> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands/pam-gateway-commands.md).

# PAM Gateway Commands

Keeper Gateway runs rotation, discovery, connections, and tunneling from your managed environments. Deploy it on Docker, Linux, or Windows, on a host, VM, or cluster. One Gateway can reach both on-pre

### Gateway List command

Lists all gateways accessible by the Commander user. Gateways directly accessible by the user in their vault. Gateways registered under any managed node from the user's role.

<details>

<summary>DotNet CLI</summary>

**Command:** `pam-gateway list`

**Alias**: `pam-gw list` / `pam-gw l`

**Parameters**:

<table><thead><tr><th width="258">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--online</code>, <code>-o</code></td><td>Show only online gateways</td></tr><tr><td><code>--ignore-router</code></td><td>List registered gateways when router is unavailable</td></tr><tr><td><code>--verbose</code>, <code>-v</code></td><td>Verbose output (device, node, OS details, router host)</td></tr><tr><td><code>--format {table,json}</code></td><td>Output format. Default: <code>table</code></td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
My Vault>  pam-gateway list
KSM Application Name (UID)                                Gateway Name                                                  Gateway UID             Status   Gateway Version
--------------------------------------------------------  ------------------------------------------------------------  ----------------------  -------  ---------------
New-G1 Application (B17aoEfDlasq23U369OIvpbvw)               New-G1 Gateway                                            Y-2M-dszTK6Eu3oiCmF50g  OFFLINE                 
[APP NOT ACCESSIBLE OR DELETED] (vHARyY3cQnaxdfr45O0FcxRtA)  snowPAM Gateway                                           qsww2tPDSriaR1kJnl6TIA  OFFLINE                 
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
 public static async Task<IList<PamProto.PAMController>> GetAllGatewaysAsync(IAuthentication auth)
    {
      var response = (PamProto.PAMControllersResponse)await auth.ExecuteAuthRest(
        GetControllersEndpoint,
        null,
        typeof(PamProto.PAMControllersResponse));
      return response?.Controllers?.ToList() ?? new List<PamProto.PAMController>();
    }
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamGatewayList`

**Alias**: `pam-gateway-list` / `pam-gw-list`

**Parameters**:

<table><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Force</code>, <code>-f</code></td><td>List registered gateways when router is unavailable</td></tr><tr><td><code>-VerboseOutput</code></td><td>Verbose gateway and router details</td></tr><tr><td><code>-Format {table,json}</code></td><td>Output format. Default: <code>table</code></td></tr><tr><td><code>-Online</code>, <code>-o</code></td><td>Show only online gateways</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Get-KeeperPamGatewayList
Syncing PAM data...

KSM Application Name (UID)                               Gateway Name                                                                           Gateway UID
--------------------------                               ------------                                                                           -----------
New-G1 Application (B17aoEfDlasq23U369OIvpbvw)              New-G1 Gateway                                                                     AN1Y-2MzTK6E…
[APP NOT ACCESSIBLE OR DELETED] (vHRyY3cQnaxdfr45O0FcxRtA) snowPAM Gateway                                                                    AThw2tPDSria…
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Gateway Create command

This command is used to create a new Gateway

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-gateway new`

**Alias**: `pam-gw new` / `pam-gw n`

**Parameters**:

<table><thead><tr><th width="285">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--name</code>, <code>-n</code></td><td>Name of the Gateway</td></tr><tr><td><code>--application</code>, <code>-a</code></td><td>KSM Application name or UID</td></tr><tr><td><code>--token-expires-in-min</code>, <code>-e</code></td><td>One-time token expiration in minutes. Default: <code>60</code>. Maximum: <code>1440</code></td></tr><tr><td><code>--return-value</code>, <code>-r</code></td><td>Return only the token/config (for automation)</td></tr><tr><td><code>--config-init</code>, <code>-c</code> <code>{json,b64}</code></td><td>Initialize client config and return configuration string instead of raw token</td></tr></tbody></table>

