# Keeper Drive Commands ### Commands With the introduction of **Nested Share Subfolders with Role-Based Folder Permissions**, we’ve rebuilt the vault’s folder, sharing and permissions model from the ground up, delivering a more flexible and scalable experience for every user and team. During this transition, the new Nested Share Subfolder system will exist alongside the existing Classic folder system and permission model, with two distinct folder icons to help users easily differentiate between them. Keeper Drive (aka Nested Share Subfolders) is built on the Keeper v3 API. The commands listed below operate exclusively on Keeper Drive folders and records and are namespaces with the `kd-` prefix to keep them clearly separated from the classic vault commands. Whether using the interactive shell, CLI or JSON config file, Keeper supports the following Keeper Drive commands. Each command supports additional parameters and options. To get help on a particular command, run: `help `
CommandDescription
kd-listList Keeper Drive folders and records
kd-getShow the details of a Keeper Drive record or folder
kd-record-detailsShow metadata (title, type, version, revision) for one or more records
kd-mkdirCreate a Keeper Drive folder
kd-rndirRename or recolor a Keeper Drive folder
kd-rmdirRemove a Keeper Drive folder and its entire contents
kd-record-addCreate a Keeper Drive record
kd-record-updateUpdate an existing Keeper Drive record
kd-rmRemove (trash, permanently delete, or unlink) a Keeper Drive record
kd-lnLink a record into a Keeper Drive folder
kd-shortcutList or manage Keeper Drive record shortcuts (records in 2+ folders)
kd-share-folderGrant or revoke folder sharing
kd-share-recordGrant, update, revoke, or transfer ownership of a record share
kd-record-permissionBulk-update record sharing permissions for every record inside a folder
kd-transfer-recordTransfer record ownership to another user
*** ### kd-list command **Command:** `kd-list` **Detail:** List Keeper Drive folders and records cached locally. By default, both folders and records are shown. Use the `--folders` or `--records` flag to filter, and `--format` to control the output style. **Switches:** `--folders` show only folders `--records` show only records `--format <{table, csv, json}>` choose the format of the output * `table` — show the result in **table** format (default) * `csv` — show the result in **CSV** format * `json` — show the result in **JSON** format `--output ` path to the resulting output file (ignored for `table` format) **Examples:** ``` kd-list kd-list --folders kd-list --records --format json kd-list --format csv --output drive.csv ``` 1. List every Keeper Drive folder and record 2. List only Keeper Drive folders 3. Show all Keeper Drive records in JSON format 4. Export the full Keeper Drive listing to a CSV file *** ### kd-get command **Command:** `kd-get` **Detail:** Show the details of a Keeper Drive record or folder by UID or title. The command first attempts to resolve the input as a folder and falls back to record resolution. For records it prints field values and per-user permissions; for folders it prints user/team permissions and any share administrators. **Parameters:** UID or title of a Keeper Drive record or folder **Switches:** `--format <{detail, json}>` choose the format of the output * `detail` — human-readable report (default) * `json` — machine-readable JSON `-v`, `--verbose` show the full permission breakdown for each accessor (per-flag) `--unmask` reveal masked field values (passwords, secrets, PINs). Output is sent to **stdout only** and is never written to log files. **Examples:** ``` kd-get rvwIBG_ban2VTH64OsnzLn kd-get "My Drive Folder" kd-get rvwIBG_ban2VTH64OsnzLn --format json kd-get rvwIBG_ban2VTH64OsnzLn --unmask kd-get rvwIBG_ban2VTH64OsnzLn -v ``` 1. Show the details of a Keeper Drive object (record or folder) by UID 2. Show the details of a Keeper Drive folder by name 3. Show the details of a record in JSON format 4. Show the record details with masked fields revealed in plain text 5. Show the record details with the full per-flag permission breakdown `--unmask` displays sensitive data (passwords, secrets) on the terminal. Make sure you are in a safe environment before using this flag. *** ### kd-record-details command **Command:** `kd-record-details` **Detail:** Retrieve metadata (title, type, version, revision) for one or more Keeper Drive records using the v3 API. Useful for quickly inspecting record attributes without dumping field values. **Parameters:** One or more record UIDs (or titles, which are resolved to UIDs) **Switches:** `--format <{table, json}>` choose the format of the output * `table` — human-readable text (default) * `json` — JSON output **Examples:** ``` kd-record-details rvwIBG_ban2VTH64OsnzLn kd-record-details