Shared Folder - Without sync-down

This page details the process to share a shared folder without needing to sync down the vault first.

Overview

This flow is appropriate when the app does not sync Keeper vault data into a local SDK instance (sync_down / VaultOnline) and instead uses authenticated API calls directly after login.

Use this path when you need to read shared folder metadata, invite or update a user, remove a user, work with teams, or load record payloads by UID as soon as IAuthentication is available.

For a full synced vault, shared-folder modeling as in VaultOnline, and the broadest integration surface, prefer IVaultSharedFolder / VaultOnline instead.

DotNet SDK

Structures and classes

Type	Purpose
ISharedFolderSkipSyncDown	Interface for dependency injection and testing.
SharedFolderSkipSyncDown	Static entry points (GetSharedFolderAsync, PutUserToSharedFolderAsync, RemoveUserFromSharedFolderAsync).
SharedFolderSkipSyncDown.SharedFolderSkipSyncDownClient	Default implementation of ISharedFolderSkipSyncDown.

Use this path when your app needs to read shared folder metadata, invite or update a user, or remove a user from a shared folder as soon as authentication with keeper is completed.

For full vault integration (synced tree, teams, etc.), use IVaultSharedFolder / VaultOnline instead.

Scope and limitations

• Shared folder skip-sync targets apps that do not run a full sync_down / VaultOnline tree. It supports selected shared-folder and record operations right after authentication.

• Users: Add, update, or remove individual users (email), as in the previous release.

• Teams: You can add or remove a team from a shared folder and list teams available for sharing, without loading the vault.

• Records: You can list record UIDs linked to a shared folder and fetch and decrypt records without syncing the vault.

Supported Functions

Shared folder — supported functions

GetSharedFolderAsync

Loads one shared folder by UID. The request includes shared folders while returning shared folder along with user flows, team flows, and record UID listing.

public static async Task<GetSharedFoldersResponse> GetSharedFolderAsync(
    IAuthentication auth,
    string sharedFolderUid)

Returns null if the session cannot access the folder or the response has no shared folder entries.

GetRecordUidsFromSharedFolderAsync

Returns distinct record UIDs attached to the folder. Empty if the folder is unavailable or has no records.

public static async Task<IReadOnlyList<string>> GetRecordUidsFromSharedFolderAsync(
    IAuthentication auth,
    string sharedFolderUid)

PutUserToSharedFolderAsync / RemoveUserFromSharedFolderAsync

Add or Update a user, or Remove a user. Optional IUserShareOptions (e.g. SharedFolderUserOptions) controls permissions and expiration.

public static async Task PutUserToSharedFolderAsync(
    IAuthentication auth,
    string sharedFolderUid,
    string userId,
    IUserShareOptions options = null)

public static async Task RemoveUserFromSharedFolderAsync(
    IAuthentication auth,
    string sharedFolderUid,
    string userId)
    
// options can be something like this
var options = new SharedFolderUserOptions
                {
                    ManageRecords = true,
                    ManageUsers = true,
                    Expiration = DateTimeOffset.Now.AddMinutes(10)
                };

GetAvailableTeamsForShareAsync

Returns teams the current user may share with, using the same approach - without loading the vault.

public static async Task<IEnumerable<TeamInfo>> GetAvailableTeamsForShareAsync(
    IAuthentication auth)

GetTeamUidFromNameAsync

Resolves a team display name to a team UID when the name is unique. Returns null if none match; throws if multiple teams match (use an explicit Team Name).

public static async Task<string> GetTeamUidFromNameAsync(
    IAuthentication auth,
    string teamName)

PutTeamToSharedFolderAsync / RemoveTeamFromSharedFolderAsync

Add or update a team to the shared folder, or remove it. Pass a team UID or, when it uniquely identifies a team, a display name. GetTeamUidFromNameAsync helps when you need an explicit UID. Optional IUserShareOptions applies where supported.

public static async Task PutTeamToSharedFolderAsync(
    IAuthentication auth,
    string sharedFolderUid,
    string teamUid,
    IUserShareOptions options = null)

public static async Task RemoveTeamFromSharedFolderAsync(
    IAuthentication auth,
    string sharedFolderUid,
    string teamUid)

GetRecordKeysFromSharedFolderAsync(auth, sharedFolderUid)

Loads decrypted record keys for every record linked to that shared folder.

record UID → record key. Empty if the folder cannot be read or no keys are available.

public Task<IReadOnlyDictionary<string, byte[]>> GetRecordKeysFromSharedFolderAsync(IAuthentication auth,string sharedFolderUid)

Record payloads without vault sync — RecordSkipSyncDown

Use when you already have record UIDs (for example from GetRecordUidsFromSharedFolderAsync) and want decrypted KeeperRecord instances without a full vault sync.

GetRecordsAsync

Retrieves record data of the given record uids.

public static async Task<RecordDetailsSkipSyncResult> GetRecordsAsync(
    IAuthentication auth,
    IEnumerable<string> recordUids,
    RecordDetailsInclude include = RecordDetailsInclude.DataPlusShare)

RecordDetailsInclude matches the API (default DATA_PLUS_SHARE). Use DataOnly or ShareOnly for a narrower payload.

RecordDetailsSkipSyncResult:

Member	Meaning
Records	Successfully decrypted records
NoPermissionRecordUids	From noPermissionRecordUid
FailedRecordUids	Rows returned but decrypt/load failed (e.g. unsupported recordKeyType)
InvalidRecordUids	Caller strings that could not be decoded to binary record UIDs and were not sent

GetOwnedRecordsAsync(auth, recordUids, include?)

Fetches record details for the given UIDs and decrypts each record using the key supplied with that record in the response.