**Examples**:

{% code overflow="wrap" %}

```csharp
My Vault> pam-gateway new --name "Prod Gateway" --application "<application-uid>"
The one time token has been created in application "<application-uid>".

The new Gateway named Prod Gateway will show up in the gateway list once it is initialized.

Following one time token will expire in 60 minutes:
-----------------------------------------------
US:<one-time-token>
-----------------------------------------------                                                    
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
public static async Task<string> CreateGatewayAsync(
      VaultOnline vault,
      string gatewayName,
      string ksmAppUid,
      int ottExpireInMinutes = DefaultOttExpireMinutes,
      string configInit = null)
    {
      if (vault == null)
      {
        throw new ArgumentNullException(nameof(vault));
      }

      if (string.IsNullOrWhiteSpace(gatewayName))
      {
        throw new ArgumentException("Gateway name is required", nameof(gatewayName));
      }

      if (string.IsNullOrWhiteSpace(ksmAppUid))
      {
        throw new ArgumentException("KSM application UID is required", nameof(ksmAppUid));
      }

      var result = await vault.AddSecretManagerClient(
        ksmAppUid,
        unlockIp: true,
        firstAccessExpireInMinutes: ottExpireInMinutes,
        name: gatewayName,
        appClientType: AppClientType.DiscoveryAndRotationController);

      var oneTimeToken = result?.Item2 ?? throw new InvalidOperationException("Gateway one-time token was not returned");
      if (string.IsNullOrWhiteSpace(configInit))
      {
        return oneTimeToken;
      }

      return await FormatGatewayConfigAsync(vault, oneTimeToken, configInit);
    }
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `New-KeeperPamGateway`

**Alias**: `pam-gateway-new` / `pam-gw-new`

**Parameters**:

<table><thead><tr><th width="264">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Name</code>, <code>-n</code></td><td>Gateway name</td></tr><tr><td><code>-Application</code>, <code>-a</code></td><td>KSM application UID or title</td></tr><tr><td><code>-TokenExpiresInMinutes</code>, <code>-e</code></td><td>One-time token expiration in minutes. Default: <code>60</code>. Maximum: <code>1440</code></td></tr><tr><td><code>-ConfigInit</code>, <code>-c</code> <code>{json,b64}</code></td><td>Initialize client config and return configuration string</td></tr><tr><td><code>-ReturnValue</code>, <code>-r</code></td><td>Return only the token/config string</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > New-KeeperPamGateway -Name "Prod Gateway" -Application "<application-uid>"
The one time token has been created in application "<application-uid>".

The new Gateway named Prod Gateway will show up in the gateway list once it is initialized.

Following one time token will expire in 60 minutes:
-----------------------------------------------
US:<one-time-token>
-----------------------------------------------
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Gateway Edit command

Allows updating the gateway's name or registered node. Equivalent actions can be performed in the Admin Console, under Secrets Manager → Gateways.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-gateway edit`

**Alias**: `pam-gw edit` / `pam-gw e`

**Parameters**:

<table><thead><tr><th width="268">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--gateway</code>, <code>-g</code></td><td>Gateway UID or name</td></tr><tr><td><code>--name</code>, <code>-n</code></td><td>New gateway name</td></tr><tr><td><code>--node-id</code>, <code>-i</code></td><td>Enterprise node ID or name</td></tr></tbody></table>

\* At least one of `--name` or `--node-id` is required.

**Examples**:

{% code overflow="wrap" %}

```csharp
My Vault> pam-gateway edit --gateway "Prod Gateway" --name "Production Gateway"
Gateway Production Gateway has been edited.
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
public static async Task EditGatewayAsync(
      IAuthentication auth,
      string gatewayUid,
      string gatewayName,
      long nodeId)
    {
      if (string.IsNullOrWhiteSpace(gatewayName))
      {
        throw new ArgumentException("Gateway name is required", nameof(gatewayName));
      }

      var request = new PamProto.PAMController
      {
        ControllerUid = ByteString.CopyFrom(DecodeGatewayUid(gatewayUid)),
        ControllerName = gatewayName,
        NodeId = nodeId,
      };

      await auth.ExecuteAuthRest(ModifyControllerEndpoint, request, null);
    }
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Set-KeeperPamGateway`

**Alias**: `pam-gateway-edit` / `pam-gw-edit`

**Parameters**:

<table><thead><tr><th width="231">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Gateway</code>, <code>-g</code></td><td>Gateway UID or name</td></tr><tr><td><code>-Name</code>, <code>-n</code></td><td>New gateway name</td></tr><tr><td><code>-NodeId</code>, <code>-i</code></td><td>Enterprise node ID or name</td></tr></tbody></table>

\* At least one of `-Name` or `-NodeId` is required.

