Ctrlk
HomepageSystem Status

KeeperPAM Commands

Management of KeeperPAM functionality including Discovery, Rotation, Connections and Tunneling.

Overview

KeeperPAM functionality including discovery, password rotation, PAM Configuration, Keeper Gateway configuration can be controlled and operated through Commander using the pam command and sub-commands.

PAM Record types command reference and examples are on this page

pam Command

command: pam

Detail: Perform KeeperPAM controls.

My Vault> pam
pam command [--options]

Command     Description
----------  -----------------------------------------
gateway     Manage Gateways
config      Manage PAM Configurations
rotation    Manage Rotations
action      Execute action on the Gateway
tunnel      Manage Tunnels
split       Split credentials from legacy PAM Machine
legacy      Switch to legacy PAM commands
connection  Manage Connections
rbi         Manage Remote Browser Isolation
project     PAM Project Import/Export
launch      Launch a connection to a PAM resource
workflow    Manage PAM Workflows

Sub Commands

Sub-Command: gateway

Detail: View, create and remove Keeper Gateway services. To learn more about the Keeper Gateway click here.

list

Lists all gateways accessible by the Commander user. This includes:

  • Gateways directly accessible by the user in their vault.

  • Gateways registered under any managed node from the user's role.

new

edit

Allows updating the gateway's name or registered node. Equivalent actions can be performed in the Admin Console, under Secrets Manager → Gateways.

remove

Removes a gateway. The user executing this command must have admin rights on the gateway's parent application to perform this action.

set-max-instances

Defines maximum gateway pool instances. Used for High Availability integrations.

Sub-Command: config

Detail: View, create, edit and remove Keeper PAM Configurations. To learn more about PAM Configurations click here.

new

edit

list

remove

Sub-Command: connection

This command will edit the connection parameters and user accounts that are attached to PAM Machine and PAM Database records. The process can also be done in bulk with the run-batch command. To launch the connection, use the Keeper vault or Desktop app.

Prerequisites: Ensure that the PAM user credential, PAM Machine or PAM Database records are staged in a shared folder. Also ensure that there is a gateway configured, and everything is tied together in a PAM Configuration.

edit

examples:

example 1: Creates an RDP connection and assigns an administrative credential and PAM configuration. Activates the connection and screen recording.

example 2: Creates an SSH connection and assigns and administrative credential and PAM configuration. Activates the connection and screen recording while running in silent mode without screen outputs.

example 3: Creates an MSSQL connection and assigns and administrative credential and PAM configuration. Activates the connection and typescript recording.

Sub-Command: rbi

This command provides the ability to edit remote browser isolation settings for a record.

edit

Sub-Command: rotation

Detail: View and create Keeper Rotation configuration for records.

edit

Example - Set the rotation schedule using JSON

The --schedulejson or -sj params are used to set the schedule via JSON.

Rotate the PAM User record every month, on the 1st, at 4:00AM Chicago time.

Rotate the PAM User record every week on a Saturday, at 10:00PM New York time.

The following are the valid schedule types.

ON DEMAND

The job is triggered manually on demand.

DAILY

The job is triggered every day.

  • type - DAILY

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; The number of days between triggers. Allows ability to skip days.

WEEKLY

The job is triggered every week.

  • type - WEEKLY

  • weekday - Week day name. Must be the full name, all in uppercase.

    • SUNDAY

    • MONDAY

    • TUESDAY

    • WEDNESDAY

    • THURSDAY

    • FRIDAY

    • SATURDAY

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; If set to a value greater than 1, weekday will be ignored. The job will be triggers the multiple times per week starting on Sunday. The day will be based on the value of intervalCount .

MONTHLY_BY_DAY

The job is triggered every month on a specific month day.

  • type - MONTHLY_BY_DAY

  • monthDay - Day of the month. Starts at 1 and goes to max number of days per month. Remeber that 29 can be a leap year day.

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; If set to a value greater than 1, the job will trigger on the monthDay and will re-trigger every intervalCount days.

MONTHLY_BY_WEEKDAY

The job is triggered every month on a specific week day and time.

  • type - MONTHLY_BY_WEEKDAY

  • weekday - Week day name. Must be the full name, in all uppercase.

    • SUNDAY

    • MONDAY

    • TUESDAY

    • WEDNESDAY

    • THURSDAY

    • FRIDAY

    • SATURDAY

  • occurrence - Which week to trigger. If fifth week, use LAST.

    • FIRST

    • SECOND

    • THIRD

    • FOURTH

    • LAST

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; If set, and set to value other than 1, the trigger will start on the weekday and then trigger every intervalCount weeks.

YEARLY

The job is triggered yearly on a specific month, day and time.

  • type - YEARLY

  • month - Month name. Must be the full month name, in all uppercase.

    • JANUARY

    • FEBURARY

    • MARCH

    • APRIL

    • MAY

    • JUNE

    • JULY

    • AUGUST

    • SEPTEMBER

    • OCTOBER

    • NOVEMBER

    • DECEMBER

  • monthDay - Day of the month. Starts at 1 and goes to max number of days per month. Remeber that 29 can be a leap year day.

  • time - A 24 hours formatted time when the jobs should be triggered.

  • tz - You local IANA time zone. (i.e., America/Chicago)

  • intervalCount - Optional; If set, and set to value other than 1, every intervalCount year will be triggered.

Example - Set the password complexity for the PAM User

The --complexity or -x params are used to set the password complexity.

Set the password complexity to create a 20 character password with a minimum of 1 uppercase letter, 4 lowercase letters, 2 digits, and 2 symbols from the symbol set .=+- .

The value is a comma separated value (CSV) style value with the following parts:

  1. Overall password length

  2. Minimum number of uppercase letters.

  3. Minimum number of lowercase letters.

  4. Minimum number of digits.

  5. Minimum number of symbols.

  6. Special set. After last comma, just type the special characters you would like. You are limited to symbols in the following set. If left blank, this symbol set will be used.

list

Display a list of all resources configured for rotation

info

Display information about the rotation settings for a particular resource.

script

Manage post-rotation PAM scripts

Sub-Command: action

Detail: Discovery, rotation and service account management of PAM Resources

gateway-info

Display information about the specific Keeper Gateway.

discover

Manage Discovery jobs

discover start

Start a discovery job

discover status

Display the status of a discovery job

discover remove

Stop a running discovery job

discover process

Process the findings of a discovery job

discover rule

Manage discovery rules

discover rule add

Add a discovery rule

rotate

Issue a credential rotation on the specific resource, folder of resources, or pattern in the resource title. Optionally send an email with a one-time share link through a configured email provider.

job-info

Display information about the running job

job-cancel

Cancel a running job

service list

Display the services and scheduled tasks associated to a specific Keeper Gateway

service add

Add an association for a service to a specific Keeper Gateway and PAM Machine. Once associated, Keeper will update the credentials for that service, on the specific PAM Machine, and restart the service (if running).

service remove

Remove an association for a service on a specific PAM Machine.

Sub-Command: tunnel

Detail: View and create Keeper Tunnels from the local machine to target infrastructure.

start

Start a tunnel from the local device to the target resource

list

Display a list of all available tunnels running

stop

Stop a tunnel that is currently running

tail

Display information in the Keeper tunnel

edit

Edit the configuration of an existing Tunnel

Sub-command: split

Detail: Split a legacy PAM record into the new KeeperPAM format.

Sub-command: project

Detail: Create a KeeperPAM project (similar to the Quick Start Sandbox from the vault user interface).

The PAM Import command helps customers (such as MSPs) with thousands of managed companies to automate the creation of folders, gateways, machines, users, connections, tunnels and (optionally) rotations.

pam project import --name=project1 --filename=/path/to/import.json --dry-run

  • --name, -n → Project name (overrides "project":"" from JSON)

  • --filename, -f → JSON file to load import data from.

  • --dry-run, -d → Test import without modifying vault.

Command Variation: "extend"

The pam project extend command helps customers to create additional records after the initial import that will use same existing PAM Gateway and PAM Configuration.

Import/Extend JSON Documentation

  • A step-by-step guide to importing Windows Servers as PAM Resources from a basic list of server hostnames can be found at this page: Importing PAM Resources

  • A more detailed specification for "pam project import" templates can be found at this GitHub README Page

  • If you require assistance, contact the Commander team ([email protected]).

Sub-Command: Launch

Detail: Launch a CLI-based KeeperPAM privileged session. This allows developers to use their preferred native terminal for connecting to a target. When "pam launch" is used, the session activity is recorded and monitored as configured by the resource.

To initiate a connection from the Commander CLI:

From the terminal, sessions can be launched outside of the Commander CLI:

Syntax:

Sub-Command: workflow

Detail: Manage Just-In-Time (JIT) privileged access workflows for PAM resources. Workflows enforce approval-based access control with optional check-in/check-out, MFA verification and time-based access windows.

Workflow configuration commands (create, update, delete, add-approver, remove-approver) require the "Can manage workflow settings" enforcement policy enabled for your role. Users without this enforcement will only see requester and approver commands.

Record owners and approvers (users on a workflow's approver list, either directly or via a team) are exempt from workflow requirements on that record and can access the resource directly.

Sub Commands

create

Create a workflow configuration for a PAM record. At least one approver must be added if approvals are required.

Examples

Create a basic workflow requiring 1 approval with a 1 day access window:

Create a workflow with check-in/check-out, MFA, and reason required:

Create a workflow with temporal access restrictions (weekdays only, business hours):

Allowed days and time ranges are stored in the admin's local IANA timezone (auto-detected when running the command). All access enforcement is performed in this timezone, regardless of where the requester is located. Override at run-time via the TZ environment variable (e.g. TZ=America/New_York pam workflow create ...).

read

Display the current workflow configuration for a record, including parameters, approvers and temporal access filters.

