PAM Config Commands

View, create, edit and remove Keeper PAM Configurations. To learn more about PAM Configurations click here.

Config List command

Lists all configs accessible by the Commander user.

DotNet CLI

Command: pam-config list

Alias: pam-cfg list / pam-cfg l

Parameters:

Parameter	Description
<uid> (positional)	Configuration UID or name. When set, shows detail for one config
--verbose, -v	Include field details (and allowed settings in JSON detail)
--format {table,json}	Output format. Default: table

Examples:

My Vault> pam-config list
UID                     Config Name          Config Type              Shared Folder                         Gateway UID             Resource Record UIDs 
----------------------  -------------------  -----------------------  ------------------------------------  ----------------------  -------------------- 
r0GEhXL8fQabsgtY3f_cyy_--w  Gate1 Configuration  pamNetworkConfiguration  SF2 - Users (W8eQhS6wcrnahayDldSbgCb_h8A)  UorQhjoeTNmsuGA4rRzcNd-fQ
m-KTGmajats9e7INjefCVZsnxw  Test-CONFIG-14TH     pamNetworkConfiguration  SF2 - Users (W8ensgaQhS6wcrDldSbgCb_h8A)  UorQhjoeTNGlaiyA4rRzcNd-fQ

DotNet SDK

Function:

    public static Dictionary<string, TypedRecord> GetConfigurationRecords(VaultOnline vault)
    {
      if (vault == null)
      {
        return new Dictionary<string, TypedRecord>();
      }

      return vault.KeeperRecords
        .OfType<TypedRecord>()
        .Where(x => PamRecordTypes.Configuration.Contains(x.TypeName ?? ""))
        .ToDictionary(x => x.Uid, x => x);
    }

Power Commander

Command: Get-KeeperPamConfig Alias: pam-config-list / pam-cfg-list

Parameters:

Parameter	Description
Config / -c	Specific PAM Configuration UID or title
-VerboseOutput / -v	Verbose output
-Format	Output format {table,json} (default: table)

Examples:

PS > Get-KeeperPamConfig
Uid                    ConfigName      ConfigType               SharedFolder                    GatewayUid            ResourceRecordUids
---                    ----------      ----------               ------------                    ----------            ------------------
abc123...              Network Config  pamNetworkConfiguration  Pam Folder (sfUid...)           AN1Y-2MzTK6E...       recUid1, recUid2

PS > Get-KeeperPamConfig -Config "<CONFIG_UID>" -VerboseOutput
PS > pam-config-list -c "<CONFIG_UID>" -Format json

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Config Create command

Creates a PAM Configuration record, moves it into the shared folder, optionally binds a gateway, and applies tunneling/feature permissions.

DotNet CLI

Command: pam-config new

Alias: pam-cfg new / pam-cfg n

Parameters:

Parameter	Description
--environment	Config type: local, network, aws, azure, gcp, domain, oci, github
--title, -t	Title of the PAM Configuration
--shared-folder	Shared folder UID, name, or path (e.g. PAM/TestFolder)
--gateway, -g	Gateway UID or name
--schedule	Default rotation schedule CRON (e.g. 0 0 2 * * ?) or On-Demand
--port-mapping	Port mapping entry (repeatable)
--identity-provider	Identity Provider UID
--connections, -c	Connections permissions: on, off, default
--tunneling, -u	Tunneling permissions: on, off, default
--rotation, -r	Rotation permissions: on, off, default
--remote-browser-isolation	RBI permissions: on, off, default
--connections-recording	Session recording: on, off, default
--typescript-recording	TypeScript recording: on, off, default
--ai-threat-detection	AI threat detection: on, off, default
--ai-terminate-session-on-detection	AI session terminate on detection: on, off, default

Network (local / network):

Parameter	Description
--network-id	Network ID
--network-cidr	Network CIDR

AWS:

Parameter	Description
--aws-id	AWS ID
--access-key-id	Access key ID
--access-secret-key	Access secret key
--region-name	Region name(s) (repeatable)

Azure:

Parameter	Description
--azure-id	Azure ID
--client-id	Client ID
--client-secret	Client secret
--subscription-id	Subscription ID
--tenant-id	Tenant ID
--resource-group	Resource group(s) (repeatable)

GCP:

Parameter	Description
--gcp-id	GCP ID
--service-account-key	Service account key JSON
--google-admin-email	Google Workspace admin email
--gcp-region	GCP region name(s) (repeatable)

Domain:

Parameter	Description
--domain-id	Domain ID
--domain-hostname	Domain hostname
--domain-port	Domain port
--domain-use-ssl	Use SSL: true, false
--domain-scan-dc-cidr	Scan DC CIDR: true, false
--domain-network-cidr	Domain network CIDR
--domain-admin	Domain administrative credential (UID/title)
--domain-user-match	Domain user match filter
--force-domain-admin	Treat --domain-admin as a raw UID

OCI / GitHub:

Parameter	Description
--oci-id, --oci-admin-id, --oci-admin-public-key, --oci-admin-private-key, --oci-tenancy, --oci-region	OCI fields (environment not supported yet)

oci and github are recognized but not supported yet (coming soon).