rvwIBG_ban2VTH64OsnzLn AbCDef0123456789hIJklM kd-record-details rvwIBG_ban2VTH64OsnzLn --format json ``` 1. Show metadata for a single record 2. Show metadata for multiple records in one call 3. Output record metadata as JSON *** ### kd-mkdir command **Command:** `kd-mkdir` **Detail:** Create a new Keeper Drive folder using the v3 API. The folder is created as a child of the *current* folder when the user is `cd`-ed into a Keeper Drive folder; otherwise it is created at the Keeper Drive root. **Parameters:** Folder name (use `//` to embed a literal `/` in the name; nested paths are not supported — `kd-mkdir` creates exactly one folder per call). **Switches:** `--color <{none, red, orange, yellow, green, blue, gray}>` set the folder colour `--no-inherit` do not inherit parent folder permissions (the new folder will start with no shares) **Examples:** ``` kd-mkdir Engineering kd-mkdir "Q1 Reports" --color blue kd-mkdir Confidential --no-inherit kd-mkdir "Side//Project" ``` 1. Create a folder named "Engineering" under the current location 2. Create a blue-coloured folder named "Q1 Reports" 3. Create a folder that does not inherit parent folder permissions 4. Create a folder whose literal name contains a forward slash: `Side/Project` If a folder with the same name already exists in the same parent location, `kd-mkdir` will not create a duplicate; it logs a warning and returns the existing folder UID. *** ### kd-rndir command **Command:** `kd-rndir` **Detail:** Rename a Keeper Drive folder, change its colour, or update its parent-permission inheritance setting. At least one of `--name`, `--color`, `--inherit`, or `--no-inherit` must be supplied. **Parameters:** Path or UID of an existing Keeper Drive folder **Switches:** `-n`, `--name ` new folder name `--color <{none, red, orange, yellow, green, blue, gray}>` set/change folder color `-q`, `--quiet` suppress the post-rename confirmation message **Examples:** ``` kd-rndir Engineering --name "Engineering Team" kd-rndir zXuYXRYWgsie5TBPzQACLw --color red kd-rndir "Old Folder" --name "New Folder" --color green ``` 1. Rename a folder 2. Change a folder's colour by UID 3. Rename and recolour a folder in a single call *** ### kd-rmdir command **Command:** `kd-rmdir` **Detail:** Remove one or more Keeper Drive folders and their entire contents. The command always runs a preview first (showing the impact: sub-folders, records, affected users and teams) before asking for confirmation. Up to **100 folders** may be removed per invocation. **Parameters:** One or more folder UID(s) or name(s) **Switches:** `--operation`, `-o <{folder-trash, delete-permanent}>` removal operation (default: `folder-trash`) * `folder-trash` — recoverable; folders go to the trash * `delete-permanent` — **IRREVERSIBLE**; folders and their contents are permanently destroyed `--force`, `-f` skip the confirmation prompt and execute immediately after the preview `--dry-run` run the preview step only; do not delete anything (mutually exclusive with `--force`) `--quiet`, `-q` suppress per-folder detail; only show the summary **Examples:** ``` kd-rmdir Engineering kd-rmdir zXuYXRYWgsie5TBPzQACLw -f kd-rmdir folder1 folder2 folder3 kd-rmdir Confidential --operation delete-permanent kd-rmdir Engineering --dry-run ``` 1. Move the "Engineering" folder to the trash (with confirmation) 2. Trash a folder by UID without prompting 3. Trash multiple folders in a single call 4. Permanently delete a folder and all its contents (IRREVERSIBLE) 5. Preview the impact of removing a folder without actually deleting it `--operation delete-permanent` cannot be undone. All sub-folders and records inside the targeted folder(s) will be permanently destroyed. *** ### kd-record-add command **Command:** `kd-record-add` **Detail:** Create a new Keeper Drive record. Mirrors the "classic" `record-add` command and supports all standard record types, custom record types, standard fields, and custom fields. Use `--syntax-help` for detailed examples of field specifications. **Parameters:** A space-separated list of field values using the standard field syntax: `=`. See `--syntax-help` for full details. **Switches:** `-t`, `--title ` record title (**required**) `-rt`, `--record-type <TYPE>` record type (**required**); see the list of standard record types `-n`, `--notes <NOTES>` record notes `--folder <FOLDER>` folder name or UID to store the new record in (omit to place at the Keeper Drive root) `-f`, `--force` ignore warnings (e.g. unsupported attachment fields) and create the record anyway `--syntax-help` display detailed information on field syntax and exit **Examples:** ``` kd-record-add --title "Sample Login" --record-type login --folder Engineering login=alice@example.com password=$GEN url=https://www.google.com kd-record-add -t "Empty Classic Record" -rt legacy kd-record-add --syntax-help ``` 1. Create a login record in the "Engineering" folder with a generated password 2. Create an empty "classic" record at the Keeper Drive root 3. Show the field-syntax help and exit File attachments are not yet supported in `kd-record-add`. Use the classic `record-add` command if you need to attach files. *** ### kd-record-update command **Command:** `kd-record-update` **Detail:** Update an existing Keeper Drive record. Title, notes, record type, and individual fields can all be modified. Multiple records can be updated in a single invocation by supplying `-r` more than once. **Parameters:** A space-separated list of field values using the standard field syntax: `<FIELD_NAME>=<FIELD_VALUE>`. **Switches:** `-r`, `--record <RECORD>` record path or UID to update (**required**, repeatable) `-t`, `--title <TITLE>` modify the record title `-rt`, `--record-type <TYPE>` change the record type `-n`, `--notes <NOTES>` append/modify the record notes `-f`, `--force` ignore warnings `--syntax-help` display detailed information on field syntax and exit **Examples:** ``` kd-record-update -r rvwIBG_ban2VTH64OsnzLn --title "Updated Title" kd-record-update -r rvwIBG_ban2VTH64OsnzLn password=$GEN kd-record-update -r rec1 -r rec2 --notes "Reviewed during Q1 audit" kd-record-update --syntax-help ``` 1. Rename a record 2. Replace the password on a record (regenerate using `$GEN`) 3. Update notes on multiple records in one call 4. Show the field-syntax help *** ### kd-rm command **Command:** `kd-rm` **Detail:** Remove one or more Keeper Drive records. Always runs a preview first (showing the impact: folders, additional locations, affected users/teams) and asks for confirmation. Up to **500 records** may be removed per invocation. Three removal operations are supported. **Parameters:** One or more record UID(s) or title(s) **Switches:** `--folder <FOLDER>` folder UID or name that provides the context for the removal (required when `--operation unlink` is used) `--operation`, `-o <{owner-trash, folder-trash, unlink}>` removal operation (default: `owner-trash`) * `owner-trash` — only the owner deletes the record; it lands in the owner's trash * `folder-trash` — remove the record from the supplied folder context and trash it * `unlink` — remove the record from a specific folder only; the record itself remains in other folders (requires `--folder`) `--force`, `-f` skip the confirmation prompt and execute immediately after the preview `--dry-run` run the preview only (mutually exclusive with `--force`) **Examples:** ``` kd-rm rvwIBG_ban2VTH64OsnzLn kd-rm "Old Login" -f kd-rm rec1 rec2 rec3 kd-rm rvwIBG_ban2VTH64OsnzLn --folder Engineering --operation unlink kd-rm rvwIBG_ban2VTH64OsnzLn --dry-run ``` 1. Move the record to the owner's trash (with confirmation) 2. Force-delete a record by title without prompting 3. Remove multiple records in one call 4. Unlink a record from the "Engineering" folder while leaving it in any other folders it appears in 5. Preview a removal without actually deleting *** ### kd-ln command **Command:** `kd-ln` **Detail:** Link an existing Keeper Drive record into a Keeper Drive folder. The record will appear in both its original folder(s) and the destination folder (similar to a hard-link). **Parameters:** Two positional arguments: `RECORD FOLDER` * `RECORD` — record UID, title, or path * `FOLDER` — destination folder UID or name **Examples:** ``` kd-ln rvwIBG_ban2VTH64OsnzLn Engineering kd-ln "Twitter" Marketing kd-ln rvwIBG_ban2VTH64OsnzLn / ``` 1. Link a record (by UID) into the "Engineering" folder 2. Link a record (by title) into the "Marketing" folder 3. Link a record into the Keeper Drive root *** ### kd-shortcut command **Command:** `kd-shortcut <subcommand>` **Detail:** List or manage Keeper Drive record shortcuts. A "shortcut" exists when the same record is linked into more than one folder. **Sub-commands:** * `list <RECORD UID, FOLDER UID, or PATH>` — show records that appear in 2+ folders, optionally filtered by record or folder * `keep <RECORD> <FOLDER>` — keep the record in exactly one folder; remove all other shortcuts **`kd-shortcut list`** **Switches:** `--format <{table, csv, json}>` choose the format of the output (default: `table`) `--output <FILENAME>` file to write output results to **Examples:** ``` kd-shortcut list kd-shortcut list --format csv --output shortcuts.csv kd-shortcut list rvwIBG_ban2VTH64OsnzLn kd-shortcut list Engineering ``` 1. Display every record that appears in more than one folder 2. Export the shortcut list to a CSV file 3. Show only the shortcuts for a specific record (by UID) 4. Show only the shortcut records that exist in the "Engineering" folder **`kd-shortcut keep`** **Switches:** `-f`, `--force` do not prompt before removing the extra shortcuts **Examples:** ``` kd-shortcut keep rvwIBG_ban2VTH64OsnzLn Engineering kd-shortcut keep "API Key" Production -f kd-shortcut keep rvwIBG_ban2VTH64OsnzLn ``` 1. Keep "API Key" only in the "Engineering" folder; remove it from all other folders (with confirmation) 2. Keep a record only in the "Production" folder without prompting 3. Keep a record only in the **current** folder (when no folder is specified, the current folder is used; you must be `cd`-ed into a Keeper Drive folder) {% hint style="info" %} `kd-shortcut keep` only removes the *links* — the record itself is preserved in the folder you choose to keep it in. {% endhint %} *** ### kd-share-folder command **Command:** `kd-share-folder` **Detail:** Grant or revoke sharing on one or more Keeper Drive folders. Supports user emails, team names/UIDs, and the special `@existing` recipient that expands to all users *and* teams currently on the folder (excluding the caller). **Parameters:** One or more folder paths or UIDs (positional, repeatable) **Switches:** `-a`, `--action <{grant, remove}>` share-folder action (default: `grant`). `grant` also updates existing shares. `-e`, `--email <USER>` recipient — account email, team name, team UID, or `@existing` for all users and teams currently on the folder (repeatable) `-r`, `--role <ROLE>` permission role (default: `viewer`). Required for `grant`. Allowed values: * `viewer` * `share-manager` * `content-manager` * `content-share-manager` * `full-manager` `--expire-at <TIMESTAMP>` share expiration as `never` or ISO datetime (e.g. `2027-01-01T00:00:00Z`) `--expire-in <PERIOD>` share expiration as `never` or a relative period (e.g. `30d`, `6mo`, `1y`, `24h`, `30mi`) **Examples:** ``` kd-share-folder Engineering -e alice@example.com -r viewer kd-share-folder Engineering -e alice@example.com -e bob@example.com -r content-manager kd-share-folder Engineering -e "Engineering Team" -r full-manager kd-share-folder Engineering -a grant -e alice@example.com -r viewer --expire-in 30d kd-share-folder Engineering -a remove -e alice@example.com kd-share-folder Engineering -a remove -e @existing ``` 1. Grant viewer access to a single user 2. Grant content-manager access to multiple users in one call 3. Grant full-manager access to a team (by team name) 4. Grant viewer access that automatically expires in 30 days 5. Remove a single user from the folder 6. Remove every existing user and team from the folder (excluding the caller) `--expire-at` and `--expire-in` are mutually exclusive. *** ### kd-share-record command **Command:** `kd-share-record` **Detail:** Manage Keeper Drive record sharing. Supports granting, updating, revoking, and transferring ownership. The `record` argument can be a record UID, a record title, or a folder (in which case all records inside the folder are processed; combine with `-R` for recursive descent). **Parameters:** A record path/UID or a folder path/UID (positional) **Switches:** `-e`, `--email <EMAIL>` recipient email (**required**, repeatable) `-a`, `--action <{grant, revoke, owner}>` sharing action (default: `grant`) * `grant` — share the record (also updates existing shares) * `revoke` — remove the share * `owner` — transfer record ownership (single recipient only) `-r`, `--role <ROLE>` permission role; required for `grant`. Allowed values: `viewer`, `share-manager`, `content-manager`, `content-share-manager`, `full-manager` `-R`, `--recursive` apply the command to every record within the folder *and* its sub-folders `--contacts-only` only share with already-known contacts (refuses unknown email addresses unless `--force` is supplied) `-f`, `--force` skip confirmation prompts (e.g. for `--contacts-only` confirmations) `--dry-run` display the permission changes without committing them `--expire-at <EXPIRE_AT>` share expiration as `never` or UTC datetime (e.g. `2027-01-01T00:00:00Z`) `--expire-in <PERIOD>` share expiration as `never` or a relative period (e.g. `30d`, `6mo`, `1y`) **Examples:** ``` kd-share-record rvwIBG_ban2VTH64OsnzLn -e alice@example.com -r viewer kd-share-record "API Key" -e alice@example.com -e bob@example.com -r content-manager kd-share-record Engineering -e alice@example.com -r viewer -R kd-share-record rvwIBG_ban2VTH64OsnzLn -e alice@example.com -r viewer --expire-in 30d kd-share-record rvwIBG_ban2VTH64OsnzLn -e alice@example.com -a revoke kd-share-record rvwIBG_ban2VTH64OsnzLn -e bob@example.com -a owner kd-share-record rvwIBG_ban2VTH64OsnzLn -e alice@example.com -r viewer --dry-run ``` 1. Share a record with a single user as a viewer 2. Share a record with multiple users in one call 3. Share every record in the "Engineering" folder *and its sub-folders* with a single user 4. Share a record with an expiration of 30 days 5. Revoke a share 6. Transfer ownership of a record (you will lose access after the transfer completes) 7. Preview a share without