RecordDetailsSkipSyncResult — decrypted records plus lists of UIDs with no permission, failed decrypt/load, or invalid UID strings.

public static Task<RecordDetailsSkipSyncResult> GetOwnedRecordsAsync(IAuthentication auth,

Typical pattern when UIDs come from a shared folder listing:

var recordUids = await SharedFolderSkipSyncDown.GetRecordUidsFromSharedFolderAsync(auth, sharedFolderUid);
var details = await RecordSkipSyncDown.GetOwnedRecordsAsync(auth, recordUids);

GetSharedFolderRecordsAsync(auth, sharedFolderUid, include?)

Resolves keys from the shared folder, then loads and decrypts all records attached to that folder.

Same RecordDetailsSkipSyncResult as above.

var details = await RecordSkipSyncDown.GetSharedFolderRecordsAsync(auth, sharedFolderUid);

GetRecordsAsync (obsolete)

Does: Same as GetOwnedRecordsAsync.

Result: Same as GetOwnedRecordsAsync.

Usage: Prefer GetOwnedRecordsAsync or GetSharedFolderRecordsAsync explicitly.

RecordDetailsSkipSyncResult

Property	What you get
Records	Decrypted KeeperRecord instances that succeeded.
NoPermissionRecordUids	UIDs the server reported as no permission.
FailedRecordUids	UIDs that were returned but could not be decrypted or loaded.
InvalidRecordUids	UIDs you passed in that were not valid record UID strings.

---

Sample helpers (Sample/ShareFolderSkipSyncExample)

Function	Does	Typical call
ListSharedFolderRecordsAsync	Prints titles for records decrypted via GetSharedFolderRecordsAsync.	await ListSharedFolderRecordsAsync(auth, sharedFolderUid);
ListSharedFolderRecordsOwnedAsync	Prints titles for records decrypted via UIDs from the folder + GetOwnedRecordsAsync.	await ListSharedFolderRecordsOwnedAsync(auth, sharedFolderUid);
PutUserToSharedFolder / RemoveUserFromSharedFolder	Adds or removes a user, then prints folder records (shared-folder decrypt path).	After share changes, see console output.
PutTeamToSharedFolder / RemoveTeamFromSharedFolder	Adds or removes a team, then prints folder records (shared-folder decrypt path).	Same.

Prerequisites

Valid IAuthentication after login ( vault.Auth from VaultOnline or AuthenticateAndGetVault.GetAuthAsync from examples below or any object that implements IAuthentication interface)

Sample: authenticate, folder metadata, user share (prior release style)

using System;
using System.Threading.Tasks;
using KeeperSecurity.Authentication;
using KeeperSecurity.Vault;
using Sample;

// 1) Auth only (no full vault sync)
var auth = await AuthenticateAndGetVault.GetAuthAsync(enablePersistentLogin: null);
if (auth == null)
{
    Console.WriteLine("Could not authenticate.");
    return;
}

var sharedFolderUid = "<your_shared_folder_uid>";
var userEmail = "[email protected]";

// 2) Load shared folder metadata (get_shared_folders)
var folder = await SharedFolderSkipSyncDown.GetSharedFolderAsync(auth, sharedFolderUid);
if (folder == null || folder.SharedFolders == null || folder.SharedFolders.Length == 0)
{
    Console.WriteLine("Could not load shared folder (check UID and access).");
    return;
}

var sf = folder.SharedFolders[0];
Console.WriteLine($"Folder UID: {sf.SharedFolderUid}, revision: {sf.Revision}");

var options = new SharedFolderUserOptions
{
    ManageRecords = true,
    ManageUsers = true,
    Expiration = DateTimeOffset.UtcNow.AddDays(7)
};

try
{
    await SharedFolderSkipSyncDown.PutUserToSharedFolderAsync(auth, sharedFolderUid, userEmail, options);
    Console.WriteLine("Shared folder updated.");
}
catch (Exception ex)
{
    Console.WriteLine($"Error: {ex.Message}");
}

// await SharedFolderSkipSyncDown.RemoveUserFromSharedFolderAsync(auth, sharedFolderUid, userEmail);

---

Sample: teams, record UIDs, and decrypt records (no full vault sync)

using System;
using System.Linq;
using System.Threading.Tasks;
using KeeperSecurity.Authentication;
using KeeperSecurity.Vault;
using Records;
using Sample;

var auth = await AuthenticateAndGetVault.GetAuthAsync(enablePersistentLogin: null);
if (auth == null)
{
    Console.WriteLine("Could not authenticate.");
    return;
}

var sharedFolderUid = "<your_shared_folder_uid>";
var teamUid = "<your_team_uid_base64url>";

var teams = await SharedFolderSkipSyncDown.GetAvailableTeamsForShareAsync(auth);
foreach (var t in teams)
    Console.WriteLine($"{t.Name}: {t.TeamUid}");

await SharedFolderSkipSyncDown.PutTeamToSharedFolderAsync(
    auth, sharedFolderUid, teamUid,
    new SharedFolderUserOptions { ManageRecords = true, ManageUsers = false });

var recordUids = await SharedFolderSkipSyncDown.GetRecordUidsFromSharedFolderAsync(auth, sharedFolderUid);
Console.WriteLine($"Records: {recordUids.Count}");

var details = await RecordSkipSyncDown.GetRecordsAsync(auth, recordUids);
foreach (var r in details.Records)
    Console.WriteLine($"{r.Uid}: {r.Title}");

if (details.NoPermissionRecordUids.Any())
    Console.WriteLine("No permission: " + string.Join(", ", details.NoPermissionRecordUids));
if (details.FailedRecordUids.Any())
    Console.WriteLine("Failed: " + string.Join(", ", details.FailedRecordUids));

// await SharedFolderSkipSyncDown.RemoveTeamFromSharedFolderAsync(auth, sharedFolderUid, teamUid);