For the complete documentation index, see llms.txt. This page is also available as Markdown.

CyberArk PAM Import

Use the pam project cyberark-import command to migrate privileged accounts from CyberArk PVWA or Privilege Cloud into KeeperPAM. The command imports CyberArk accounts and safes as KeeperPAM resources

Prerequisites

  • Keeper Commander is installed and you are logged in.

  • Your Keeper account has permission to create and manage PAM projects.

  • You can connect to the CyberArk PVWA API endpoint.

  • You have CyberArk credentials with permission to read the safes and accounts you want to migrate.

The command prompts for CyberArk credentials when they are not provided through environment variables. For unattended runs, set the appropriate variables before starting Commander:

Variable
Purpose

KEEPER_CYBERARK_ID_TENANT

CyberArk Identity tenant for Privilege Cloud

KEEPER_CYBERARK_USERNAME

CyberArk username or service-account client ID

KEEPER_CYBERARK_PASSWORD

CyberArk password or service-account client secret

KEEPER_CYBERARK_LOGON_TYPE

Self-hosted logon type: CyberArk, LDAP, RADIUS, or Windows

KEEPER_CYBERARK_AUTH_METHOD

Privilege Cloud authentication method, when required

Command syntax

<PVWA_HOST> can be a self-hosted PVWA hostname, such as pvwa.example.com, or a Privilege Cloud tenant, such as mycompany.cyberark.cloud.

Quick start

Preview the import

Run a dry run before changing the vault. Credentials are omitted unless --include-credentials is explicitly supplied.

Review the available safes

Import the selected safes

If --name is omitted, the project name defaults to CyberArk Migration.

Import from Privilege Cloud

Common options

Option
Description

--name, -n

Name of the PAM project.

--config, -c

Extend an existing PAM project by PAM Configuration UID or title.

--gateway, -g

Gateway UID or name for a new project.

--folder-mode

Safe-folder layout: safe (default), ksm, exact, or flat.

--safes

Import only matching safes. Comma-separated names and globs are supported.

--exclude-safes

Exclude matching safes. Comma-separated names and globs are supported.

--list-safes

Display safes with account counts and exit.

--dry-run, -d

Preview the import without changing the vault.

--output, -o

Save the generated import JSON to a file.

--include-credentials

Include passwords in dry-run output or the saved JSON.

--yes, -y

Skip confirmation prompts.

--skip-users

Import resource records without importing pamUser records.

--skip-linked-accounts

Skip linked logon, reconcile, and enable accounts.

--skip-dependents

Skip CyberArk dependent-account service mappings.

--state-filter

Import only accounts with the specified CPM states.

--platform-map

Use a JSON file with custom CyberArk platform mappings.

--no-verify-ssl

Disable certificate verification for self-hosted PVWA. Use only when necessary.

--include-system-safes

Include CyberArk system safes, which are excluded by default.

--strict-policies

Stop the import when a platform rotation policy cannot be read.

Folder layout

The default safe mode creates a Keeper shared folder for each CyberArk safe. This preserves the safe's member permissions and makes it easier to maintain access control after migration.

The imported project contains:

  • PAM machine and database resources.

  • PAM users linked to their resources.

  • Login records for supported website accounts.

  • Safe-member permissions mapped to Keeper permissions.

  • Rotation and connection settings from CyberArk policies.

  • Linked logon and reconcile accounts, when available.

Use --folder-mode exact to preserve the safe hierarchy under the project folders, or --folder-mode flat to place records in the legacy shared-folder layout.

Save the import JSON

To review or archive the generated payload without importing it:

Passwords are redacted by default. Add --include-credentials only when the output file is protected and the credentials are required.

Remove an imported project

Preview the cleanup first:

Remove the project by name or PAM Configuration UID:

Cleanup removes the imported project records and folders, and the gateway and Secrets Manager application associated with the project when they were created by the import.

Troubleshooting

Message or symptom
What to check

Authentication failed

Confirm the tenant or PVWA hostname and CyberArk credentials. For self-hosted installations, verify KEEPER_CYBERARK_LOGON_TYPE.

No safes or accounts found

Confirm that the CyberArk account can read the target safes and review the output of --list-safes.

SSL certificate error

Install the issuing CA certificate or use --no-verify-ssl only for a trusted internal test environment.

Import is too large or slow

Use --safes, --exclude-safes, --batch-size, and --batch-delay to control the import.

Rotation settings are missing

Check that the CyberArk platform policy is available to the importing account. Use --strict-policies to fail instead of applying the master-policy default.

For command details available in your installed version, run:

Last updated