Example

update

Update an existing workflow configuration. Only specified fields are changed; unspecified fields retain their current values.

Example

Enable MFA and change the access duration to 4 hours:

delete

Delete the workflow configuration from a record. This removes all workflow requirements for the resource.

add-approver

Add users or teams as approvers to a workflow. Supports escalation approvers with an optional delay timer. Any user with at least view-only access to the record can be added as an approver. Enterprise administrators can add any team in the enterprise as an approver, even if they are not personally a member of that team.

Examples

Add a user and a team as approvers:

Add an escalation approver that is notified after 1 hour:

remove-approver

Remove users or teams from a workflow's approver list.

Example

pending

List all pending workflow approval requests assigned to the current user. Duplicate entries (when the user is an approver via multiple paths) are automatically filtered.

Example

approve

Approve a pending workflow access request using the flow UID from the pending command.

Example

deny

Deny a pending workflow access request. An optional reason can be provided which is encrypted with the requester's public key.

Example

request

Request access to a workflow-protected PAM resource. Supports escalation of pending requests and cancellation of active requests.

The --cancel flag cannot be used with --escalate, --reason, or --ticket.

Examples

Request access with a reason and ticket number:

Escalate a pending request to escalation approvers:

Cancel a pending or active request:

start

Start a workflow session (check-out). This is required before connecting to the resource when check-in/check-out is enabled. Accepts either a record UID/name or a flow UID.

Example

end

End a workflow session (check-in). Credentials may be rotated after check-in. The --force flag allows approvers to terminate another user's active session when single-user checkout is enabled.

Examples

End your own workflow session:

Force check-in another user's session (approver only):

state

View the current workflow state for a record. Output includes the current Stage, outstanding Conditions, who has the resource checked out, and the list of approvers who have already approved.

Example

Check workflow state by flow UID:

my-access

List all active workflow sessions for the current user across all resources.

Example

Single-User Check-In / Check-Out Mode

When a workflow is created with the --checkout (-co) flag, the resource operates in single-user check-in/check-out mode. This enforces exclusive access - only one user can have the resource checked out at a time.

How it works:

  • After a request is approved, the user must explicitly check out the resource with pam workflow start before they can connect via pam tunnel or pam launch.

  • While the resource is checked out, no other user can check it out until the current session ends.

  • When the user is done, they check in with pam workflow end, which releases the resource and may trigger credential rotation.

  • If a user's session needs to be terminated, an approver can use pam workflow end <uid> --force to forcibly check in the resource.

Without single-user check-out mode: After approval, the user must still run pam workflow start to begin the access session, unless --start-on-approval was set (which starts the access timer automatically upon approval). Multiple users can have concurrent approved access to the same resource.

Visibility: When a resource is checked out, the pam workflow state <record> command shows the Checked out by field with the current user's email.

Force check-in (--force) is only available when single-user checkout is active. It allows approvers to revoke a user's session - for example, if the user is unresponsive or the session has been left open.

Typical Workflow Lifecycle

The following describes a typical end-to-end JIT access workflow:

  1. Administrator creates a workflow on a PAM record: pam workflow create "Prod Server" -n 1 -co -rm -d 2h

  2. Administrator adds approvers: pam workflow add-approver "Prod Server" -u [email protected]

  3. User requests access: pam workflow request "Prod Server" -r "Deploy hotfix" -t "INC-789"

  4. Approver reviews pending requests: pam workflow pending

  5. Approver approves the request: pam workflow approve xY9zA8bC7dE6

  6. User checks out the resource: pam workflow start "Prod Server"

  7. User is prompted for MFA (if --require-mfa was set), then connects via tunnel or launch: pam tunnel start "Prod Server" or pam launch "Prod Server"

  8. User checks in after completing work: pam workflow end "Prod Server"

Glossary

Term
Definition

Flow UID

Unique identifier for a workflow request instance. Generated when a user requests access; used to approve, deny, start, or end that specific request. Visible in the output of pam workflow pending and pam workflow my-access.

Stage

Current state of a workflow request: Needs Action (no request raised), Waiting (request raised, awaiting approvals or time-window), Ready to Start (approved, awaiting check-out), Started (active session).

Conditions

Outstanding requirements blocking the workflow from advancing. Possible values: Approval Required, Check-in Required, MFA Required, Time Restriction, Reason Required, Ticket Required.

Check-out

Acquiring exclusive access to a resource via pam workflow start. Required when single-user check-in/check-out mode is enabled.

Check-in

Releasing access to a resource via pam workflow end. May trigger credential rotation.

PreviousSharing CommandsNextPAM Extended Commands

Last updated