> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands/pam-action-commands.md).

# PAM Action Commands

Discovery, rotation and service account management of PAM Resources

### Action Rotate command

Triggers an on-demand credential rotation through the Keeper Gateway for a single vault record, or for all `pamUser` records in shared folders matching a UID or title pattern. This schedules a gateway job; it does not configure rotation schedules (use `pam-rotation edit` for that). Requires the enterprise enforcement that allows credential rotation.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-action rotate`

**Alias**: `pam-act rotate` / `pam-act r`

**Parameters**:

<table><thead><tr><th width="264">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--record-uid</code>, <code>-r</code></td><td>Record UID to rotate</td></tr><tr><td><code>--folder</code>, <code>-f</code></td><td>Shared folder UID or title regex pattern; rotates all <code>pamUser</code> records in matching folders</td></tr><tr><td><code>--dry-run</code>, <code>-n</code></td><td>Folder mode only: report how many folders/records would rotate, without scheduling jobs</td></tr></tbody></table>

\*Either `--record-uid` or `--folder` is required.

**Examples**:

{% code expandable="true" %}

```csharp
My Vault> pam-action rotate --record-uid <RECORD_UID>
My Vault> pam-action rotate -r <RECORD_UID>
My Vault> pam-action rotate --folder <SHARED_FOLDER_UID>
My Vault> pam-action rotate -f "Prod.*" --dry-run
My Vault> pam-act r -r <RECORD_UID>
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
using KeeperSecurity.Plugins.PAM;

// Single-record on-demand rotate
var rotateResult = await ActionUtils.RotateAsync(vault, new PamRotateOptions
{
    RecordUid = "<RECORD_UID>"
});

if (rotateResult.RecordResult?.IsScheduled == true)
{
    var jobId = rotateResult.RecordResult.ConversationId;
    var gatewayUid = rotateResult.RecordResult.GatewayUid;
    Console.WriteLine($"Scheduled action id: {jobId}");

    var job = await ActionUtils.GetJobInfoAsync(vault.Auth, jobId, gatewayUid);
    if (job.JobInfo != null)
    {
        Console.WriteLine($"Status: {job.JobInfo.Status}");
        Console.WriteLine($"Duration: {job.JobInfo.Duration}");
        Console.WriteLine($"Message: {job.JobInfo.ResponseMessage}");
    }
}

// Folder-mode dry run (pamUser records only)
var folderPreview = await ActionUtils.RotateAsync(vault, new PamRotateOptions
{
    Folder = "<SHARED_FOLDER_UID_OR_TITLE_PATTERN>",
    DryRun = true
});
Console.WriteLine(
    $"Folders: {folderPreview.FolderResult.FolderCount}, Records: {folderPreview.FolderResult.RecordCount}");

// Folder-mode live rotate
var folderLive = await ActionUtils.RotateAsync(vault, new PamRotateOptions
{
    Folder = "<SHARED_FOLDER_UID_OR_TITLE_PATTERN>",
    DryRun = false
});
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: Invoke-KeeperPamActionRotate

**Alias:** `pam-action-rotate`\
**Parameters:**

<table><thead><tr><th width="264">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-RecordUid,</code> <code>-r</code></td><td>PAM user record UID to rotate</td></tr><tr><td><code>-Folder, -f</code></td><td>Shared folder UID or title pattern (rotates pamUser records)</td></tr><tr><td><code>-DryRun,</code> <code>-n</code></td><td>Folder only — list selection without rotating</td></tr></tbody></table>

**Examples:**

```powershell
PS > Invoke-KeeperPamActionRotate -RecordUid "32gU_yrxxWdOCqkiWW4gRw"
Scheduled action id: <conversation-id>
The action has been scheduled, use command 'Get-KeeperPamActionJobInfo -JobId "<conversation-id>"' to get status of the scheduled action

PS > Invoke-KeeperPamActionRotate -Folder "tVjvRq_gbPBRF5kO3noYGw" -DryRun
Selected for rotation - folders: 1, records: 7

PS > pam-action-rotate -r "32gU_yrxxWdOCqkiWW4gRw"

```

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Action Job-info command

Queries the status of a previously scheduled PAM gateway job (for example after `pam-action rotate`). Quote job IDs that contain `/`. When more than one gateway is running, pass `--gateway`.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-action job-info`

**Alias**: `pam-act job-info` / `pam-act ji`

**Parameters**:

<table><thead><tr><th width="275">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;job_id></code> (positional)</td><td>Conversation / job id returned by rotate (or another gateway action)</td></tr><tr><td><code>--gateway</code>, <code>-g</code></td><td>Gateway UID when multiple gateways are available</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
My Vault> pam-action job-info "<JOB_ID>"
My Vault> pam-action job-info "<JOB_ID>" --gateway <GATEWAY_UID>
My Vault> pam-act ji "<JOB_ID>" -g <GATEWAY_UID>
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
    public static Dictionary<string, TypedRecord> GetConfigurationRecords(VaultOnline vault)
    {
      if (vault == null)
      {
        return new Dictionary<string, TypedRecord>();
      }

      return vault.KeeperRecords
        .OfType<TypedRecord>()
        .Where(x => PamRecordTypes.Configuration.Contains(x.TypeName ?? ""))
        .ToDictionary(x => x.Uid, x => x);
    }
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamActionJobInfo`

**Alias**: `pam-action-job-info`

**Parameters**:

<table><thead><tr><th width="275">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-JobId, -j</code></td><td>Scheduled action / conversation id (quote if it contains <code>/</code>)</td></tr><tr><td><code>-Gateway, -g</code></td><td>Gateway UID when multiple gateways exist</td></tr></tbody></table>

**Examples:**

```powershell
PS > Get-KeeperPamActionJobInfo -JobId "<conversation-id>"
Job id to check [<conversation-id>]
Execution Details
-------------------------
        Status              : finished
        Duration            : 00:00:12
        Response Message    : ...

PS > pam-action-job-info -j "<conversation-id>" -Gateway "9uUuUYaQThmhKSjQ8foCdw"


```

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands/pam-action-commands.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.