# Enterprise Role Commands

#### Usage <a href="#usage-4" id="usage-4"></a>

```bash
enterprise-role command [--options] OR er command [--option]
```

**Alias:** `er`

#### Commands <a href="#commands-2" id="commands-2"></a>

| Command                                     | Description                       | Alias |
| ------------------------------------------- | --------------------------------- | ----- |
| [`view`](#enterprise-role-view)             | View enterprise role              | `v`   |
| [`add`](#enterprise-info-tree)              | Create enterprise role(s)         | `a`   |
| [`edit`](#enterprise-info-tree-1)           | Edit enterprise role(s)           | `e`   |
| [`delete`](#enterprise-info-tree-2)         | Delete enterprise role(s)         |       |
| [`admin`](#enterprise-node-invite-email)    | Manage enterprise admin role      |       |
| [`membership`](#enterprise-role-membership) | Manage enterprise role membership | `m`   |
| [`copy`](#enterprise-role-copy)             | Copy role with enforcements       |       |

### Enterprise Role view Command

View enterprise role.

<details>

<summary>Dotnet CLI</summary>

**Command:** `enterprise-role name`

**Example:**

```
My Vault> enterprise-role view "IT Admin" OR er view "IT Admin"
```

</details>

<details>

<summary>DotNet SDK</summary>

Data can be retrieved from `RoleData`

**Function:** `RoleData`

```csharp
 public interface IRoleDataManagement
```

**Example:**

```csharp
await roleData.Enterprise.Load();
```

</details>

<details>

<summary>PowerCommander</summary>

**Command**: `Get-KeeperEnterpriseRole`

**Syntax:**

```powershell
Get-KeeperEnterpriseRole [[-Role] <long>] [<CommonParameters>]
```

**Aliases:** `ker`

**Parameters:**

* `-Name` - User email.
* `-Filter` - Search filter.
* `-Format` - Output format.
* `-Output` - Output file name.

**Examples**:

```powershell
# List all roles
PS> Get-KeeperEnterpriseRole
ker

# Get specific role
PS> Get-KeeperEnterpriseRole -Role 123453e

# Search role
PS> Get-KeeperEnterpriseRole -Filter Test1
```

**Command:** `Get-KeeperEnterpriseRoleUsers` / `Get-KeeperEnterpriseRoleTeams`

Get role members

**Syntax:**

```powershell
Get-KeeperEnterpriseRoleUsers [-Role] <long> [<CommonParameters>]
Get-KeeperEnterpriseRoleTeams [-Role] <long> [<CommonParameters>]
```

**Aliases:** `keru`, `kert`

**Parameters:**

* `-Role` - Role ID (required)

**Examples:**

```powershell
# Get users in role
Get-KeeperEnterpriseRoleUsers -Role 12345
keru 12345

# Get teams in role
Get-KeeperEnterpriseRoleTeams -Role 12345
kert 12345
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `enterprise-role view`

**Parameter**:

`role` - Role Name or ID (required)

**Flag:**

* `-v`, `--verbose` - Print verbose information
* `--format` - Output format: `json`
* `--output` - Output filename

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```python
if isinstance(role_name, int):
    role = enterprise_data.roles.get_entity(role_name)
elif isinstance(role_name, str):
    if role_name.isnumeric():
        role = enterprise_data.roles.get_entity(int(role_name))
    if not role:
        role = [x for x in enterprise_data.roles.get_all_entities() if x.name.lower() == role_name.lower()]
```

</details>

### Enterprise Role Add Command <a href="#enterprise-info-tree" id="enterprise-info-tree"></a>

Create enterprise role(s).

<details>

<summary>Dotnet CLI</summary>

**Command:** `enterprise-role add "Role Name" --node "Node Name" OR er add "Role Name" --node "Node Name"`

**Example:**

```
My Vault> enterprise-role add "Help Desk" --node "IT Department"
OR 
er add "Help Desk" --node "IT Department"
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:** `CreateRole`

```
Task<EnterpriseRole> CreateRole(string roleName, long nodeId, bool newUserInherit);
```

**Example:**

```
await roleData.CreateRole(arguments.Role, nodeId, arguments.NewUser);
```

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `New-KeeperEnterpriseRole`

**Aliases:** `keradd`

**Parameters:**

<table><thead><tr><th width="163.71875">Parameter</th><th width="128.453125">Required</th><th>Description</th></tr></thead><tbody><tr><td><code>-Role</code></td><td>Yes</td><td>Role name(s). Can specify multiple roles.</td></tr><tr><td><code>-ParentNode</code></td><td>No</td><td>Parent node name or ID. Defaults to root node.</td></tr><tr><td><code>-NewUser</code></td><td>No</td><td>Assign role to new users. Values: <code>on</code>, <code>off</code>. Default: <code>off</code>.</td></tr><tr><td><code>-VisibleBelow</code></td><td>No</td><td>Make role visible to subnodes. Values: <code>on</code>, <code>off</code>. Default: <code>off</code>.</td></tr><tr><td><code>-Enforcement</code></td><td>No</td><td>Role enforcement in <code>KEY:VALUE</code> format. Can be repeated. list can be found <a href="/pages/-McBBhPRYGc9uLwMe71Z#changing-role-enforcements-and-privileges">here</a></td></tr><tr><td><code>-Force</code></td><td>No</td><td>Skip confirmation when role name already exists.</td></tr></tbody></table>

**Example:**

```powershell
PS> New-KeeperEnterpriseRole -ParentNode test_node_updated2 -Role PowerShellTest -NewUser on -VisibleBelow on -Enforcement "RESTRICT_IMPORT:True","RESTRICT_EXPORT:True"
Role with name "PowerShellTest" already exists. Do you want to create a new one? (Yes/No): yes
Role "PowerShellTest" created successfully (ID: 894448862131)

Id              DisplayName    NodeName           NewUserInherit Users Teams IsAdminRole
--              -----------    --------           -------------- ----- ----- -----------
894448862131    PowerShellTest test_node_updated2       X          0     0        -
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `enterprise-role add`

**Parameter**:

`role` - Role Name. Can be repeated. (required)

**Flag:**

* `--parent` - Parent node name or ID
* `--new-user` - Assign this role to new users: `on` or `off`
* `--visible-below` - Visible to all nodes. 'add' only: `on` or `off`
* `--enforcement` - Sets role enforcement. Format: `KEY:VALUE`. Can be repeated.
* `-f`, `--force` - Do not prompt for confirmation

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```python
from keepersdk.enterprise import batch_management,  enterprise_management

roles = list['names of roles to add']
role_lookup: Dict[str, Union[enterprise_types.Role, List[enterprise_types.Role]]] = {}

for role in e_data.roles.get_all_entities():
    role_lookup[str(role.role_id)] = role
    if role.name:
        role_name = role.name.lower()
        n = role_lookup.get(role_name)
        if n is None:
            role_lookup[role_name] = role
        elif isinstance(n, list):
            n.append(role)
        elif isinstance(n, enterprise_types.Role):
            role_lookup[role_name] = [n, role]
            
role_names: Optional[Dict[str, str]] = None
if isinstance(roles, list):
    role_names = {x.lower(): x for x in roles}
    for role_key, role_name in list(role_names.items()):
        r = role_lookup.get(role_key)
        if r is not None:
            skip = False
            if isinstance(r, enterprise_types.Role):
                r = [r]
            for r1 in r:
                if r1.node_id == parent_node_id:
                    logging.info('Role \"%s\" already exists', r1.name)
                    skip = True
                    break
            if skip:
                del role_names[role_key]
                
roles_to_add = [enterprise_management.RoleEdit(
    role_id=enterprise_loader.get_enterprise_id(), name=x, node_id=parent_node_id,
    new_user_inherit=apply_to_new_user, visible_below=visible_to_all_nodes)
    for x in role_names.values()]
batch = batch_management.BatchManagement(loader=enterprise_loader, logger=enterprise_manager_logger)
batch.modify_roles(to_add=roles_to_add)
batch.apply()
```

</details>

### Enterprise Role Edit Command <a href="#enterprise-info-tree" id="enterprise-info-tree"></a>

Edit enterprise role(s).

<details>

<summary>DotNet CLI</summary>

**Command**: `enterprise-role update`

**Usage :** `enterprise-role update role-name --flags=values`

**flags:**

<table><thead><tr><th width="168.7578125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-new-user</code></td><td>Set role as default for new users in the node</td></tr><tr><td><code>-visible-below</code></td><td>Set role visibility to subnodes</td></tr><tr><td><code>-new-role-name</code></td><td>New role display name</td></tr></tbody></table>

**Example:**

```console
My Vault> enterprise-role update Analyst --new-user=true --visible-below=true
Role "Analyst" updated successfully.
        Role Name:  Analyst
    Visible Below:  X
 New User Inherit:  X   

My Vault> enterprise-role update Test1 --new-user=false --visible-below=false
Role "Test1" updated successfully.
        Role Name:  Test1
    Visible Below:  -    
 New User Inherit:  -    
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:** `UpdateRole`

**Usage:**

```csharp
public async Task<EnterpriseRole> UpdateRole(EnterpriseRole role, bool? newUserInherit = null, bool? visibleBelow = null, string displayName = null)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>newUserInherit</code></td><td>Sets the current role we are editing as a default role</td></tr><tr><td><code>visibleBelow</code></td><td>Set role visibility to subnodes. If null, property is not changed</td></tr><tr><td><code>displayName</code></td><td>New role display name. If null, property is not changed.</td></tr></tbody></table>

\
**Example:**

```csharp
roleData.UpdateRole(
                updateParams['newUserInherit'],
                updateParams['visibleBelow'],
                updateParams['displayName']
            )
```

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Set-KeeperEnterpriseRole`

**Usage:** `Set-KeeperEnterpriseRole <Role Name> -NewUserInherit $true`

**Options:**

<table><thead><tr><th width="168.7578125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Role</code></td><td>Role Name, ID, or EnterpriseRole object (mandatory)</td></tr><tr><td><code>-NewUserInherit</code></td><td>Set role as default for new users in the node</td></tr><tr><td><code>-VisibleBelow</code></td><td>Set role visibility to subnodes</td></tr><tr><td><code>-NewDisplayName</code></td><td>New role display name</td></tr></tbody></table>

**Example:**

```powershell
PS> Set-KeeperEnterpriseRole Test1 -NewUserInherit $true
Role "Test1" updated successfully

Id              DisplayName NodeName   NewUserInherit Users Teams IsAdminRole
--              ----------- --------   -------------- ----- ----- -----------
894122414228537 Test1       Metronlabs       X          1     0        -
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `enterprise-role edit`

**Parameter**:

`role` - Role Name or ID. Can be repeated. (required)

**Flag:**

* `--parent` - Parent node name or ID
* `--name`, `--displayname` - Set role display name
* `--new-user` - Assign this role to new users: `on` or `off`
* `--visible-below` - Visible to all nodes: `on` or `off`
* `--enforcement` - Sets role enforcement. Format: `KEY:VALUE`. Can be repeated.

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```python
from keepersdk.enterprise import batch_management,  enterprise_management

if isinstance(role_name, int):
    role = enterprise_data.roles.get_entity(role_name)
elif isinstance(role_name, str):
    if role_name.isnumeric():
        role = enterprise_data.roles.get_entity(int(role_name))
    if not role:
        role = [x for x in enterprise_data.roles.get_all_entities() if x.name.lower() == role_name.lower()]

role_list = [role]
batch = batch_management.BatchManagement(loader=enterprise_loader, logger=enterprise_manager_logger)

roles_to_update = [enterprise_management.RoleEdit(
    role_id=x.role_id, name=role_name, node_id=parent_id,
    new_user_inherit=new_user_inherit, visible_below=visible_below)
    for x in role_list]
batch.modify_roles(to_update=roles_to_update
batch.apply()
```

</details>

### Enterprise Role Delete Command <a href="#enterprise-info-tree" id="enterprise-info-tree"></a>

Delete enterprise role(s).

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role delete <"Role name"> OR er delete <"Role name">`

**Example:**

```
My Vault> enterprise-role delete "Help Desk"
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:** `DeleteRole()`

**Usage:**

```csharp
public async Task DeleteRole(EnterpriseRole role)
```

**Example:**

```csharp
 await roleData.DeleteRole(role)
```

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Remove-KeeperEnterpriseRole`

**Aliases** : `kerdel`

**Parameters:**

`-Force` : skips confirmation prompt

**Example:**

```powershell
PS> Remove-KeeperEnterpriseRole PowerShellTest                

Confirm
Are you sure you want to perform this action?
Performing the operation "Delete Enterprise Role" on target "Role "PowerShellTest" (ID: 894448414228628)".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): A
Role "PowerShellTest" (ID: 894448414228628) deleted successfully
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `enterprise-role delete`

**Parameter:**

* `role` - Role Name or ID. Can be repeated. (required)

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```python
from keepersdk.enterprise import batch_management,  enterprise_management

if isinstance(role_name, int):
    role = enterprise_data.roles.get_entity(role_name)
elif isinstance(role_name, str):
    if role_name.isnumeric():
        role = enterprise_data.roles.get_entity(int(role_name))
    if not role:
        role = [x for x in enterprise_data.roles.get_all_entities() if x.name.lower() == role_name.lower()]

role_list = [role]
batch = batch_management.BatchManagement(loader=enterprise_loader, logger=enterprise_manager_logger)

batch.modify_roles(to_remove=(enterprise_management.RoleEdit(role_id=x.role_id) for x in role_list))
batch.apply()
```

</details>

### Enterprise Role Admin Command <a href="#enterprise-node-invite-email" id="enterprise-node-invite-email"></a>

Manage enterprise admin role.

<details>

<summary>DotNet CLI</summary>

**Command :** `enterprise-role add-users-to-admin-role <Role name> <Username> OR`

`er add-users-to-admin-role <Role name> <Username>`

**Example :**

```
enterprise-role add-users-to-admin-role "Administrator" "test@demo.com"
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:** `AddUserToAdminRole`

**Usage:**

```csharp
public async Task AddUserToAdminRole(EnterpriseRole role, EnterpriseUser user)
```

</details>

<details>

<summary>PowerCommander</summary>

The commands are seperated here and have different commands for each functionality

check the below commands for details on functionality.

| [Add-KeeperEnterpriseRoleManagedNode](#enterprise-role-managed-node-add-command)                |
| ----------------------------------------------------------------------------------------------- |
| [Remove-KeeperEnterpriseRoleManagedNode](#enterprise-role-managed-node-delete-command)          |
| [Add-KeeperEnterpriseRolePrivilege](#enterprise-role-managed-node-privileges-add-command)       |
| [Remove-KeeperEnterpriseRolePrivilege](#enterprise-role-managed-node-privileges-remove-command) |

</details>

<details>

<summary>Python CLI</summary>

**Command:** `enterprise-role admin`

**Parameter**:

`role` - Role Name or ID (required)

**Flag:**

* `-aa`, `--add-admin` - Add managed node to role. Can be repeated.
* `-ra`, `--remove-admin` - Remove managed node from role. Can be repeated.
* `-ap`, `--add-privilege` - Add privilege to managed node. Can be repeated.
* `-rp`, `--remove-privilege` - Remove privilege from managed node. Can be repeated.
* `--cascade` - Apply to the child nodes. "--add-admin" only: `on` or `off`

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```
from keepersdk.enterprise import batch_management,  enterprise_management

batch = batch_management.BatchManagement(loader=enterprise_loader, logger=enterprise_manager_logger)

if isinstance(role_name, int):
    role = enterprise_data.roles.get_entity(role_name)
elif isinstance(role_name, str):
    if role_name.isnumeric():
        role = enterprise_data.roles.get_entity(int(role_name))
    if not role:
        role = [x for x in enterprise_data.roles.get_all_entities() if x.name.lower() == role_name.lower()]

existing_nodes = {x.managed_node_id: x for x in enterprise_data.managed_nodes.get_links_by_subject(role.role_id)}

nodes_to_add_admin = ['list of nodes']
nodes_to_remove_admin = ['list of nodes']

nodes_to_add_admin: Optional[List[enterprise_types.Node]] = None
nodes_to_remove_admin: Optional[List[enterprise_types.Node]] = None
cascade: Optional[bool] = None
add_admins = ['nodes']
if isinstance(add_admins, list):
    for admin in add_admins:
        if isintance(admin, int):
            node = enterprise_data.nodes.get_entity(admin)
        elif isintance(admin, str):
            node = [node for node in enterprise_data.nodes.get_all_entities() if node.name.lower() == admin]
        nodes_to_add_admin.append(node)

remove_admins = ['nodes']
if isinstance(remove_admins, list):
    for admin in remove_admins:
        if isintance(admin, int):
            node = enterprise_data.nodes.get_entity(admin)
        elif isintance(admin, str):
            node = [node for node in enterprise_data.nodes.get_all_entities() if node.name.lower() == admin]
        nodes_to_remove_admin.append(node)

add_privileges = ['privileges to be granted']
remove_priviliges = ['privileges to be removed']
if nodes_to_add_admin is not None:
    aps: Optional[Set[str]] = None
    rps: Optional[Set[str]] = None
    if isinstance(add_privileges, list):
        privilege = enterprise_types.RolePrivileges(role_id=0, managed_node_id=0)
        for p in add_privileges:
            if not privilege.set_by_name(p, True):
                logger.info('Invalid privilege "%s"', p)
        aps = privilege.to_set()

    if isinstance(remove_privileges, list):
        privilege = enterprise_types.RolePrivileges(role_id=0, managed_node_id=0)
        for p in remove_privileges:
            if not privilege.set_by_name(p, False):
                logger.info('Invalid privilege "%s"', p)
        rps = privilege.to_set()

    for node in nodes_to_add_admin:
        mne = enterprise_management.ManagedNodeEdit(
            role_id=role.role_id, managed_node_id=node.node_id, cascade_node_management=cascade)
        if aps and len(aps) > 0:
            if mne.privileges is None:
                mne.privileges = {}
            for p in aps:
                mne.privileges[p] = True
        if rps and len(rps) > 0:
            if mne.privileges is None:
                mne.privileges = {}
            for p in rps:
                mne.privileges[p] = False
        if node.node_id in existing_nodes:
            en = existing_nodes[node.node_id]
            assert en
            if (isinstance(cascade, bool) and en.cascade_node_management != cascade) or aps or rps:
                batch.modify_managed_nodes(to_update=[mne])
        else:
            batch.modify_managed_nodes(to_add=[mne])

if nodes_to_remove_admin is not None:
    for node in nodes_to_remove_admin:
        if node.node_id in existing_nodes:
            batch.modify_managed_nodes(to_remove=[enterprise_management.ManagedNodeEdit(
                role_id=role.role_id, managed_node_id=node.node_id)])

batch.apply()
```

</details>

### Enterprise Role Membership Command <a href="#enterprise-role-membership" id="enterprise-role-membership"></a>

Manage enterprise role membership.

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role add-members "Role Name"`

**Aliases**: `er`

**Example:**

```
My Vault> enterprise-role add-members "IT Admin" admin1@company.com
My Vault> enterprise-role remove-members "IT Admin" admin1@company.com
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

`AddUserToAdminRole` - To add user as admin

`RemoveUserFromRole` - To remove admin role from user

**Examples:**

```csharp
public async Task AddUserToAdminRole(EnterpriseRole role, EnterpriseUser user)
```

```csharp
 public async Task RemoveUserFromRole(EnterpriseRole role, EnterpriseUser user)
```

</details>

<details>

<summary>PowerCommander</summary>

**Add Users to a given Role**

**Command:** `Grant-KeeperEnterpriseRoleToUser`

**Aliases:** `kerua`

**Flags:**

* `-Role` : Role Name, ID, or EnterpriseRole object
* `-User` : User email, ID, or EnterpriseUser object

**Example:**

```ps1
PS > Grant-KeeperEnterpriseRoleToUser -Role "Administrator Role" -User "user@example.com"
User "user@example.com" added to role "Administrator Role"
```

**Remove Users from a given role:**

**Command:** `Revoke-KeeperEnterpriseRoleFromUser`

**Aliases:** `kerur`

**Flags:**

* `-Role` : Role Name, ID, or EnterpriseRole object
* `-User` : User email, ID, or EnterpriseUser object

**Example:**

```ps1
PS > Revoke-KeeperEnterpriseRoleFromUser -Role "Administrator Role" -User "user@example.com"
User "user@example.com" removed from role "Administrator Role"
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `enterprise-role membership`

**Parameter:**

* `role` - Role Name or ID (required)

**Options**:\
`-h, --help` show this help message and exit\
`-au, --add-user` EMAIL - add user to role. Can be repeated.\
`-ru, --remove-user` EMAIL - remove user (Email, User ID, @all) from role. Can be repeated.\
`-at, --add-team` TEAM - add team to role. Can be repeated.\
`-rt, --remove-team` TEAM - remove team (Name, Team UID, @all) from role. Can be repeated.

**Warning:** This action cannot be undone and will remove all users, roles, teams, and subnodes.

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```python
from keepersdk.enterprise import batch_management,  enterprise_management

if isinstance(role_name, int):
    role = enterprise_data.roles.get_entity(role_name)
elif isinstance(role_name, str):
    if role_name.isnumeric():
        role = enterprise_data.roles.get_entity(int(role_name))
    if not role:
        role = [x for x in enterprise_data.roles.get_all_entities() if x.name.lower() == role_name.lower()]

role_list = [role]
users_to_add: Optional[List[enterprise_types.User]] = None
teams_to_add: Optional[List[enterprise_types.Team]] = None
users_to_remove: Optional[List[enterprise_types.User]] = None
teams_to_remove: Optional[List[enterprise_types.Team]] = None
add_users = ['list of user to add']
add_teams = ['list of teams to add']
remove_users = ['list of user to remove']
has_remove_all_users: bool = False
remove_teams = ['list of teams to remove']
has_remove_all_teams: bool = False

if isinstance(add_users, list):
    for add_user in add_users:
        user = [user for user in enterprise_data.users.get_all_entities() if user.username.lower() == add_user.lower()]
        users_to_add.append(user)
if isinstance(add_teams, list):
    team_lookup: Dict[str, Union[enterprise_types.Team, List[enterprise_types.Team]]] = {}
    for team in enterprise_data.teams.get_all_entities():
        team_lookup[team.team_uid] = team
        team_name = team.name.lower()
        t = team_lookup.get(team_name)
        if t is None:
            team_lookup[team_name] = team
        elif isinstance(t, list):
            t.append(team)
        elif isinstance(t, enterprise_types.Team):
            team_lookup[team_name] = [t, team]

    found_teams: Dict[str, enterprise_types.Team] = {}
    t: Optional[enterprise_types.Team]
    for team_name in add_teams:
        t = None
        if isinstance(team_name, str):
            t = enterprise_data.teams.get_entity(team_name)
            if t is None:
                tt = team_lookup.get(team_name.lower())
                if isinstance(tt, list):
                    if len(tt) == 1:
                        t = tt[0]
                    elif len(tt) >= 2:
                        continue
                elif isinstance(tt, enterprise_types.Team):
                    t = tt
        if t is None:
            continue
        found_teams[t.team_uid] = t
    teams_to_add = list(found_teams.values())
if isinstance(remove_users, list):
    has_remove_all_users = any((True for x in remove_users if x == '@all'))
    if not has_remove_all_users:
        for remove_user in remove_users:
            user = [user for user in enterprise_data.users.get_all_entities() if user.username.lower() == remove_user.lower()]
            users_to_remove.append(user)
if isinstance(remove_teams, list):
    has_remove_all_teams = any((True for x in remove_teams if x == '@all'))
    if not has_remove_all_teams:

        team_lookup: Dict[str, Union[enterprise_types.Team, List[enterprise_types.Team]]] = {}
        for team in enterprise_data.teams.get_all_entities():
            team_lookup[team.team_uid] = team
            team_name = team.name.lower()
            t = team_lookup.get(team_name)
            if t is None:
                team_lookup[team_name] = team
            elif isinstance(t, list):
                t.append(team)
            elif isinstance(t, enterprise_types.Team):
                team_lookup[team_name] = [t, team]

        found_teams: Dict[str, enterprise_types.Team] = {}
        t: Optional[enterprise_types.Team]
        for team_name in remove_teams:
            t = None
            if isinstance(team_name, str):
                t = enterprise_data.teams.get_entity(team_name)
                if t is None:
                    tt = team_lookup.get(team_name.lower())
                    if isinstance(tt, list):
                        if len(tt) == 1:
                            t = tt[0]
                        elif len(tt) >= 2:
                            continue
                    elif isinstance(tt, enterprise_types.Team):
                        t = tt
            if t is None:
                continue
            found_teams[t.team_uid] = t
        teams_to_remove = list(found_teams.values())

batch = batch_management.BatchManagement(loader=enterprise_loader, logger=enterprise_manager_logger)
for role in role_list:
    existing_users = {x.enterprise_user_id for x in enterprise_data.role_users.get_links_by_subject(role.role_id)}
    existing_teams = {x.team_uid for x in enterprise_data.role_teams.get_links_by_subject(role.role_id)}
    if users_to_add:
        users_to_add = [x for x in users_to_add if x.enterprise_user_id not in existing_users]
        if users_to_add:
            batch.modify_role_users(to_add=[enterprise_management.RoleUserEdit(
                role_id=role.role_id, enterprise_user_id=x.enterprise_user_id) for x in users_to_add])
    if teams_to_add:
        teams_to_add = [x for x in teams_to_add if x.team_uid not in existing_teams]
        if teams_to_add:
            batch.modify_role_teams(to_add=[enterprise_management.RoleTeamEdit(
                role_id=role.role_id, team_uid=x.team_uid) for x in teams_to_add])
    if has_remove_all_users:
        batch.modify_role_users(to_remove=[enterprise_management.RoleUserEdit(
            role_id=role.role_id, enterprise_user_id=x) for x in existing_users])
    elif users_to_remove:
        batch.modify_role_users(to_remove=[enterprise_management.RoleUserEdit(
            role_id=role.role_id, enterprise_user_id=x.enterprise_user_id) for x in users_to_remove])
    if has_remove_all_teams:
        batch.modify_role_teams(to_remove=[enterprise_management.RoleTeamEdit(
            role_id=role.role_id, team_uid=x) for x in existing_teams])
    elif teams_to_remove:
        batch.modify_role_teams(to_remove=[enterprise_management.RoleTeamEdit(
            role_id=role.role_id, team_uid=x.team_uid) for x in teams_to_remove])

batch.apply()
```

</details>

#### Enterprise Role Copy Command <a href="#enterprise-role-copy" id="enterprise-role-copy"></a>

Copy role with enforcement.

<details>

<summary>DotNet CLI</summary>

**Command:**

```bash
enterprise-role copy <source-role> --node <target-node> --new-role-name <new-name>
```

**Parameters**

| Parameter         | Required | Description                                                     |
| ----------------- | -------- | --------------------------------------------------------------- |
| `copy`            | Yes      | Command: must be `copy`.                                        |
| `<source-role>`   | Yes      | Role name or Role ID to copy from. Must match exactly one role. |
| `--node`          | Yes      | Target node name or Node ID where the new role will be created. |
| `--new-role-name` | Yes      | Display name for the new role.                                  |

**Examples:**

```bash
My Vault> enterprise-role copy "Test2 Role" --node "dev" --new-role-name "third dev 2"
Role "third dev 2" created with enforcements from "Test2 Role" (10 user(s), 2 team(s) copied).
```

</details>

<details>

<summary>DotNet SDK</summary>

Not Implemented

</details>

<details>

<summary>PowerCommander</summary>

**Command:**

```powershell
Copy-KeeperEnterpriseRole -SourceRole <role> -TargetNode <node> -NewRoleName <name> [-CopyUsers <bool>] [-CopyTeams <bool>] [-Force]
```

**Alias:** `kercopy`

**Parameters**

| Parameter     | Type    | Required | Default | Description                                                     |
| ------------- | ------- | -------- | ------- | --------------------------------------------------------------- |
| `SourceRole`  | Object  | Yes      | —       | Role name, Role ID, or `EnterpriseRole` object to copy from.    |
| `TargetNode`  | String  | Yes      | —       | Target node name or Node ID where the new role will be created. |
| `NewRoleName` | String  | Yes      | —       | Display name for the new role.                                  |
| `CopyUsers`   | Boolean | No       | `$true` | Copy users from the source role to the new role.                |
| `CopyTeams`   | Boolean | No       | `$true` | Copy teams from the source role to the new role.                |
| `Force`       | Switch  | No       | —       | Reload enterprise data before running.                          |

**Examples:**

```powershell
PowerCommander> Copy-KeeperEnterpriseRole -SourceRole "Test2 Role" -TargetNode "dev" -NewRoleName "second dev"
Role "second dev" created with enforcements from "Test2 Role" (10 user(s), 4 team(s) copied).
```

</details>

<details>

<summary>Python CLI</summary>

**Command:** `enterprise-role copy`

**Parameter**:

`role` - Role Name or ID (required)

**Flag:**

* `--node` - New role node name or ID (required)
* `--name`, `--displayname` - New role name (required)

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```python
from keepersdk.enterprise import batch_management,  enterprise_management

if isinstance(role_name, int):
    role = enterprise_data.roles.get_entity(role_name)
elif isinstance(role_name, str):
    if role_name.isnumeric():
        role = enterprise_data.roles.get_entity(int(role_name))
    if not role:
        role = [x for x in enterprise_data.roles.get_all_entities() if x.name.lower() == role_name.lower()]

node_id = 'node uid or name'
if isintance(node_id, int):
    node = enterprise_data.nodes.get_entity(node_id)
elif isintance(node_id, str):
    node = [node for node in enterprise_data.nodes.get_all_entities() if node.name.lower() == node_id]
    
role_name = 'name for role copy'

batch = batch_management.BatchManagement(loader=enterprise_loader, logger=enterprise_manager_logger)
role_id = enterprise_loader.get_enterprise_id()
role_to_add = enterprise_management.RoleEdit(role_id=role_id, node_id=node.node_id, name=role_name, visible_below=role.visible_below,
                                                new_user_inherit=role.new_user_inherit)
batch.modify_roles(to_add=[role_to_add])

enforcements = [enterprise_management.RoleEnforcementEdit(role_id=role_id, name=x.enforcement_type, value=x.value)
                for x in enterprise_data.role_enforcements.get_links_by_subject(role.role_id)]
batch.modify_role_enforcements(enforcements=enforcements)
batch.apply()
```