Examples:

My Vault> pam-config new --environment local --title "Local Network" --shared-folder W8eQhamahsyS6wcrDldSbgCb_h8A --gateway UorQhjoeTNGAnhay4rRzcNd-fQ --network-id "corp-net" --network-cidr "10.0.0.0/24"
qNmCaiSQbd-ymgZpjauhamTuaYQ

DotNet SDK

Function:

public static TypedRecord CreateConfigurationRecord(VaultOnline vault, string recordType, string title)
    {
      if (vault == null)
      {
        throw new ArgumentNullException(nameof(vault));
      }

      if (string.IsNullOrWhiteSpace(recordType))
      {
        throw new ArgumentException("Record type is required", nameof(recordType));
      }

      if (string.IsNullOrWhiteSpace(title))
      {
        throw new ArgumentException("Title is required", nameof(title));
      }

      var record = new TypedRecord(recordType) { Title = title.Trim(), Version = 6 };
      vault.AdjustTypedRecord(record);
      return record;
    }

Power Commander

Command: New-KeeperPamConfig

Alias: pam-config-new

Parameters:

Parameter	Description
-Environment / -env	PAM Configuration Type {local,aws,azure,gcp,domain,oci,network,github}
-Title / -t	Title of the PAM Configuration
-SharedFolder / -sf / -shared-folder	Shared Folder UID, name, or path
-Gateway / -g	Gateway UID or Name
-DefaultSchedule / -sc / -schedule	Default Schedule (CRON syntax)
-PortMapping / -pm / -port-mapping	Port Mapping
-IdentityProvider / -idp	Identity Provider UID
-Connections / -c	on,off,default
-Tunneling / -u	on,off,default
-Rotation / -r	on,off,default
-RemoteBrowserIsolation / -rbi	on,off,default
-ConnectionsRecording / -cr	on,off,default
-TypescriptRecording / -tr	on,off,default
-AiThreatDetection / -ai-threat-detection	on,off,default
-ai-terminate-session-on-detection	on,off,default

network:

Parameter	Description
NetworkId / -network-id	Network ID
-NetworkCidr / -network-cidr	Network CIDR

aws:

Parameter	Description
-AwsId / -aws-id	AWS ID
-AccessKeyId / -access-key-id	Access Key Id
-AccessSecretKey / -access-secret-key	Access Secret Key
-RegionNames / -region-name	Region Names

azure:

Parameter	Description
-AzureId / -azure-id	Azure Id
-ClientId / -client-id	Client Id
-ClientSecret / -client-secret	Client Secret
-SubscriptionId / -subscription-id	Subscription Id
-TenantId / -tenant-id	Tenant Id
-ResourceGroups / -resource-group	Resource Group

gcp:

Parameter	Description
-GcpId / -gcp-id	GCP Id
-ServiceAccountKey / -service-account-key	Service Account Key (JSON)
-GoogleAdminEmail / -google-admin-email	Google Workspace Administrator Email
-GcpRegionNames / -gcp-region	GCP Region Names

domain:

Parameter	Description
-DomainId / -domain-id	Domain ID
-DomainHostname / -domain-hostname	Domain hostname
-DomainPort / -domain-port	Domain port
-DomainUseSsl / -domain-use-ssl	true,false
-DomainScanDcCidr / -domain-scan-dc-cidr	true,false
-DomainNetworkCidr / -domain-network-cidr	Domain Network CIDR
-domain-admin	Domain administrative credential
-DomainUserMatch / -domain-user-match	Domain user match
-ForceDomainAdmin / -force-domain-admin	Force domain admin assignment

Examples:

PS > New-KeeperPamConfig -Environment local -Title "Network Config" -SharedFolder "<SF_UID>" -Gateway "<GATEWAY_UID>" -NetworkId "net1" -NetworkCidr "10.0.0.0/24"
<CONFIG_UID>
PS > pam-config-new -env aws -t "AWS Config" -sf "<SF_UID>" -g "<GATEWAY_UID>" -aws-id "prod" -access-key-id "<KEY>" -access-secret-key "<SECRET>" -region-name "us-east-1"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Config Edit command

Updates an existing PAM Configuration. UID/name is required.

