# Secrets Manager App Commands

### Secrets Manager App Commands

This subset of secrets manager command deal with keeper secrets manager applications found in vault under **Secrets Manager > My Applications.** These Commands help with performing CRUD and share/un-share operations for applications, so that you can use the app to access your vault data like secrets and folders.

**Commands**:

* [list](#secrets-manager-app-list)
* [create](#secrets-manager-app-create)
* [view](#secrets-manager-app-view)
* [delete](#secrets-manager-app-delete)
* [share](#secrets-manager-app-share)
* [unshare](#secrets-manager-app-unshare)

### Secrets Manager App List

This action retrieves and displays a table of all Secrets Manager applications currently available in the Keeper vault. Each row contains the unique application UID and the application’s title. This is useful for quickly reviewing all registered apps before managing access or clients.

<details>

<summary>DotNet CLI</summary>

**Command:**  `ksm list`&#x20;

**Flags:**&#x20;

* `--folder` : Shared Folder UID or name. "share", "unshare" only
* `-e, --can-edit` : Can secret be edited? "share", "unshare" only
* `--client-name` : Client name. "add-client", "remove-client" only
* `--unlock-ip` : Unlock IP Address? "add-client" only
* `--create-expire` : Device creation expitation in minutes. "add-client" only
* `--access-expire` : Device access expitation in minutes. "add-client" only
* `--b64` : Return KSM configuration intead of one time token "add-client" only
* `--email` : User UID or email address."app-share", "app-unshare" only
* `--is-admin` : Share as admin user. "app-share", "app-unshare" only
* `--help` : Display this help screen.
* `--version` : Display version information.
* `value pos. 0` : KSM command options: "`view`", "`create`", "`delete`", "`share`", "`unshare`", "`add-client`", "`delete-client`", "`list`", "`app-share`", "`app-unshare`"
* `value pos. 1` : Secret Manager application UID or Title

**Example:**

```
My Vault> ksm list

  #  Application UID         Title          
---  ----------------------  ---------------
  1  ksm_app_uid             DemoApplication
```

</details>

<details>

<summary>DotNet SDK</summary>

Application list can be obtained from sdk using the following snippet, provided the vault is authenticated before.

```csharp
foreach (var app in context.Vault.KeeperRecords.OfType<ApplicationRecord>())
{
    Console.WriteLine(app.Uid, app.Title);
}
```

</details>

<details>

<summary>PowerCommander</summary>

**Command**: `Get-KeeperSecretManagerApp`&#x20;

**Aliases:** `ksm`

**Flags**:&#x20;

* `-Uid`&#x20;
* `-Filter`&#x20;
* `-Detail`&#x20;

**Example:**

```powershell
PS> Get-KeeperSecretManagerApp
ksm

# Get specific app
Get-KeeperSecretManagerApp -Uid "AppUID"
```

</details>

<details>

<summary>Python CLI</summary>

**Command**: `secrets-manager-app --command='list'`&#x20;

**Parameters**:&#x20;

* `--command` : list

**Example:**

```sh
My Vault> secrets-manager-app --command='list'

App Name     App UID                 Records   Folders  Devices  Last Access     
---------    ----------------------  --------  -------  -------  ---------
My App       ksm_app_uid             10         2       40       2025-01-01
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `list_secrets_manager_apps`