</details>

### Enterprise Role Team Management Command <a href="#enterprise-role-copy" id="enterprise-role-copy"></a>

This command assigns or unassigne a role to team

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role`

**Add Team to a Role:**

**Action:** `add-members`

**Flags:**

* `--help` : Display this help screen.
* `--version` : Display version information.
* `value pos. 0` : KSM command: "add-members"
* `value pos. 1` : Role Name or ID
* `value pos. 2` : User Email, User ID, Team Name, or Team UID (space-separated list)

**Example:**

```
My Vault > enterprise-role add-members "Administrator Role" "Engineering Team"
Adding members to role "Administrator Role"
Team: "Engineering Team" : Success
```

\
**Remove Team from a Role:**

**Action:** `remove-members`

**Flags:**

* `--help` : Display this help screen.
* `--version` : Display version information.
* `value pos. 0` : KSM command: "remove-members"
* `value pos. 1` : Role Name or ID
* `value pos. 2` : User Email, User ID, Team Name, or Team UID (space-separated list)

**Example:**

```
My Vault > enterprise-role remove-members "Administrator Role" "Engineering Team"
Removing members from role "Administrator Role"
Team: "Engineering Team" : Success
```

</details>

<details>

<summary>DotNet SDK</summary>

**Add Team to a Role:**

**Function:** `AddTeamToRole`

```csharp
Task AddTeamToRole(EnterpriseRole role, EnterpriseTeam team);
```

**Arguments:**

`role` - EnterpriseRole object representing the role to which the team will be added

`team` - EnterpriseTeam object representing the team to be added to the role

**Remove Team from a Role:**

**Function:** `RemoveTeamFromRole`

```csharp
Task RemoveTeamFromRole(EnterpriseRole role, EnterpriseTeam team);
```

**Arguments:**

`role` - EnterpriseRole object representing the role from which the team will be removed

`team` - EnterpriseTeam object representing the team to be removed from the role

</details>

<details>

<summary>PowerCommander</summary>

**Add Team to a Role:**

**Command:** `Grant-KeeperEnterpriseRoleToTeam`

**Aliases:** `kerta`

**Flags:**

* `-Role` : Role Name, ID, or EnterpriseRole object
* `-Team` : Team UID, Name, or EnterpriseTeam object

**Example:**

```
PS > Grant-KeeperEnterpriseRoleToTeam -Role "Administrator Role" -Team "Engineering Team"
Team "Engineering Team" added to role "Administrator Role"
```

**Remove Team from a Role:**

**Command:** `Revoke-KeeperEnterpriseRoleFromTeam`

**Aliases:** `kertr`

**Flags:**

* `-Role` : Role Name, ID, or EnterpriseRole object
* `-Team` : Team UID, Name, or EnterpriseTeam object

**Example:**

```
PS > Revoke-KeeperEnterpriseRoleFromTeam -Role "Administrator Role" -Team "Engineering Team"
Team "Engineering Team" removed from role "Administrator Role"
```

</details>

### Enterprise Role Managed Node Add Command

This command/function helps to add a managed node to a role.

<details>

<summary>DotNet CLI</summary>

im**Command:** `enterprise-role <action> roll_name --node=<node_name> --cascade OR er <action> roll_name --node=<node_name> --cascade`

**Parameter:**

`roll_name` - Role name or ID.

`node_name` - Node name or ID.

`cascade` - cascade includes it is true else false

**Examples:**

```sh
My Vault> enterprise-role managed-node-add "Test4" --node="Test1" --cascade
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>DotNet SDK</summary>

**Add Managed Node:**

**Function:** `RoleManagedNodeAdd`

**Usage:**

```csharp
public async Task RoleManagedNodeAdd(EnterpriseRole role, EnterpriseNode node, bool cascadeNodeManagement)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>role</code></td><td>EnterpriseRole object representing the role</td></tr><tr><td><code>node</code></td><td>EnterpriseNode object representing the node</td></tr><tr><td><code>cascade</code></td><td>do the privileges for this managed node apply to the children nodes - <code>true / false</code></td></tr></tbody></table>

**Example:**

{% code overflow="wrap" %}

```csharp
await EnterpriseManagementExamples.EnterpriseRoleExamples.RoleManagedNodeExample.RoleManagedNodeAdd(roleName: "Test2", nodeId: 70411693850884, cascadeNodeManagement: true);
```

{% endcode %}

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Add-KeeperEnterpriseRoleManagedNode`

**Flags:**

<table><thead><tr><th width="227.8876953125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>Role</code></td><td>Role Name or ID</td></tr><tr><td><code>Node</code></td><td>Node name or ID to add as a managed node</td></tr><tr><td><code>Cascade</code></td><td>Cascade node management to subnodes</td></tr></tbody></table>

**Example:**

```powershell
PS> Add-KeeperEnterpriseRoleManagedNode -Role PCRTest -Node PCTNode -Cascade 
Managed node "PCTNode" added to role "PCRTest" successfully.
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

### Enterprise Role Managed Node Update Command

This command/function helps to update a managed node to a role.

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role <action> roll_name --node=<node_name> --cascade OR er <action> roll_name --node=<node_name> --cascade`

**Parameter:**

`roll_name` - Role name or ID.

`node_name` - Node name or ID.

`cascade` - cascade includes it is true else false

**Examples:**

```sh
My Vault> enterprise-role managed-node-update "Test4" --node="Test1" --cascade
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>DotNet SDK</summary>

**Update Managed Node:**

**Function:** `RoleManagedNodeUpdate`

**Usage:**

```csharp
public async Task RoleManagedNodeUpdate(EnterpriseRole role, EnterpriseNode node, bool cascadeNodeManagement)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>role</code></td><td>EnterpriseRole object representing the role</td></tr><tr><td><code>node</code></td><td>EnterpriseNode object representing the node</td></tr><tr><td><code>cascade</code></td><td>do the privileges for this managed node apply to the children nodes - <code>true / false</code></td></tr></tbody></table>

**Example:**

{% code overflow="wrap" %}

```csharp
await EnterpriseManagementExamples.EnterpriseRoleExamples.RoleManagedNodeExample.RoleManagedNodeUpdate(roleName: "Test2", nodeId: 70411693850884, cascadeNodeManagement: true);
```

{% endcode %}

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>PowerCommander</summary>

**Command**:`Update-KeeperEnterpriseRoleManagedNode`

**Flags**:

<table><thead><tr><th width="227.8876953125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>Role</code></td><td>Role Name or ID</td></tr><tr><td><code>Node</code></td><td>Node name or ID to add as a managed node</td></tr><tr><td><code>Cascade</code></td><td>Cascade node management to subnodes</td></tr></tbody></table>

**Example**:

```powershell
PS> Update-KeeperEnterpriseRoleManagedNode -Role PCRTest -Node PCTNode 
Managed node "PCTNode" updated for role "PCRTest" successfully.
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

### Enterprise Role Managed Node Delete Command

This command/function helps to delete a managed node to a role.

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role <action> roll_name --node=<node_name> OR er <action> roll_name --node=<node_name>`

**Parameter:**

`roll_name` - Role name or ID.

`node_name` - Node name or ID.

**Examples:**

```sh
My Vault> enterprise-role managed-node-delete "Test4" --node="Test1"
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>DotNet SDK</summary>

**Remove Managed Node:**

**Function:** `RoleManagedNodeRemove`

**Usage:**

```csharp
public async Task RoleManagedNodeRemove(EnterpriseRole role, EnterpriseNode node)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>role</code></td><td>EnterpriseRole object representing the role</td></tr><tr><td><code>node</code></td><td>EnterpriseNode object representing the node</td></tr></tbody></table>

**Example:**

{% code overflow="wrap" %}

```csharp
await EnterpriseManagementExamples.EnterpriseRoleExamples.RoleManagedNodeExample.RoleManagedNodeRemove(roleName: "Test1", nodeId: 70411693850884);
```

{% endcode %}

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>PowerCommander</summary>

Command: `Remove-KeeperEnterpriseRoleManagedNode`

Flags:

<table><thead><tr><th width="227.8876953125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>Role</code></td><td>Role Name or ID</td></tr><tr><td><code>Node</code></td><td>Node name or ID to add as a managed node</td></tr></tbody></table>

**Example:**

```
PS> Remove-KeeperEnterpriseRoleManagedNode -Role PCRTest -Node PCTNode
Managed node PCTNode deleted from role PCRTest successfully.
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

### Enterprise Role Managed Node Privileges Add Command

This command/function helps to add a batch or individual privileges to managed node.

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role <action> roll_name --node=<node_name> --privileges=<privilege1, privilege2> OR er <action> roll_name --node=<node_name> --privileges=<privilege1, privilege2>`

**Parameter:**

`roll_name` - Role name or ID.

`node_name` - Node name or ID.

`privileges` - comma separated privileges inside a string.

**Examples:**

```sh
My Vault> er add-privileges "Test4" --node="Ananth-Test" --privileges="manage_nodes,manage_user,run_reports"
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>DotNet SDK</summary>

**Add Privileges to Managed Node:**

**Function:** `RoleManagedNodePrivilegeAddBatch`

**Usage:**

```csharp
public async Task<IList<KeeperApiResponse>> RoleManagedNodePrivilegeAddBatch(EnterpriseRole role, EnterpriseNode node, List<RoleManagedNodePrivilege> privileges)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>role</code></td><td>EnterpriseRole object representing the role</td></tr><tr><td><code>node</code></td><td>EnterpriseNode object representing the node</td></tr><tr><td><code>privileges</code></td><td><p>Adds a list of privileges of type</p><pre class="language-csharp" data-overflow="wrap"><code class="lang-csharp">List&#x3C;RoleManagedNodePrivilege>
</code></pre></td></tr></tbody></table>

**Example:**

{% code overflow="wrap" %}

```csharp
await EnterpriseManagementExamples.EnterpriseRoleExamples.RoleManagedNodeExample.RoleManagedNodePrivilegeAdd(roleName: "Test1", nodeId: 70411693850884, privileges: new List<RoleManagedNodePrivilege> { RoleManagedNodePrivilege.MANAGE_USER, RoleManagedNodePrivilege.TRANSFER_ACCOUNT });
```

{% endcode %}

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Add-KeeperEnterpriseRolePrivilege`

**Aliases:** `Add-KeeperRolePrivilege`

**Flags:**

<table><thead><tr><th width="170.6611328125">Flag</th><th>Description</th></tr></thead><tbody><tr><td><code>-Role</code></td><td>Role Name or ID (Mandatory, Position 0)</td></tr><tr><td><code>-Node</code></td><td>Node name or ID of the managed node (Mandatory, Position 1)</td></tr><tr><td><code>-Privilege</code></td><td>One or more privilege names to add. Valid values: MANAGE_NODES, MANAGE_USER, MANAGE_LICENCES, MANAGE_ROLES, MANAGE_TEAMS, TRANSFER_ACCOUNT, RUN_REPORTS, VIEW_TREE, MANAGE_BRIDGE, MANAGE_COMPANIES, SHARING_ADMINISTRATOR, APPROVE_DEVICE, MANAGE_RECORD_TYPES, RUN_COMPLIANCE_REPORTS (Mandatory, Position 2)</td></tr></tbody></table>

Example:

```powershell
PS> Add-KeeperEnterpriseRolePrivilege -Role PCRTest -Node PCTNode -Privilege MANAGE_NODES,MANAGE_USER,MANAGE_LICENCES,MANAGE_ROLES,MANAGE_TEAMS,TRANSFER_ACCOUNT,VIEW_TREE,MANAGE_COMPANIES,SHARING_ADMINISTRATOR,APPROVE_DEVICE,MANAGE_RECORD_TYPES,RUN_COMPLIANCE_REPORTS                             
Command: managed_node_privilege_add, Privilege: MANAGE_NODES, Result: success
Command: managed_node_privilege_add, Privilege: MANAGE_USER, Result: success
Command: managed_node_privilege_add, Privilege: MANAGE_LICENCES, Result: success
Command: managed_node_privilege_add, Privilege: MANAGE_ROLES, Result: success
Command: managed_node_privilege_add, Privilege: MANAGE_TEAMS, Result: success
Command: managed_node_privilege_add, Privilege: TRANSFER_ACCOUNT, Result: success
Command: managed_node_privilege_add, Privilege: VIEW_TREE, Result: fail, Code: access_denied, Message: You do not have the required privilege to perform this operation.
Command: managed_node_privilege_add, Privilege: MANAGE_COMPANIES, Result: fail, Code: access_denied, Message: You do not have the required privilege to perform this operation.
Command: managed_node_privilege_add, Privilege: SHARING_ADMINISTRATOR, Result: success
Command: managed_node_privilege_add, Privilege: APPROVE_DEVICE, Result: success
Command: managed_node_privilege_add, Privilege: MANAGE_RECORD_TYPES, Result: success
Command: managed_node_privilege_add, Privilege: RUN_COMPLIANCE_REPORTS, Result: success
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

### Enterprise Role Managed Node Privileges Remove Command

This command/function helps to remove a batch or individual privileges to managed node.

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role <action> roll_name --node=<node_name> --privileges=<privilege1, privilege2> OR er <action> roll_name --node=<node_name> --privileges=<privilege1, privilege2>`

**Parameter:**

`roll_name` - Role name or ID.

`node_name` - Node name or ID.

`privileges` - comma separated privileges inside a string.

