> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-cli/command-reference/import-and-export-commands/cyberark-pam-import.md).

# CyberArk PAM Import

Use the pam project cyberark-import command to migrate privileged accounts from CyberArk PVWA or Privilege Cloud into KeeperPAM.  The command imports CyberArk accounts and safes as KeeperPAM resources

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FVx3vcawaXEus29CaFi0G%2FImport-Keeper-Cyberark.jpg?alt=media&amp;token=5feb06a1-909a-4200-bad0-80848f2b5841" alt=""><figcaption></figcaption></figure>

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* Keeper Commander is installed and you are logged in.
* Your Keeper account has permission to create and manage PAM projects.
* You can connect to the CyberArk PVWA API endpoint.
* You have CyberArk credentials with permission to read the safes and accounts you want to migrate.

The command prompts for CyberArk credentials when they are not provided through environment variables. For unattended runs, set the appropriate variables before starting Commander:

| Variable                      | Purpose                                                            |
| ----------------------------- | ------------------------------------------------------------------ |
| `KEEPER_CYBERARK_ID_TENANT`   | CyberArk Identity tenant for Privilege Cloud                       |
| `KEEPER_CYBERARK_USERNAME`    | CyberArk username or service-account client ID                     |
| `KEEPER_CYBERARK_PASSWORD`    | CyberArk password or service-account client secret                 |
| `KEEPER_CYBERARK_LOGON_TYPE`  | Self-hosted logon type: `CyberArk`, `LDAP`, `RADIUS`, or `Windows` |
| `KEEPER_CYBERARK_AUTH_METHOD` | Privilege Cloud authentication method, when required               |

### Command syntax <a href="#command-syntax" id="command-syntax"></a>

```
pam project cyberark-import <PVWA_HOST> [OPTIONS]
```

`<PVWA_HOST>` can be a self-hosted PVWA hostname, such as `pvwa.example.com`, or a Privilege Cloud tenant, such as `mycompany.cyberark.cloud`.

### Quick start <a href="#quick-start" id="quick-start"></a>

#### Preview the import <a href="#preview-the-import" id="preview-the-import"></a>

Run a dry run before changing the vault. Credentials are omitted unless `--include-credentials` is explicitly supplied.

```bash
pam project cyberark-import pvwa.example.com --dry-run
```

#### Review the available safes <a href="#review-the-available-safes" id="review-the-available-safes"></a>

```bash
pam project cyberark-import pvwa.example.com --list-safes
```

#### Nested Share Folder Support <a href="#import-the-selected-safes" id="import-the-selected-safes"></a>

```bash
pam project cyberark-import pvwa.example.com --nsf
```

#### Import the selected safes <a href="#import-the-selected-safes" id="import-the-selected-safes"></a>

```bash
pam project cyberark-import pvwa.example.com \
  --name "CyberArk Production" \
  --gateway "Production Gateway" \
  --safes "Production,Shared*"
```

If `--name` is omitted, the project name defaults to `CyberArk Migration`.

#### Import from Privilege Cloud <a href="#import-from-privilege-cloud" id="import-from-privilege-cloud"></a>

```bash
pam project cyberark-import mycompany.cyberark.cloud \
  --name "CyberArk Cloud Migration" \
  --dry-run
```

### Common options <a href="#common-options" id="common-options"></a>

| Option                   | Description                                                                                                                                     |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| `--name`, `-n`           | Name of the PAM project.                                                                                                                        |
| `--config`, `-c`         | Extend an existing PAM project by PAM Configuration UID or title.                                                                               |
| `--gateway`, `-g`        | Gateway UID or name for a new project.                                                                                                          |
| `--folder-mode`          | Safe-folder layout: `safe` (default), `ksm`, `exact`, or `flat`.                                                                                |
| `--safes`                | Import only matching safes. Comma-separated names and globs are supported.                                                                      |
| `--exclude-safes`        | Exclude matching safes. Comma-separated names and globs are supported.                                                                          |
| `--list-safes`           | Display safes with account counts and exit.                                                                                                     |
| `--dry-run`, `-d`        | Preview the import without changing the vault.                                                                                                  |
| `--output`, `-o`         | Save the generated import JSON to a file.                                                                                                       |
| `--include-credentials`  | Include passwords in dry-run output or the saved JSON.                                                                                          |
| `--yes`, `-y`            | Skip confirmation prompts.                                                                                                                      |
| `--skip-users`           | Import resource records without importing `pamUser` records.                                                                                    |
| `--skip-linked-accounts` | Skip linked logon, reconcile, and enable accounts.                                                                                              |
| `--skip-dependents`      | Skip CyberArk dependent-account service mappings.                                                                                               |
| `--state-filter`         | Import only accounts with the specified CPM states.                                                                                             |
| `--platform-map`         | Use a JSON file with custom CyberArk platform mappings.                                                                                         |
| `--no-verify-ssl`        | Disable certificate verification for self-hosted PVWA. Use only when necessary.                                                                 |
| `--include-system-safes` | Include CyberArk system safes, which are excluded by default.                                                                                   |
| `--strict-policies`      | Stop the import when a platform rotation policy cannot be read.                                                                                 |
| `--nsf`                  | Build the project (resources, users, rotation settings and PAM Configuration record) in Nested Share Folders instead of classic shared folders. |

### Folder layout <a href="#folder-layout" id="folder-layout"></a>

The default `safe` mode creates a Keeper shared folder for each CyberArk safe. This preserves the safe's member permissions and makes it easier to maintain access control after migration.

The imported project contains:

* PAM machine and database resources.
* PAM users linked to their resources.
* Login records for supported website accounts.
* Safe-member permissions mapped to Keeper permissions.
* Rotation and connection settings from CyberArk policies.
* Linked logon and reconcile accounts, when available.

Use `--folder-mode exact` to preserve the safe hierarchy under the project folders, or `--folder-mode flat` to place records in the legacy shared-folder layout.

### Save the import JSON <a href="#save-the-import-json" id="save-the-import-json"></a>

To review or archive the generated payload without importing it:

```bash
pam project cyberark-import pvwa.example.com \
  --dry-run \
  --output /tmp/cyberark-import.json
```

Passwords are redacted by default. Add `--include-credentials` only when the output file is protected and the credentials are required.

### Remove an imported project <a href="#remove-an-imported-project" id="remove-an-imported-project"></a>

Preview the cleanup first:

```bash
pam project cyberark-cleanup --name "CyberArk Production" --dry-run
```

Remove the project by name or PAM Configuration UID:

```bash
pam project cyberark-cleanup --name "CyberArk Production" --yes
pam project cyberark-cleanup --config <PAM_CONFIG_UID> --yes
```

Cleanup removes the imported project records and folders, and the gateway and Secrets Manager application associated with the project when they were created by the import.

### Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

| Message or symptom            | What to check                                                                                                                                                 |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authentication failed         | Confirm the tenant or PVWA hostname and CyberArk credentials. For self-hosted installations, verify `KEEPER_CYBERARK_LOGON_TYPE`.                             |
| No safes or accounts found    | Confirm that the CyberArk account can read the target safes and review the output of `--list-safes`.                                                          |
| SSL certificate error         | Install the issuing CA certificate or use `--no-verify-ssl` only for a trusted internal test environment.                                                     |
| Rotation settings are missing | Check that the CyberArk platform policy is available to the importing account. Use `--strict-policies` to fail instead of applying the master-policy default. |

For command details available in your installed version, run:

```
help pam project cyberark-import
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.keeper.io/keeperpam/commander-cli/command-reference/import-and-export-commands/cyberark-pam-import.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.