DotNet CLI

Command: pam-config edit

Alias: pam-cfg edit / pam-cfg e

Parameters:

Parameter	Description
<uid> (positional)	Configuration UID or name
--environment	Change config type (local, network, aws, azure, gcp, domain, …)
--title, -t	New title
--gateway, -g	Gateway UID or name
--shared-folder	Move config to shared folder UID/name/path
--schedule	Default rotation schedule CRON or On-Demand
--port-mapping	Port mapping entry (repeatable)
--identity-provider	Identity Provider UID
--remove-resource-record	Resource record UID to unlink (repeatable)
--connections, -c	Connections: on, off, default
--tunneling, -u	Tunneling: on, off, default
--rotation, -r	Rotation: on, off, default
--remote-browser-isolation	RBI: on, off, default
--connections-recording	Session recording: on, off, default
--typescript-recording	TypeScript recording: on, off, default
--ai-threat-detection	AI threat detection: on, off, default
--ai-terminate-session-on-detection	AI session terminate: on, off, default

Environment-specific fields are the same as pam-config new (network / AWS / Azure / GCP / domain / OCI).

Examples:

My Vault>  pam-config edit qNmCaaiSQbdanhs-ymgZpmTuaYQ --title "Local Network Updated"
PAM configuration "Local Network Updated" updated.

DotNet SDK

Function:

await ConfigUtils.AddConfigurationRecordAsync(vault, record);
await ConfigUtils.EnsureConfigurationNetworkGraphAsync(auth, record.Uid);

if (!string.IsNullOrEmpty(facade.ControllerUid))
{
    await ConfigUtils.SetConfigurationGatewayAsync(auth, record.Uid, facade.ControllerUid);
}

await vault.SyncDown();
await vault.MoveRecordToFolder(
    new RecordPath { RecordUid = record.Uid, FolderUid = sourceFolderUid },
    sharedFolderUid);

Power Commander

Command: Set-KeeperPamConfig

Alias: pam-config-edit / pam-cfg-edit

Parameters:

Parameter	Description
-Uid	PAM Configuration UID or title
-Environment / -env	PAM Configuration Type {local,aws,azure,gcp,domain,oci,network,github}
-Title / -t	Title of the PAM Configuration
-SharedFolder / -sf / -shared-folder	Shared Folder UID, name, or path
-Gateway / -g	Gateway UID or Name
-DefaultSchedule / -sc / -schedule	Default Schedule (CRON syntax)
-PortMapping / -pm / -port-mapping	Port Mapping
-RemoveResourceRecords / -rrr	Resource Record UID(s) to remove
-IdentityProvider / -idp	Identity Provider UID
-Connections / -c	on,off,default
-Tunneling / -u	on,off,default
-Rotation / -r	on,off,default
-RemoteBrowserIsolation / -rbi	on,off,default
-ConnectionsRecording / -cr	on,off,default
-TypescriptRecording / -tr	on,off,default
-AiThreatDetection / -ai-threat-detection	on,off,default
-ai-terminate-session-on-detection	on,off,default

Environment-specific parameters are the same as New-KeeperPamConfig (network/aws/azure/gcp/domain).

Examples:

PS > Set-KeeperPamConfig -Uid "<CONFIG_UID>" -Title "Updated Title"
PAM configuration "Updated Title" updated.
PS > pam-config-edit "<CONFIG_UID>" -g "<GATEWAY_UID>" -Rotation on
PS > Set-KeeperPamConfig -Uid "<CONFIG_UID>" -RemoveResourceRecords "<RESOURCE_UID>"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Config Remove command

This command is used to remove the configuration.

DotNet CLI

Command: pam-config remove

Alias: pam-cfg remove / pam-cfg rm / pam-cfg delete

Parameters:

Parameter	Description
<uid> (positional)	Configuration UID or name

Examples:

My Vault>  pam-config remove qNmCaiSQamshbd-ymgZpmajuymTuaYQ
PAM configuration "Local Network Updated" removed.

DotNet SDK

Function:

    public static async Task RemovePamConfigurationAsync(VaultOnline vault, string configurationUid)
    {
      if (vault == null)
      {
        throw new ArgumentNullException(nameof(vault));
      }

      if (string.IsNullOrEmpty(configurationUid))
      {
        throw new ArgumentException("Configuration UID is required", nameof(configurationUid));
      }

      await PamVaultHelpers.DeletePamConfigurationRecordAsync(vault, configurationUid);
    }

Power Commander

Command: Remove-KeeperPamConfig

Alias: pam-config-remove / pam-config-rm

Parameters:

Parameter	Description
-Uid	PAM Configuration UID or title (required)

Examples:

PS > Remove-KeeperPamConfig -Uid "<CONFIG_UID>"
PAM configuration "Network Config" removed.
PS > pam-config-remove "<CONFIG_UID>"
PS > pam-config-rm "<CONFIG_UID>"

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon