions

**Function** :

`keepersdk.importer.import_utils.py`

```python
def do_import_vault(vault: vault_online.VaultOnline,
                    data_source: import_data.BaseImporter,
                    *,
                    import_logger: Optional[import_data.IImportLogger]=None,
                    filter_folder: Optional[str]=None,
                    **kwargs
                    ) -> None:
```

data source will be the object we have created earlier

**Arguments**

`vault` - VaultOnline instance

`data_source` - Importer Class

`import_logger` - This is logger object of class `ImportData`.

</details>

### Export Command

This command allows you to export your vault data (records, folders, shared folders) from Keeper to your local system.

<details>

<summary>DotNet CLI</summary>

**Note:** The dotnet implementation of this command supports JSON export of vault data including records, folders, and shared folder information.

**Command:** `export`

**Flags:**

* **filename** (required): Name of the output JSON file to export vault data
* **--force** or **-f** (optional): Overwrite existing file without prompting
* **--exclude-shared-folders** or **-x** (optional): Exclude shared folders from export

**Examples:**

```
MyVault> export vault_backup.json

MyVault> export vault_backup.json --force

MyVault> export vault_backup.json --exclude-shared-folders
```

</details>

<details>

<summary>DotNet SDK</summary>

**Note:** This function exports vault records, folders, and shared folder information to JSON format.

**Functions:**

1. **Export to JSON string:**

```csharp
public static async Task<string> ExportVaultToJson(this VaultOnline vault, 
    IEnumerable<string> recordUids = null,
    bool includeSharedFolders = true,
    Action<Severity, string> logger = null)
```

2. **Export to file:**

```csharp
public static async Task ExportVaultToFile(this VaultOnline vault,
    string filename,
    IEnumerable<string> recordUids = null,
    bool includeSharedFolders = true,
    Action<Severity, string> logger = null)
```

**Flags:**

* **vault**: The authenticated VaultOnline instance
* **filename**: Path to the output JSON file
* **recordUids**: Optional list of specific record UIDs to export (null exports all)
* **includeSharedFolders**: Whether to include shared folder information (default: true)
* **logger**: Optional logging callback

</details>

<details>

<summary>PowerCommander</summary>

**Command :** `Export-KeeperVault`

**Alias:** `kexport`

**Parameters**

<table><thead><tr><th width="226.9501953125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><strong>FileName</strong></td><td>Output path or filename. If it does not end with <code>.json</code>, <code>.json</code> is appended.</td></tr><tr><td><strong>Force</strong></td><td>Overwrite an existing file without prompting.</td></tr><tr><td><strong>ExcludeSharedFolders</strong></td><td>Export only records; omit shared folders from the JSON.</td></tr></tbody></table>

#### Examples

**Basic export**

Export the vault to `vault_backup.json`. If the file exists, you are prompted to overwrite:

```powershell
Export-KeeperVault -FileName "vault_backup.json"
```

Or with full path:

```powershell
Export-KeeperVault -FileName "C:\Backups\keeper_vault.json"
```

**Overwrite without prompting**

Use `-Force` to overwrite an existing file without confirmation:

```powershell
Export-KeeperVault -FileName "vault.json" -Force
```

**Records only (no shared folders)**

Export only vault records, excluding shared folder data:

```powershell
Export-KeeperVault -FileName "records_only.json" -ExcludeSharedFolders
```

**Using the alias**

```powershell
kexport -FileName "backup" -Force
```

***

#### Output

The command writes JSON to the specified path and then prints a summary, for example:

```
Exporting vault data...

Export Summary:
    Records Exported: 42
    Shared Folders: 5
    File Size: 125,340 bytes
    Output File: C:\Backups\vault_backup.json

Export completed successfully.
```

When `-ExcludeSharedFolders` is used, the shared folder count line is omitted.

</details>

<details>

<summary>Python CLI</summary>

**Command:** `export`

**Parameters:**

* `name` : file name or console output if omitted

**Options**:

* `--format {json,csv,keepass}` : file format
* `--max-size MAX_SIZE` : Maximum file attachment file. Example: 100K, 50M, 2G. Default: 10M
* `--file-password FILE_PASSWORD` : Password for the exported file
* `--zip` : Create ZIP archive for file attachments. JSON only
* `--force` : Suppress user interaction. Assume "yes"
* `--folder FOLDER` : Export data from the specific folder only.

**Example:**

```bash
My Vault> export "export-command.json" --folder "example folder" --format json
5 records exported
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `KeeperJsonExporter.vault_export`

```python
from keepersdk.importer import keeper_format

exporter = KeeperJsonExporter
exporter.vault_export(items: List[Union[import_data.Record, import_data.SharedFolder, import_data.Team]])
```

</details>

### Download Membership Command

This command downloads the sharing settings of your shared folders, including:

* Which users **or** teams have access
* What permissions they have (read-only, edit, manage)

<details>

<summary>DotNet CLI</summary>

**Note:** The dotnet implementation downloads shared folder and team membership information for migration purposes. Currently supports only Keeper as the source.

**Command:** `download-membership`

**Parameters:**

* `--source`**:** Membership source - valid values: `keeper`, `lastpass`, `thycotic` (only `keeper` is currently implemented)

**Flags:**

* `filename`: Output JSON filename (default: `shared_folder_membership.json`)
* `--force` or `-f`: Overwrite existing file; if not set, data will be merged with existing file
* `--folders-only`: Download shared folders only, skip teams
* `--permissions` or `-p`: Force shared folder permissions - values: `U` (manage users), `R` (manage records)
* `--restrictions` or `-r` : Force shared folder restrictions - values: `U` (manage users), `R` (manage records)
* `--sub-folder` : Shared sub-folder handling - values: `ignore`, `flatten`

**Examples:**

```
MyVault> download-membership --source keeper

MyVault> download-membership --source keeper membership.json

MyVault> download-membership --source keeper --force --folders-only

MyVault> download-membership --source keeper --permissions UR

MyVault> download-membership --source keeper --sub-folder flatten
```

</details>

<details>

<summary>DotNet SDK</summary>

**Note:** This function downloads shared folder and team membership information from the vault.

**Functions:**

1. **Download to ExportFile object:**

```csharp
public static async Task<ExportFile> DownloadMembership(this VaultOnline vault,
    DownloadMembershipOptions options = null,
    Action<Severity, string> logger = null)
```

2. **Download to JSON string:**

```csharp
public static async Task<string> DownloadMembershipToJson(this VaultOnline vault,
    DownloadMembershipOptions options = null,
    Action<Severity, string> logger = null)
```

3. **Download to file:**

```csharp
public static async Task DownloadMembershipToFile(this VaultOnline vault,
    string filename,
    DownloadMembershipOptions options = null,
    Action<Severity, string> logger = null)
```

4. **Merge with existing file:**

```csharp
public static async Task MergeMembershipToFile(this VaultOnline vault,
    string filename,
    DownloadMembershipOptions options = null,
    Action<Severity, string> logger = null)
```

**DownloadMembershipOptions:**

* **FoldersOnly**: Include only shared folders, skip teams (default: false)
* **ForceManageUsers**: Force manage users permission for all users (nullable bool)
* **ForceManageRecords**: Force manage records permission for all users (nullable bool)
* **SubFolderHandling**: Subfolder handling mode - values: `"ignore"`, `"flatten"`

**Flags:**

* **vault**: The authenticated VaultOnline instance
* **filename**: Path to the output JSON file
* **options**: Configuration options for the download operation
* **logger**: Optional logging callback

</details>

<details>

<summary>PowerCommander</summary>

**Command :** `Export-KeeperMembership`

**Flags:**

* `-FileName` (Optional, default: `shared_folder_membership.json`) - Output JSON filename. Extension `.json` added automatically if not specified.
* `-Force` (Optional) - Overwrite existing file. Without this flag, data is merged with existing file.
* `-FoldersOnly` (Optional) - Download shared folders only, skip teams
* `-ForceManageUsers` (Optional) - Force enable 'manage users' permission for all users in all shared folders
* `-ForceManageRecords` (Optional) - Force enable 'manage records' permission for all users in all shared folders
* `-RestrictManageUsers` (Optional) - Force disable 'manage users' permission for all users in all shared folders
* `-RestrictManageRecords` (Optional) - Force disable 'manage records' permission for all users in all shared folders
* `-SubFolderHandling` (Optional) - Shared sub-folder handling. Valid values: `ignore`, `flatten`

**Notes:**

* Cannot specify both `-ForceManageUsers` and `-RestrictManageUsers`
* Cannot specify both `-ForceManageRecords` and `-RestrictManageRecords`
* If output file exists and `-Force` is not used, new data is merged by UID (new entries override, additional entries preserved)
* Parent directories are created automatically if they don't exist

**Example:**

```powershell
PS> Export-KeeperMembership                  
Downloading shared folder membership from Keeper...

Download Summary:
    Shared Folders: 6
    Teams: 7
    Output File: /Users/satish/Desktop/sdk-dotnet/keeper-sdk-dotnet/shared_folder_membership.json

Download membership completed successfully.
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `download-membership`

**Parameters:**

* `--source {keeper,lastpass,thycotic}` : Shared folder membership source

**Options**:

* `-p, --permissions` : PERMISSIONS force shared folder permissions: manage Users(U), manage Records(R).
* `-r, --restrictions` : RESTRICTIONS force shared folder restrictions: manage Users(U), manage Records(R).
* `--folders-only` : Unload shared folders only. Skip teams
* `--sub-folder, -sf {ignore,flatten}` : hared sub-folder handling
* `name` : Output file name. "shared\_folder\_membership.json" if omitted.

**Example:**

```bash
My Vault> download-membership --source keeper
10 shared folder memberships added.
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `download_membership`

```python
download_membership(self, folders_only: Optional[bool] = False, **kwargs
                            ) -> Iterable[Union[import_data.SharedFolder, import_data.Team]]:
```

</details>

### Apply Membership Command

This command restores or applies shared folder permissions from a JSON file created by `download-membership`.

* Add the correct users/teams to folders
* Set their permissions automatically

#### JSON File Format

The input file must be valid JSON with a top-level `shared_folders` array. Each shared folder can be identified by `uid` or `path` and contains a `permissions` array.

#### Structure

```json
{
  "shared_folders": [
    {
      "uid": "VPBeke23vou0z-zg2j30iA",
      "path": "My Shared Folder",
      "can_edit": true,
      "can_share": true,
      "manage_records": true,
      "manage_users": true,
      "permissions": [
        {
          "name": "user@company.com",
          "manage_records": true,
          "manage_users": true
        },
        {
          "uid": "team_uid_base64",
          "name": "Engineering Team",
          "manage_records": false,
          "manage_users": true
        }
      ]
    }
  ]
}
```

#### Shared folder object

| Field            | Type    | Required | Description                                                                      |
| ---------------- | ------- | -------- | -------------------------------------------------------------------------------- |
| `uid`            | string  | No\*     | Shared folder UID (base64url). Use this or `path`.                               |
| `path`           | string  | No\*     | Shared folder path (e.g. folder name). Resolved to a shared folder in the vault. |
| `can_edit`       | boolean | No       | Folder-level edit flag                                                           |
| `can_share`      | boolean | No       | Folder-level share flag                                                          |
| `manage_records` | boolean | No       | Folder-level manage records                                                      |
| `manage_users`   | boolean | No       | Folder-level manage users                                                        |
| `permissions`    | array   | Yes      | List of user/team permissions to apply                                           |

\* At least one of `uid` or `path` is required to identify the shared folder.

#### Permission object (per user/team)

| Field            | Type    | Required | Description                                             |
| ---------------- | ------- | -------- | ------------------------------------------------------- |
| `name`           | string  | Yes      | User email or team name (used to resolve user/team)     |
| `uid`            | string  | No       | Team UID (for teams). If present, used for team lookup. |
| `manage_records` | boolean | No       | Allow member to manage records in the shared folder     |
| `manage_users`   | boolean | No       | Allow member to manage users in the shared folder       |

#### Example file

```json
{
  "shared_folders": [
    {
      "path": "Team Credentials",
      "uid": "VPBeke23vou0z-zg2j30iA",
      "permissions": [
        {
          "name": "alice@company.com",
          "manage_records": true,
          "manage_users": true
        },
        {
          "name": "bob@company.com",
          "manage_records": false,
          "manage_users": true
        }
      ]
    }
  ]
}
```

<details>

<summary>DotNet CLI</summary>

**Command : `apply-membership [filename] [options]`**

**Parameters**

<table><thead><tr><th width="144.875">Parameter</th><th>Default</th><th>Description</th></tr></thead><tbody><tr><td><code>filename</code></td><td><code>shared_folder_membership.json</code></td><td>Path to the JSON membership file</td></tr><tr><td><code>--full-sync</code></td><td>false</td><td>If set, also <strong>update</strong> and <strong>remove</strong> membership so the vault matches the file</td></tr></tbody></table>

**Examples**

```console
My Vault> apply-membership /path/to/membership.json
//or 
My Vault> apply-membership --full-sync
//or
My Vault> apply-membership ./prod-membership.json --full-sync
```

</details>

<details>

<summary>DotNet SDK</summary>

**Namespace:** `KeeperSecurity.Vault`

**Function:** `KeeperApplyMembership.ApplyMembership` (extension on `VaultOnline`)

```csharp
public static async Task<MembershipSummary> ApplyMembership(
    this VaultOnline vault,
    ImportFile importFile,
    ApplyMembershipOptions options = null)
```

**Types:**

* **`ImportFile`** – Parsed JSON input (from `KeeperSecurity.Commands`). Contains `SharedFolders` array.
* **`ApplyMembershipOptions`** – Optional. `FullSync = true` to also update and remove members.
* **`MembershipSummary`** – Result: `TeamsAdded`, `UsersAdded`, `TeamsUpdated`, `UsersUpdated`, `TeamsRemoved`, `UsersRemoved`.

**Example:**