**Examples**:

{% code expandable="true" %}

```powershell
PS > Set-KeeperPamGateway -Gateway "YZIMw2wQQashetyRmb_vj-4Ku_IA" -Name "Production Gateway"
Gateway Production Gateway has been edited.
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Gateway Remove command

Removes a gateway. The user executing this command must have admin rights on the gateway's parent application to perform this action.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-gateway remove`

**Alias**: `pam-gw remove` / `pam-gw rm` / `pam-gateway delete`

**Parameters**:

<table><thead><tr><th width="254">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--gateway</code>, <code>-g</code></td><td>Gateway UID or name</td></tr></tbody></table>

**Examples**:

{% code overflow="wrap" %}

```csharp
My Vault> pam-gateway remove --gateway "YZIMw2wQQnhautwr1-Rmb_vj-4Ku_IA"
Gateway Prod Gateway has been removed.
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
public static async Task RemoveGatewayAsync(IAuthentication auth, string gatewayUid)
    {
      var uidBytes = DecodeGatewayUid(gatewayUid);
      var request = new PamProto.PAMGenericUidRequest
      {
        Uid = ByteString.CopyFrom(uidBytes),
      };

      var response = (PamProto.PAMRemoveControllerResponse)await auth.ExecuteAuthRest(
        RemoveControllerEndpoint,
        request,
        typeof(PamProto.PAMRemoveControllerResponse));

      var controller = response?.Controllers?.FirstOrDefault(x =>
        x.ControllerUid != null && x.ControllerUid.ToByteArray().SequenceEqual(uidBytes));
      if (controller != null)
      {
        throw new KeeperApiException("remove_controller", controller.Message);
      }
}
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Remove-KeeperPamGateway`

**Alias**: `pam-gateway-remove` / `pam-gw-remove` / `pam-gateway-rm`

**Parameters**:

<table><thead><tr><th width="282">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Gateway</code>, <code>-g</code></td><td>Gateway UID or name</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Remove-KeeperPamGateway -Gateway "ssPtYpO4TmnjauetA4-iKLEsqPnVDEA"
Gateway Production Gateway has been removed.
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

### Gateway set-max-instances command

Defines maximum gateway pool instances. Used for [High Availability](https://docs.keeper.io/keeperpam/privileged-access-manager/getting-started/gateways/scaling-and-high-availability) integrations.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-gateway set-max-instances`

**Alias**: `pam-gw set-max-instances` / `pam-gw smi`

**Parameters**:

<table><thead><tr><th width="257">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--gateway</code>, <code>-g</code></td><td>Gateway UID or name</td></tr><tr><td><code>--max-instances</code>, <code>-m</code></td><td>Maximum number of gateway instances (must be >= 1)</td></tr></tbody></table>

**Examples**:

{% code overflow="wrap" %}

```csharp
My Vault>  pam-gateway set-max-instances --gateway "ygE7xsutS0haunet460-qZEIGZ-33qfQ" --max-instances 3
NG1 Gateway: max instance count set to 3
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

```csharp
public static async Task SetGatewayMaxInstancesAsync(IAuthentication auth, string gatewayUid, int maxInstanceCount)
    {
      if (maxInstanceCount < 1)
      {
        throw new ArgumentOutOfRangeException(nameof(maxInstanceCount), "Max instances must be at least 1");
      }

      var request = new PamProto.PAMSetMaxInstanceCountRequest
      {
        ControllerUid = ByteString.CopyFrom(DecodeGatewayUid(gatewayUid)),
        MaxInstanceCount = maxInstanceCount,
      };

      await auth.ExecuteAuthRest(SetMaxInstanceCountEndpoint, request, null);
}
```

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Set-KeeperPamGatewayMaxInstances`

**Alias**: `pam-gateway-set-max-instances` / `pam-gw-set-max-instances`

**Parameters**:

<table><thead><tr><th width="249">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Gateway</code>, <code>-g</code></td><td>Gateway UID or name</td></tr><tr><td><code>-MaxInstances</code>, <code>-m</code></td><td>Maximum number of gateway instances (must be >= 1)</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Set-KeeperPamGatewayMaxInstances -Gateway "ygE7xsutnahuyete-S0qZEIGZ-33qfQ" -MaxInstances 3
NG1 Gateway: max instance count set to 3
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands/pam-gateway-commands.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.