**Examples:**

```sh
My Vault> er remove-privileges "Test4" --node="Ananth-Test" --privileges="manage_nodes,manage_user,run_reports"
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>DotNet SDK</summary>

**Remove Privileges of Managed Node:**

**Function:** `RoleManagedNodePrivilegeRemoveBatch`

**Usage:**

```csharp
public async Task<IList<KeeperApiResponse>> RoleManagedNodePrivilegeRemoveBatch(EnterpriseRole role, EnterpriseNode node, List<RoleManagedNodePrivilege> privileges)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>role</code></td><td>EnterpriseRole object representing the role</td></tr><tr><td><code>node</code></td><td>EnterpriseNode object representing the node</td></tr><tr><td><code>privileges</code></td><td><p>Removes a list of privileges of type</p><pre class="language-csharp"><code class="lang-csharp">List&#x3C;RoleManagedNodePrivilege>
</code></pre></td></tr></tbody></table>

**Example:**

{% code overflow="wrap" %}

```csharp
await EnterpriseManagementExamples.EnterpriseRoleExamples.RoleManagedNodeExample.RoleManagedNodePrivilegeRemove(roleName: "Test1", nodeId: 70411693850884, privileges: new List<RoleManagedNodePrivilege> { RoleManagedNodePrivilege.MANAGE_USER, RoleManagedNodePrivilege.TRANSFER_ACCOUNT });
```

{% endcode %}

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Remove-KeeperEnterpriseRolePrivilege`

**Aliases:** `Remove-KeeperRolePrivilege`

**Flags:**

<table><thead><tr><th width="185.0361328125">Flag</th><th>Description</th></tr></thead><tbody><tr><td><code>-Role</code></td><td>Role Name or ID (Mandatory, Position 0)</td></tr><tr><td><code>-Node</code></td><td>Node name or ID of the managed node (Mandatory, Position 1)</td></tr><tr><td><code>-Privilege</code></td><td>One or more privilege names to remove. Valid values: MANAGE_NODES, MANAGE_USER, MANAGE_LICENCES, MANAGE_ROLES, MANAGE_TEAMS, TRANSFER_ACCOUNT, RUN_REPORTS, VIEW_TREE, MANAGE_BRIDGE, MANAGE_COMPANIES, SHARING_ADMINISTRATOR, APPROVE_DEVICE, MANAGE_RECORD_TYPES, RUN_COMPLIANCE_REPORTS (Mandatory, Position 2)</td></tr></tbody></table>

**Example:**

```powershell
PS> Remove-KeeperEnterpriseRolePrivilege -Role PCRTest -Node PCTNode -Privilege MANAGE_NODES,MANAGE_USER,MANAGE_LICENCES,MANAGE_ROLES,MANAGE_TEAMS,TRANSFER_ACCOUNT,VIEW_TREE,MANAGE_COMPANIES,SHARING_ADMINISTRATOR,APPROVE_DEVICE,MANAGE_RECORD_TYPES,RUN_COMPLIANCE_REPORTS            
Command: managed_node_privilege_remove, Privilege: MANAGE_NODES, Result: success
Command: managed_node_privilege_remove, Privilege: MANAGE_USER, Result: success
Command: managed_node_privilege_remove, Privilege: MANAGE_LICENCES, Result: success
Command: managed_node_privilege_remove, Privilege: MANAGE_ROLES, Result: success
Command: managed_node_privilege_remove, Privilege: MANAGE_TEAMS, Result: success
Command: managed_node_privilege_remove, Privilege: TRANSFER_ACCOUNT, Result: success
Command: managed_node_privilege_remove, Privilege: VIEW_TREE, Result: fail, Code: doesnt_exist, Message: This object no longer exists.
Command: managed_node_privilege_remove, Privilege: MANAGE_COMPANIES, Result: fail, Code: doesnt_exist, Message: This object no longer exists.
Command: managed_node_privilege_remove, Privilege: SHARING_ADMINISTRATOR, Result: success
Command: managed_node_privilege_remove, Privilege: APPROVE_DEVICE, Result: success
Command: managed_node_privilege_remove, Privilege: MANAGE_RECORD_TYPES, Result: success
Command: managed_node_privilege_remove, Privilege: RUN_COMPLIANCE_REPORTS, Result: success
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

### Enterprise Role Add Enforcement Policies Command

This command/function helps to add a batch or individual enforcement policies to a role.

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role <action> role_name --enforcements="key1=value1; key2="value2"" OR er <action> role_name --enforcements="key1=value1; key2="value2""`

**Parameter:**

`roll_name` - Role name or ID.

`enforcements` - Give enforcements in the form of key and value pair inside the string.

**Examples:**

```sh
My Vault>  er add-enforcements "Test4" --enforcements="RESTRICT_FILE_UPLOAD=true; TWO_FACTOR_DURATION_WEB="0,12,24""
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>DotNet SDK</summary>

**Add Enforcement Policies to Role:**

**Function:** `RoleEnforcementAddBatch`

**Usage:**

```csharp
public async Task<IList<KeeperApiResponse>> RoleEnforcementAddBatch(EnterpriseRole role, IDictionary<RoleEnforcementPolicies, string> enforcements)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>role</code></td><td><code>EnterpriseRole</code> object representing the role</td></tr><tr><td><code>enforcements</code></td><td><p>Adds a batch of enforcement policies of type</p><p><code>Dictionary&#x3C;RoleEnforcementPolicies, string></code></p></td></tr></tbody></table>

**Example:**

{% code overflow="wrap" %}

```csharp
var enforcements = new Dictionary<RoleEnforcementPolicies, string> {
                    { RoleEnforcementPolicies.RESTRICT_FILE_UPLOAD, "true" },
                    { RoleEnforcementPolicies.RESTRICT_IP_ADDRESSES, "1.1.1.1-2.2.2.2" },
                    { RoleEnforcementPolicies.MASTER_PASSWORD_MINIMUM_LENGTH, "10"},
                    { RoleEnforcementPolicies.RESTRICT_DOMAIN_ACCESS, "192.168.1.100/app123"},
                    { RoleEnforcementPolicies.GENERATED_PASSWORD_COMPLEXITY, "google.com|12|4|1|3|1"},
                };
                await EnterpriseManagementExamples.EnterpriseRoleExamples.RoleManagedNodeExample.RoleEnforcementAdd(roleName: <roleName_here>, enforcements: enforcements);

```

{% endcode %}

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Add-KeeperEnterpriseRoleEnforcement`

**Aliases:** `Add-KeeperRoleEnforcement`

**Flags:**

| Flag           | Description                                                                                                                                                                                  |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-Role`        | Role Name or ID (Mandatory, Position 0)                                                                                                                                                      |
| `-Enforcement` | Enforcement(s) in KEY=value format. Can be semicolon or comma separated. Multiple enforcements can be provided as an array. Supports both `=` and `:` as separators. (Mandatory, Position 1) |

**Example:**

```
PS > Add-KeeperEnterpriseRoleEnforcement -Role PCRTest -Enforcement RESTRICT_FILE_UPLOAD=$true,RESTRICT_EXPORT=$true        
Command: role_enforcement_add, Enforcement: RESTRICT_FILE_UPLOAD=True, Result: success
Command: role_enforcement_add, Enforcement: RESTRICT_EXPORT=True, Result: success
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

### Enterprise Role Update Enforcement Policies Command

This command/function helps to update a batch or individual enforcement policies to a role.

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role <action> role_name --enforcements="key1=value1; key2=value2" OR er <action> role_name --enforcements="key1=value1; key2=value2"`

**Parameter:**

`roll_name` - Role name or ID.

`enforcements` - Give enforcements in the form of key and value pair inside the string.