```python
from keepersdk.vault import ksm_management

app_list = ksm_management.list_secrets_manager_apps(vault=vault)
for app in app_list:
    print(app.name)
    print(app.uid)
    print(app.records)
    print(app.folders)
    print(app.count)
    print(app.last_access)
    print(app.client_devices)
    print(app.shared_secrets)
```

</details>

### Secrets Manager App Create

The `create` action creates a new Secrets Manager Application record in the Keeper Vault. This application can later be configured with client devices and shared folders for secrets management and automation use cases. Optionally, an application name (`KsmId`) can be specified during creation.

Once created, the application’s UID and title will be displayed in the output.

<details>

<summary>DotNet CLI</summary>

**Command**: `ksm create <APP_NAME>`

**Flags:**&#x20;

* `--folder` : Shared Folder UID or name. "share", "unshare" only
* `-e, --can-edit` : Can secret be edited? "share", "unshare" only
* `--client-name` : Client name. "add-client", "remove-client" only
* `--unlock-ip` : Unlock IP Address? "add-client" only
* `--create-expire` : Device creation expiration in minutes. "add-client" only
* `--access-expire` : Device access expiration in minutes. "add-client" only
* `--b64` : Return KSM configuration instead of one time token "add-client" only
* `--email` : User UID or email address. "app-share", "app-unshare" only
* `--is-admin` : Share as admin user. "app-share", "app-unshare" only
* `--help` : Display this help screen.
* `--version` : Display version information.
* `value pos. 0` : KSM command: "`view`", "`create`", "`delete`", "`share`", "`unshare`", "`add-client`", "`delete-client`", "`list`", "`app-share`", "`app-unshare`"
* `value pos. 1` : Secret Manager application UID or Title

**Example:**

```sh
My Vault> ksm create DemoApplicationCreateTest
     Application UID: <AppUID>
               Title: DemoApplicationCreateTest
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:** `CreateSecretManagerApplication`&#x20;

**Example:**

```csharp
var ApplicationRecord = await context.Vault.CreateSecretManagerApplication(ApplicationName);#
```

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Add-KeeperSecretManagerApp <appName>`&#x20;

**Flags**:

* `-AppName`&#x20;

**Example:**

```powershell
PS> Add-KeeperSecretManagerApp DemoPowerShellCreateApp

UID                    Type Title                   Info
---                    ---- -----                   ----
ksm_app_uid            app  DemoPowerShellCreateApp 
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `secrets-manager-app --command='create' or 'add'`

**Parameters:**&#x20;

* `--command`  {list,get,add,create,remove,share,unshare}\
  One of: list, get, add, create, remove, share, unshare
* `--app,   -a` : Use to set name of the secrets manager app to be created

**Options**:

* `--force,  -f` : Use to forcefully add secrets manager app with same name

**Example:**

```sh
My Vault> secrets-manager-app --command='create' --app='My App'
Application successfully created added (UID: 0xXXxxX0x_xx0x0xXxXxXX)
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `create_secrets_manager_app`

```python
from keepersdk.vault import ksm_management

ksm_management.create_secrets_manager_app(vault=vault, name='App Name', force_add=True)
```

</details>

### Secrets Manager App View

Displays detailed information about a specific Secrets Manager Application using its UID/Name.

This command retrieves the application record from the vault and prints relevant metadata, including its UID, title, shared status, linked shared folders, and any associated records.

**Behaviour:**

* Fetches the Secrets Manager Application from the vault using the provided Name.
* Outputs a summary of the application’s details, similar to how they are stored in Keeper.
* Useful for auditing or reviewing configuration and access relationships.

<details>

<summary>DotNet CLI</summary>

**Command** : `ksm view <AppName>`

**Flags :**&#x20;

* `--folder` : Shared Folder UID or name. "share", "unshare" only
* `-e, --can-edit` : Can secret be edited? "share", "unshare" only
* `--client-name` : Client name. "add-client", "remove-client" only
* `--unlock-ip` : Unlock IP Address? "add-client" only
* `--create-expire` : Device creation expiration in minutes. "add-client" only
* `--access-expire` : Device access expiration in minutes. "add-client" only
* `--b64` : Return KSM configuration instead of one time token "add-client" only
* `--email` : User UID or email address. "app-share", "app-unshare" only
* `--is-admin` : Share as admin user. "app-share", "app-unshare" only
* `--help` : Display this help screen.
* `--version` : Display version information.
* `value pos. 0` : KSM command: "`view`", "`create`", "`delete`", "`share`", "`unshare`", "`add-client`", "`delete-client`", "`list`", "`app-share`", "`app-unshare`"
* `value pos. 1` : Secret Manager application UID or Title