```cs
using System;
using System.IO;
using System.Threading.Tasks;
using KeeperSecurity.Commands;
using KeeperSecurity.Utils;
using KeeperSecurity.Vault;

var fileName = "shared_folder_membership.json";
var jsonBytes = File.ReadAllBytes(fileName);
var importFile = JsonUtils.ParseJson<ImportFile>(jsonBytes);

var options = new ApplyMembershipOptions
{
    FullSync = true   // optional: also update and remove members
};

var membershipSummary = await vault.ApplyMembership(importFile, options);
```

</details>

<details>

<summary>PowerCommander</summary>

**Command : `Import-KeeperMembership`**

**Flag** :

* `Source` - currently only `keeper` is supported.
* `FileName` - file name to store the data to, this can be file path too.
* `SSHKeyAsFile` - whether to store ssh keys as files or to store them as data, when set to true, files will be download.

**Example:**

```
PS PowerCommander> Import-KeeperMembership -FileName "/<PATH_TO_JSON>/shared_folder_membership.json" -FullSync
Processing 1 shared folder(s)...

1 user(s) added to shared folders

Apply membership completed successfully.
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `apply-membership`

**Parameters:**

* `name` : Input file name. "shared\_folder\_membership.json" if omitted

**Options**:

* `--full-sync` : Update and remove membership also.

**Example:**

```bash
My Vault> apply-membership ./shared_folder_membership.json
1 user(s) added to shared folders
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `import_user_permissions`

```bash
from keepersdk.importer import import_utils
import_utils.import_user_permissions(vault: vault_online.VaultOnline,
                            shared_folders: List[import_data.SharedFolder],
                            full_sync=False) -> UserPermissionSummary:
```

</details>

### Download Record Types Command

This command downloads your custom record types (templates you use for special data like server logins, SSH keys, etc.) into a JSON file.

<details>

<summary>DotNet CLI</summary>

**Command:** `download-record-types`

**Flag:**

* `source` : this is source from which we are pulling record types from

**Example**:

```sh
My Vault> download-record-types keeper
Downloaded 12 record types to "<some_path>/record_types.json"
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
vault.RecordTypes.ToList()
```

**Example:**

```csharp
var recordTypes = vault.RecordTypes.ToList();
// write recordTypes to file
```

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Export-KeeperRecordTypes`

**Flag** :

* `Source` - currently only `keeper` is supported.
* `FileName` - file name to store the data to, this can be file path too.
* `SSHKeyAsFile` - whether to store ssh keys as files or to store them as data, when set to true, files will be download.

**Example:**

```powershell
PS> Export-KeeperRecordTypes 
Downloaded 12 record types to '/<some path>/record_types.json'
```

</details>

<details>

<summary>Python CLI</summary>

**Command** : `download-record-types`

**Parameters** :

* `--source {keeper}` : Record Type Source. Only "keeper" is currently supported.

**Options**:

* `--ssh-key-file` : Prefer store SSH keys as file attachments rather than fields on a record
* `--name` : NAME Output file name. "record\_types.json" if omitted.

**Example:**

```bash
My Vault> download-record-types --name record_type.json --source keeper
Downloaded 13 record types to "file-path"
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** Not Supported

</details>

### Load Record Types Command

This command uploads your custom record types from a JSON file into Keeper.

* Created templates in another account
* Want to standardise templates across teams

<details>

<summary>DotNet CLI</summary>

**Command** : `load-record-types`

**Flag** :

* `--help` : Display this help screen.
* `--version` : Display version information.
* `<paraeter at position one>` - File path to load record type from

**Example:**

```sh
My Vault > load-record-types ../custom-record.json   
Record types loaded: 1
Existing Record Types which are skipped: None
Failed Record Types: None
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
Task<string> AddRecordType(string recordTypeData)
```

**Flags:**

* `recordTypeData`

**Example:**

```csharp
var parsedRecord = RecordTypeService.CreateRecordTypeObject(recordType);
var recordTypeID = await context.Vault.AddRecordType(Encoding.UTF8.GetString(JsonUtils.DumpJson(parsedRecord)));
```

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Import-KeeperRecordTypes`

**Flag:**

* `-FilePath` : File path for the record type file.

**Example:**

```powershell
PS> Import-KeeperRecordTypes -FilePath ./record_type.json
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `load-record-types`

**Parameters:**

* `--file FILE` : Path to the JSON file containing the record type definition.

**Example:**

```sh
My Vault> load-record-types --file ./record_type.json
Custom record types imported successfully. 1 record types were added.
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** Not Supported

</details>