committing the change {% hint style="warning" %} `-a owner` transfers record ownership — **you will no longer have access** to the record once the transfer is accepted. Only one recipient is allowed. {% endhint %} *** ### kd-record-permission command **Command:** `kd-record-permission` **Detail:** Bulk-update sharing permissions for every record in a Keeper Drive folder. Useful for normalizing permissions across an entire folder (e.g. "make every share in the `Production` folder a viewer"). Permissions inherited from a parent shared folder are also handled — a fresh direct share is created to override an inherited row. **Parameters:** Folder path or folder UID (positional, optional — defaults to the Keeper Drive root) **Switches:** `-a`, `--action <{grant, revoke}>` action to perform (**required**) * `grant` — set every applicable share to `--role` * `revoke` — remove every applicable share (or only those matching `--role` if supplied) `-r`, `--role <ROLE>` role to grant, or filter to revoke. Allowed values: `viewer`, `share-manager`, `content-manager`, `content-share-manager`, `full-manager` `-R`, `--recursive` apply the change to every record in the folder *and* its sub-folders `--dry-run` display the permission changes without committing them `-f`, `--force` apply changes without confirmation **Examples:** ``` kd-record-permission Engineering -a grant -r viewer kd-record-permission Engineering -a grant -r content-manager -R kd-record-permission Engineering -a revoke kd-record-permission Engineering -a revoke -r viewer kd-record-permission Engineering -a grant -r viewer --dry-run kd-record-permission Engineering -a grant -r viewer -f ``` 1. Set every record share in the "Engineering" folder to `viewer` 2. Set every record share in "Engineering" *and its sub-folders* to `content-manager` 3. Revoke **every** non-owner share on every record in "Engineering" 4. Revoke only the `viewer` shares on records in "Engineering" 5. Preview the planned permission changes without committing them 6. Apply the change without confirmation Shares inherited from a parent shared folder cannot be revoked at the record level — they must be removed from the parent shared folder instead. The command will list any such shares as **skipped**. *** ### kd-transfer-record command **Command:** `kd-transfer-record` **Detail:** Transfer ownership of one or more Keeper Drive records to another user. After a successful transfer, the original owner loses access to the record(s). For finer-grained control, see `kd-share-record -a owner`. **Parameters:** Two positional arguments: `RECORD_UIDS... NEW_OWNER_EMAIL` * one or more record UIDs (or titles), followed by * the new owner's email address **Examples:** ``` kd-transfer-record rvwIBG_ban2VTH64OsnzLn alice@example.com kd-transfer-record rec1 rec2 rec3 alice@example.com ``` 1. Transfer ownership of a record to another user 2. Transfer ownership of multiple records to the same new owner After ownership is transferred you will no longer have access to the record. Make sure the new owner is correct before running this command. {% endhint %} *** ### Roles reference Several Keeper Drive sharing commands accept a `--role` option. The available roles are listed below in order of increasing privilege: | Role | Description | | ----------------------- | -------------------------------------------------------------------------------------------------- | | `viewer` | Read-only access to records | | `share-manager` | Can manage who else has access (cannot edit content) | | `content-manager` | Can edit record content (cannot manage shares) | | `content-share-manager` | Can edit record content **and** manage shares | | `full-manager` | Full control: edit, share, and delegate. Equivalent to a Share Administrator on the record/folder. | *** ### Operation reference `kd-rm` and `kd-rmdir` accept an `--operation` flag that determines how the removal is performed: | Operation | Applies to | Description | | ------------------ | ----------------------------------------- | ------------------------------------------------------------------------------------------------- | | `owner-trash` | `kd-rm` (default) | Owner-only deletion — record goes to the owner's trash | | `folder-trash` | `kd-rm`, `kd-rmdir` (default for folders) | Removes the record/folder from the supplied folder context and trashes it; recoverable from trash | | `unlink` | `kd-rm` | Removes the record from the specified folder only; the record itself stays in any other folders | | `delete-permanent` | `kd-rmdir` | **IRREVERSIBLE** — folder and all contents are permanently destroyed | *** --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.keeper.io/keeperpam/commander-cli/command-reference/keeper-drive-commands.md?ask=<question> ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.