**Example:**

```sh
My Vault> ksm view DemoApplication       
     Application UID: ksm_app_uid
               Title: DemoApplication

Shares
  #  Share Type    Share UID               Share Title         Editable  Created          
---  ------------  ----------------------  ------------------  --------  -----------------
  1  SharedFolder  share_uid               Demo Shared Folder  -         7/23/2025 9:07 AM

Devices
  #  Name         Device ID  Created            Last Accessed
---  -----------  ---------  -----------------  -------------
  1  Device name  XX2ABC     7/23/2025 9:06 AM      
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**  `TryGetKeeperRecord`&#x20;

**Example:**

```csharp
public bool TryGetKeeperRecord(string recordUid, out KeeperRecord application)
```

</details>

<details>

<summary> PowerCommander </summary>

**Command:** `Get-KeeperSecretManagerApp`&#x20;

**Aliases :** `ksm <uid>`&#x20;

**Flags** :&#x20;

* `Uid`&#x20;
* `Filter`&#x20;
* `Detail`&#x20;

**Example:**

```powershell
PS> ksm ksm_app_uid -Detail

Uid                    Title           IsExternalShare DeviceCount ShareCount
---                    -----           --------------- ----------- ----------
ksm_app_uid            DemoApplication False           1           1
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `secrets-manager-app --command='get'`&#x20;

**Parameters:**&#x20;

* `--command`  = get
* `--app, -a` : The UID or title of the secrets-manager-app to be fetched

**Example:**

```sh
My Vault> secrets-manager-app --command='get' --app='My App'

Secrets Manager Application
App Name: My App
App UID: abcd_1234_XXXX

Client Device 1
============================
Device Name: 0XxXX00Xx0x
Short ID: ABCD1234
Created on: 2025-01-01 00:00:00
Expires On: None
First Access: None
Last Access: None
IP Lock: False
IP Address: --

Share Type        UID                Title        Permissions
---------------   ----------------   ----------   --------------
Folder            abcd1234ABCD1234   App Folder   True
```

</details>

<details>

<summary>Python SDK</summary>

**Function:**  `get_secrets_manager_app`

```python
from keepersdk.vault import ksm_management


ksm_management.get_secrets_manager_app(vault: vault_online.VaultOnline, uid_or_name: str) -> ksm.SecretsManagerApp:
```

</details>

### Secrets Manager App Delete

This Command removes the application whose UID or name is given by user.

**Behaviour:**

* Fetches the secrets manager application based on name or uid provided
* Asks user confirmation (in power shell)
* Deletes the application with given UID

<details>

<summary>DotNet CLI</summary>

**Command:** `ksm delete <APP_UID>`

**Flags :**&#x20;

* `--folder` : Shared Folder UID or name. "share", "unshare" only
* `-e, --can-edit` : Can secret be edited? "share", "unshare" only
* `--client-name` : Client name. "add-client", "remove-client" only
* `--unlock-ip` : Unlock IP Address? "add-client" only
* `--create-expire` : Device creation expiration in minutes. "add-client" only
* `--access-expire` : Device access expiration in minutes. "add-client" only
* `--b64` : Return KSM configuration instead of one time token "add-client" only
* `--email` : User UID or email address. "app-share", "app-unshare" only
* `--is-admin` : Share as admin user. "app-share", "app-unshare" only
* `--help` : Display this help screen.
* `--version` : Display version information.
* `value pos. 0` : KSM command: "`view`", "`create`", "`delete`", "`share`", "`unshare`", "`add-client`", "`delete-client`", "`list`", "`app-share`", "`app-unshare`"
* `value pos. 1` : Secret Manager application UID or Title

**Example:**

```sh
My Vault> ksm delete ksm_app_uid
KSM Application DemoApplicationCreateTest has been deleted.
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function**: `DeleteSecretManagerApplication`&#x20;

**Example:**

```csharp
public async Task DeleteSecretManagerApplication(string applicationId)
```

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Remove-KeeperSecretManagerApp <APP_UID>`&#x20;

**alias**: `ksm-delete`&#x20;

**Example:**

```powershell
PS> ksm-delete ksm_app_uid

Confirm
Are you sure you want to perform this action?
Performing the operation "Delete" on target "Secrets Manager App UID: ksm_app_uid".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): Y
System.Threading.Tasks.VoidTaskResult
Secrets Manager Application with UID 'ksm_app_uid' has been deleted.
```

</details>

<details>

<summary>Python CLI</summary>

**Command:**  `secrets-manager-app --command='remove' --app='<app_uid_or_name>'` &#x20;

**Parameters**:

`--command`  remove

**Options**:

`--force`           Use force to delete secrets manager apps with clients

**Example:**

```sh
My Vault> secrets-manager-app --command='remove' --app='My App' --force
Application was successfully removed (UID: XX0XXXX000xx-XxxxXXxxX)
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `remove_secrets_manager_app`

```python
from keepersdk.vault import ksm_management
ksm_management.remove_secrets_manager_app(vault: vault_online.VaultOnline, uid_or_name: str, force: Optional[bool] = False):
```

</details>

### Secrets Manager App Share

This command shares the application with users mentioned. In case the user is not part of shareable pool ( By default, it will be your team/enterprise) then an invitation to share will be sent to the email mentioned and an email invitation for sharing will be sent.

**Behaviour:**

* Fetches the app details and its information related to shares
* checks if the user is already in shareable pool and if user has access to the app
* once the app is shareable, it will be shared with user else an email will be sent to user with invite.

<details>

<summary>DotNet CLI</summary>

**Command**: `ksm app-share APP_UID --email=USER_EMAIL --is-admin --can-edit --folder=<FOLDER_UID_FOR_SHARE_FOLDER>`

**Flags**

<table><thead><tr><th width="117.015625">Flag</th><th width="117.04681396484375">Usage</th><th>Description</th></tr></thead><tbody><tr><td>--can-edit</td><td>--can-edit</td><td>When this flag is used in command, this sets user can edit to true which will make the application which is shared to user be editable by user, else the application will be readonly</td></tr><tr><td>--folder</td><td>--folder=UID</td><td>When this flag is given, it has to be given in format of --<em><strong>folder=FOLDER_UID</strong></em> which will share just the subfolder to the user instead of all the things which this application has acces to</td></tr><tr><td>--is-admin</td><td>--is-admin</td><td>When this flag is given, , this gives the user an admin permission to the application and everything which is being shared with the user.</td></tr><tr><td>--email</td><td>--email=id</td><td>This is <strong>required</strong> field. it should be given in format of --email=EMAIL_ID and this will be the user email to which we will be sharing to.</td></tr></tbody></table>

**Example:**

```sh
My Vault> ksm app-share APP_UID --email=USER_EMAIL --is-admin --can-edit --folder=<FOLDER_UID_FOR_SHARE_FOLDER>
User <user> is not found in the list of users for sharing.
Share invitation request has been sent to user <user_email>. Please wait for the user to accept the request before sharing the application.
Application "DemoApplication" has been shared with user <USER_EMAIL>
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:** `ShareRecordWithUser`

**Flags:**

<table><thead><tr><th width="190.3958740234375">Function Parameter</th><th width="142.015625">Usage</th><th>Description</th></tr></thead><tbody><tr><td>recordUid</td><td>&#x3C;Record UID></td><td>This is UID of the application/record which needs to be shared</td></tr><tr><td>username</td><td>&#x3C;Email></td><td>This is Email or userid of the user with whom we are sharing the application</td></tr><tr><td>options.CanEdit</td><td>boolean</td><td>can edit the application data</td></tr><tr><td>options.CanShare</td><td>boolean</td><td>can share the application</td></tr><tr><td>userType</td><td>Enum</td><td>Type of the user - Enterprise or regular user</td></tr></tbody></table>

**Example:**

```csharp
public async Task ShareRecordWithUser(string recordUid, string username, IRecordShareOptions options)
```

```csharp
public async Task PutUserToSharedFolder(string sharedFolderUid,
            string userId,
            UserType userType,
            IUserShareOptions options)
```

**Note:**

* Sharing the application this way has to follow a process.
* when we are sharing an application with user, first we have to get all records to which this application has access to.
* once we get all records, we have to share them all with the user in question with required permissions using `RevokeShareFromUser` .
* once we get all the shared folders which the application has access to, then put the user into each shared folder using the `PutUserToSharedFolder` .
* finally once all the above steps are done, then share the application with the user with appropriate permissions using `ShareRecordWithUser` .
* Now Sharing of application is done.

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Grant-KeeperAppAccess -ApplicationId <APP_UID> -UserUid <USER_ID>`

**Flags:**

<table><thead><tr><th width="117.015625">Flag</th><th width="123.85406494140625">Usage</th><th>Description</th></tr></thead><tbody><tr><td>-IsAdmin</td><td>-IsAdmin</td><td>When this flag is given, , this gives the user an admin permission to the application and everything which is being shared with the user.</td></tr><tr><td>-UserUid</td><td>-UserUid &#x3C;id></td><td>This is <strong>required</strong> field. it should be given in format of -UserUid EMAIL_ID. This will be the user email to which we will be sharing to.</td></tr></tbody></table>

**Example:**

```powershell
PS> Grant-KeeperAppAccess -ApplicationId <APP_UID> -UserUid <USER_UID> -IsAdmin
Granting Secrets Manager application access to '<APP_UID>'...
Successfully granted access to application <APP_UID> for user '<USER_UID>'.
```

</details>

<details>

<summary>Python CLI</summary>

**Command**:  `secrets-manager-app --command='share'`

**Flags**:

* `--command` = share
* `-a, --app` : Name or UID of app to be share
* `-e, --email` : Email of user with whom the app is to be shared/unshared
* `--admin` : Admin permissions to share and edit the records present in the app

**Example:**

```sh
My Vault> secrets-manager-app --command='share' --email='abc@email.com' --app='My App'
Record <APP_UID> access permissions has been granted to user 'abc@email.com'
Share updates processed successfully
```

</details>

<details>

<summary>Python SDK</summary>

**Function:**&#x20;

```python

    success_responses, failed_responses = ksm_management.share_secrets_manager_app(
        vault=vault,
        enterprise=enterprise_data,
        app_uid=app_uid_or_name,
        emails=user_emails,
        action="grant",
        can_edit=can_edit,
        can_share=can_share,
    )

    # Note: SDK may return (None, None) due to list.extend() in return; treat as success.
    if success_responses:
        print(f"KSM app '{app_uid_or_name}': {action} succeeded for {len(success_responses)} user(s).")
    if failed_responses:
        for r in failed_responses:
            print(f"  Failed: {r}")
    if (not success_responses or success_responses is None) and (
        not failed_responses or failed_responses is None
    ):
        print(f"KSM app '{app_uid_or_name}': {action} completed for {len(user_emails)} user(s).")

```

</details>

### Secrets Manager App UnShare

This command removes the application shares with users mentioned. The user's access to the application along with folder and records under the application will be revoked.

**Behavior:**

* Fetches the app details and its information related to shares
* checks if user has access to the app
* If the user is not found the command exits stating the same.
* If app is shared with the user, then we remove access to the underlying records and folder which are present in app, then app access is revoked.

<details>

<summary>DotNet CLI</summary>

**Command**: `ksm app-unshare APP_UID --email=USER_EMAIL`

**Flags**

<table><thead><tr><th width="117.015625">Flag</th><th width="117.04681396484375">Usage</th><th>Description</th></tr></thead><tbody><tr><td>email</td><td>--email=id</td><td>This is <strong>required</strong> field. it should be given in format of --email=EMAIL_ID and this will be the user whose access is revoked with respect to application.</td></tr></tbody></table>

**Example:**