**Examples:**

```sh
My Vault>  er update-enforcements "Test4" --enforcements="RESTRICT_FILE_UPLOAD=false; TWO_FACTOR_DURATION_WEB="0,12,24,30""
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>DotNet SDK</summary>

**Update Enforcement Policies to Role:**

**Function:** `RoleEnforcementUpdateBatch`

**Usage:**

```csharp
public async Task<IList<KeeperApiResponse>> RoleEnforcementUpdateBatch(EnterpriseRole role, IDictionary<RoleEnforcementPolicies, string> enforcements)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>role</code></td><td>EnterpriseRole object representing the role</td></tr><tr><td><code>enforcements</code></td><td><p>Adds a batch of enforcement policies of type</p><pre class="language-csharp"><code class="lang-csharp">Dictionary&#x3C;RoleEnforcementPolicies, string>
</code></pre></td></tr></tbody></table>

**Example:**

{% code overflow="wrap" %}

```csharp
var enforcements = new Dictionary<RoleEnforcementPolicies, string> {
                    { RoleEnforcementPolicies.RESTRICT_FILE_UPLOAD, "false" },
                    { RoleEnforcementPolicies.RESTRICT_IP_ADDRESSES, "2.2.2.2-3.3.3.3" },
                    { RoleEnforcementPolicies.MASTER_PASSWORD_MINIMUM_LENGTH, "20"},
                    { RoleEnforcementPolicies.RESTRICT_DOMAIN_ACCESS, "192.168.1.100/app345"},
                    { RoleEnforcementPolicies.GENERATED_PASSWORD_COMPLEXITY, "google.com|12|4|1|3|1"},
                };
await EnterpriseManagementExamples.EnterpriseRoleExamples.RoleManagedNodeExample.RoleEnforcementUpdate(roleName: <rollName_here>, enforcements: enforcements);
```

{% endcode %}

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Update-KeeperEnterpriseRoleEnforcement`

**Aliases:** `Update-KeeperRoleEnforcement`

**Flags:**

| Flag           | Description                                                                                                                                                                                  |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-Role`        | Role Name or ID (Mandatory, Position 0)                                                                                                                                                      |
| `-Enforcement` | Enforcement(s) in KEY=value format. Can be semicolon or comma separated. Multiple enforcements can be provided as an array. Supports both `=` and `:` as separators. (Mandatory, Position 1) |

**Example:**

```powershell
PS > Update-KeeperEnterpriseRoleEnforcement -Role PCRTest -Enforcement RESTRICT_FILE_UPLOAD=$true,RESTRICT_EXPORT=$true        
Command: role_enforcement_add, Enforcement: RESTRICT_FILE_UPLOAD=True, Result: success
Command: role_enforcement_add, Enforcement: RESTRICT_EXPORT=True, Result: success
```

Separator as Semicolon:

```powershell
PS > Update-KeeperEnterpriseRoleEnforcement -Role "AdminRole" -Enforcement "TWO_FACTOR_DURATION_WEB=7200;MASTER_PASSWORD_MINIMUM_LENGTH=16"
Command: role_enforcement_update, Enforcement: TWO_FACTOR_DURATION_WEB=7200, Result: success
Command: role_enforcement_update, Enforcement: MASTER_PASSWORD_MINIMUM_LENGTH=16, Result: success
```

Separator as Comma:

```powershell
PS > Update-KeeperEnterpriseRoleEnforcement -Role "AdminRole" -Enforcement "TWO_FACTOR_DURATION_WEB=7200,MASTER_PASSWORD_MINIMUM_LENGTH=16"
Command: role_enforcement_update, Enforcement: TWO_FACTOR_DURATION_WEB=7200, Result: success
Command: role_enforcement_update, Enforcement: MASTER_PASSWORD_MINIMUM_LENGTH=16, Result: success
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

### Enterprise Role Remove Enforcement Policies Command

This command/function helps to Remove a batch or individual enforcement policies to a role.

<details>

<summary>DotNet CLI</summary>

**Command:** `enterprise-role <action> role_name --enforcements="key1; key2; key3" OR er <action> role_name --enforcements="key1; key2; key3"`

**Parameter:**

`roll_name` - Role name or ID.

`enforcements` - comma separated enforcements inside a string.

**Examples:**

```sh
My Vault> er remove-enforcements "Test4" --enforcements="RESTRICT_FILE_UPLOAD; TWO_FACTOR_DURATION_WEB"
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>DotNet SDK</summary>

**Remove Enforcement Policies to Role:**

**Function:** `RoleEnforcementRemoveBatch`

**Usage:**

```csharp
public async Task<IList<KeeperApiResponse>> RoleEnforcementRemoveBatch(EnterpriseRole role, List<RoleEnforcementPolicies> enforcements)
```

**Parameters:**

<table><thead><tr><th width="227.4921875"></th><th>Description</th></tr></thead><tbody><tr><td><code>role</code></td><td>EnterpriseRole object representing the role</td></tr><tr><td><code>enforcements</code></td><td><p>Adds a batch of enforcement policies of type</p><pre class="language-csharp" data-overflow="wrap"><code class="lang-csharp">List&#x3C;RoleEnforcementPolicies>
</code></pre></td></tr></tbody></table>

**Example:**

{% code overflow="wrap" %}

```csharp
var enforcements = new List<RoleEnforcementPolicies> {
                    { RoleEnforcementPolicies.RESTRICT_FILE_UPLOAD},
                    { RoleEnforcementPolicies.RESTRICT_IP_ADDRESSES},
                    { RoleEnforcementPolicies.MASTER_PASSWORD_MINIMUM_LENGTH},
                    { RoleEnforcementPolicies.RESTRICT_DOMAIN_ACCESS},
                    { RoleEnforcementPolicies.GENERATED_PASSWORD_COMPLEXITY},
                };
await EnterpriseManagementExamples.EnterpriseRoleExamples.RoleManagedNodeExample.RoleEnforcementRemove(roleName: <rollName_here>, enforcement: enforcements);
```

{% endcode %}

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Remove-KeeperEnterpriseRoleEnforcement`

**Aliases:** `Remove-KeeperRoleEnforcement`

**Flags:**

| Flag           | Description                                                                                                                                                                                                    |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-Role`        | Role Name or ID (Mandatory, Position 0)                                                                                                                                                                        |
| `-Enforcement` | Enforcement key(s) to remove. Can be semicolon or comma separated. For remove operations, use KEY only (no value). If KEY=value format is provided, only the key portion will be used. (Mandatory, Position 1) |

**Example:**

```powershell
PS> Remove-KeeperEnterpriseRoleEnforcement -Role PCRTest -Enforcement RESTRICT_FILE_UPLOAD                      
Command: role_enforcement_remove, Enforcement: RESTRICT_FILE_UPLOAD, Result: success
```

Separator as Semicolon:

```powershell
PS > Remove-KeeperEnterpriseRoleEnforcement -Role "AdminRole" -Enforcement "TWO_FACTOR_DURATION_WEB;MASTER_PASSWORD_MINIMUM_LENGTH"
Command: role_enforcement_remove, Enforcement: TWO_FACTOR_DURATION_WEB, Result: success
Command: role_enforcement_remove, Enforcement: MASTER_PASSWORD_MINIMUM_LENGTH, Result: success
```

Separator as Comma:

```powershell
PS > Remove-KeeperEnterpriseRoleEnforcement -Role "AdminRole" -Enforcement "TWO_FACTOR_DURATION_WEB,MASTER_PASSWORD_MINIMUM_LENGTH"
Command: role_enforcement_remove, Enforcement: TWO_FACTOR_DURATION_WEB, Result: success
Command: role_enforcement_remove, Enforcement: MASTER_PASSWORD_MINIMUM_LENGTH, Result: success
```

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

**Reference:**

[Commander Reference](/keeperpam/commander-cli/command-reference/enterprise-management-commands.md#changing-role-enforcements-and-privileges)

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/enterprise-management-commands/enterprise-role-commands.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.