```sh
My Vault> ksm app-unshare ksm_app_uid --email=<user_email>                                                  
Application "DemoApplication" has been unshared from user <user_email>
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:** `ShareRecordWithUser`

**Flags:**

<table><thead><tr><th width="190.3958740234375">Function Parameter</th><th width="142.015625">Usage</th><th>Description</th></tr></thead><tbody><tr><td>recordUid</td><td>&#x3C;Record UID></td><td>This is UID of the application/record which needs to be revoked</td></tr><tr><td>username</td><td>&#x3C;Email></td><td>This is Email or userid of the user with whom we are revoking the application from</td></tr><tr><td>userType</td><td>Enum</td><td>Type of the user - Enterprise or regular user</td></tr></tbody></table>

**Example:**

```csharp
public async Task RevokeShareFromUser(string recordUid, string username)
```

```csharp
public async Task RemoveUserFromSharedFolder(string sharedFolderUid, string userId, UserType userType)
```

**Note:**

* revoking the application access has to follow this process
* when we are revoking an application from user, first we have to get all records to which this application has access to
* once we get all records, we have to revoke them all from the user in question with required permissions `RevokeShareFromUser`
* once we get all the shared folders which the application has access to, then remove the user from each shared folder using the `RemoveUserFromSharedFolder`
* finally once all the above steps are done, then revoke the application from user using `RevokeShareFromUser`
* Now revoking of application is done.

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Revoke-KeeperAppAccess -ApplicationId <APP_UID> -UserUid <USER_ID>`

**Flags:**

<table><thead><tr><th width="117.015625">Flag</th><th width="123.85406494140625">Usage</th><th>Description</th></tr></thead><tbody><tr><td>UserUid</td><td>-UserUid &#x3C;id></td><td>This is <strong>required</strong> field. it should be given in format of -UserUid EMAIL_ID. This will be the user email to which we will be sharing to.</td></tr></tbody></table>

**Example:**

```powershell
PS> Revoke-KeeperAppAccess -ApplicationId ksm_app_uid -UserUid <user_email>
Revoking Secrets Manager application access from '<user_email>'...
Successfully revoked access to application 'ksm_app_uid' from user '<user_email>'.
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `secrets-manager-app --command='unshare'`

**Parameters**:

`--command`            = unshare

`-a`        `--app`         Name or UID of app to be share

`-e`        `--email`     E-Mail of user with whom the app is to be shared/unshared

**Example:**

```sh
My Vault> secrets-manager-app --command='unshare' --email='abc@email.com' --app='My App'
Record <APP_UID> access permissions has been revoked from user 'abc@email.com'
Share updates processed successfully
```

</details>

<details>

<summary>Python SDK</summary>

**Function:**&#x20;

```python

    success_responses, failed_responses = ksm_management.share_secrets_manager_app(
        vault=vault,
        enterprise=enterprise_data,
        app_uid=app_uid_or_name,
        emails=user_emails,
        action="remove",
        can_edit=can_edit,
        can_share=can_share,
    )

    # Note: SDK may return (None, None) due to list.extend() in return; treat as success.
    if success_responses:
        print(f"KSM app '{app_uid_or_name}': {action} succeeded for {len(success_responses)} user(s).")
    if failed_responses:
        for r in failed_responses:
            print(f"  Failed: {r}")
    if (not success_responses or success_responses is None) and (
        not failed_responses or failed_responses is None
    ):
        print(f"KSM app '{app_uid_or_name}': {action} completed for {len(user_emails)} user(s).")

```

</details>