PAM Gateway Commands

Keeper Gateway runs rotation, discovery, connections, and tunneling from your managed environments. Deploy it on Docker, Linux, or Windows, on a host, VM, or cluster. One Gateway can reach both on-pre

Gateway List command

Lists all gateways accessible by the Commander user. Gateways directly accessible by the user in their vault. Gateways registered under any managed node from the user's role.

DotNet CLI

Command: pam-gateway list

Alias: pam-gw list / pam-gw l

Parameters:

Parameter	Description
--online, -o	Show only online gateways
--ignore-router	List registered gateways when router is unavailable
--verbose, -v	Verbose output (device, node, OS details, router host)
--format {table,json}	Output format. Default: table

Examples:

My Vault>  pam-gateway list
KSM Application Name (UID)                                Gateway Name                                                  Gateway UID             Status   Gateway Version
--------------------------------------------------------  ------------------------------------------------------------  ----------------------  -------  ---------------
New-G1 Application (B17aoEfDlasq23U369OIvpbvw)               New-G1 Gateway                                            Y-2M-dszTK6Eu3oiCmF50g  OFFLINE                 
[APP NOT ACCESSIBLE OR DELETED] (vHARyY3cQnaxdfr45O0FcxRtA)  snowPAM Gateway                                           qsww2tPDSriaR1kJnl6TIA  OFFLINE                 

DotNet SDK

Function:

 public static async Task<IList<PamProto.PAMController>> GetAllGatewaysAsync(IAuthentication auth)
    {
      var response = (PamProto.PAMControllersResponse)await auth.ExecuteAuthRest(
        GetControllersEndpoint,
        null,
        typeof(PamProto.PAMControllersResponse));
      return response?.Controllers?.ToList() ?? new List<PamProto.PAMController>();
    }

Power Commander

Command: Get-KeeperPamGatewayList

Alias: pam-gateway-list / pam-gw-list

Parameters:

Parameter	Description
-Force, -f	List registered gateways when router is unavailable
-VerboseOutput	Verbose gateway and router details
-Format {table,json}	Output format. Default: table
-Online, -o	Show only online gateways

Examples:

PS > Get-KeeperPamGatewayList
Syncing PAM data...

KSM Application Name (UID)                               Gateway Name                                                                           Gateway UID
--------------------------                               ------------                                                                           -----------
New-G1 Application (B17aoEfDlasq23U369OIvpbvw)              New-G1 Gateway                                                                     AN1Y-2MzTK6E…
[APP NOT ACCESSIBLE OR DELETED] (vHRyY3cQnaxdfr45O0FcxRtA) snowPAM Gateway                                                                    AThw2tPDSria…

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Gateway Create command

This command is used to create a new Gateway

DotNet CLI

Command: pam-gateway new

Alias: pam-gw new / pam-gw n

Parameters:

Parameter	Description
--name, -n	Name of the Gateway
--application, -a	KSM Application name or UID
--token-expires-in-min, -e	One-time token expiration in minutes. Default: 60. Maximum: 1440
--return-value, -r	Return only the token/config (for automation)
--config-init, -c {json,b64}	Initialize client config and return configuration string instead of raw token

Examples:

My Vault> pam-gateway new --name "Prod Gateway" --application "<application-uid>"
The one time token has been created in application "<application-uid>".

The new Gateway named Prod Gateway will show up in the gateway list once it is initialized.

Following one time token will expire in 60 minutes:
-----------------------------------------------
US:<one-time-token>
-----------------------------------------------                                                    

DotNet SDK

Function:

public static async Task<string> CreateGatewayAsync(
      VaultOnline vault,
      string gatewayName,
      string ksmAppUid,
      int ottExpireInMinutes = DefaultOttExpireMinutes,
      string configInit = null)
    {
      if (vault == null)
      {
        throw new ArgumentNullException(nameof(vault));
      }

      if (string.IsNullOrWhiteSpace(gatewayName))
      {
        throw new ArgumentException("Gateway name is required", nameof(gatewayName));
      }

      if (string.IsNullOrWhiteSpace(ksmAppUid))
      {
        throw new ArgumentException("KSM application UID is required", nameof(ksmAppUid));
      }

      var result = await vault.AddSecretManagerClient(
        ksmAppUid,
        unlockIp: true,
        firstAccessExpireInMinutes: ottExpireInMinutes,
        name: gatewayName,
        appClientType: AppClientType.DiscoveryAndRotationController);

      var oneTimeToken = result?.Item2 ?? throw new InvalidOperationException("Gateway one-time token was not returned");
      if (string.IsNullOrWhiteSpace(configInit))
      {
        return oneTimeToken;
      }

      return await FormatGatewayConfigAsync(vault, oneTimeToken, configInit);
    }

Power Commander

Command: New-KeeperPamGateway

Alias: pam-gateway-new / pam-gw-new

Parameters:

Parameter	Description
-Name, -n	Gateway name
-Application, -a	KSM application UID or title
-TokenExpiresInMinutes, -e	One-time token expiration in minutes. Default: 60. Maximum: 1440
-ConfigInit, -c {json,b64}	Initialize client config and return configuration string
-ReturnValue, -r	Return only the token/config string

Examples:

PS > New-KeeperPamGateway -Name "Prod Gateway" -Application "<application-uid>"
The one time token has been created in application "<application-uid>".

The new Gateway named Prod Gateway will show up in the gateway list once it is initialized.

Following one time token will expire in 60 minutes:
-----------------------------------------------
US:<one-time-token>
-----------------------------------------------

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Gateway Edit command

Allows updating the gateway's name or registered node. Equivalent actions can be performed in the Admin Console, under Secrets Manager → Gateways.

DotNet CLI

Command: pam-gateway edit

Alias: pam-gw edit / pam-gw e

Parameters:

Parameter	Description
--gateway, -g	Gateway UID or name
--name, -n	New gateway name
--node-id, -i	Enterprise node ID or name

* At least one of --name or --node-id is required.

Examples:

My Vault> pam-gateway edit --gateway "Prod Gateway" --name "Production Gateway"
Gateway Production Gateway has been edited.

DotNet SDK

Function:

public static async Task EditGatewayAsync(
      IAuthentication auth,
      string gatewayUid,
      string gatewayName,
      long nodeId)
    {
      if (string.IsNullOrWhiteSpace(gatewayName))
      {
        throw new ArgumentException("Gateway name is required", nameof(gatewayName));
      }

      var request = new PamProto.PAMController
      {
        ControllerUid = ByteString.CopyFrom(DecodeGatewayUid(gatewayUid)),
        ControllerName = gatewayName,
        NodeId = nodeId,
      };

      await auth.ExecuteAuthRest(ModifyControllerEndpoint, request, null);
    }

Power Commander

Command: Set-KeeperPamGateway

Alias: pam-gateway-edit / pam-gw-edit

Parameters:

Parameter	Description
-Gateway, -g	Gateway UID or name
-Name, -n	New gateway name
-NodeId, -i	Enterprise node ID or name

* At least one of -Name or -NodeId is required.

Examples:

PS > Set-KeeperPamGateway -Gateway "YZIMw2wQQashetyRmb_vj-4Ku_IA" -Name "Production Gateway"
Gateway Production Gateway has been edited.

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Gateway Remove command

Removes a gateway. The user executing this command must have admin rights on the gateway's parent application to perform this action.

DotNet CLI

Command: pam-gateway remove

Alias: pam-gw remove / pam-gw rm / pam-gateway delete

Parameters:

Parameter	Description
--gateway, -g	Gateway UID or name

Examples:

My Vault> pam-gateway remove --gateway "YZIMw2wQQnhautwr1-Rmb_vj-4Ku_IA"
Gateway Prod Gateway has been removed.

DotNet SDK

Function:

public static async Task RemoveGatewayAsync(IAuthentication auth, string gatewayUid)
    {
      var uidBytes = DecodeGatewayUid(gatewayUid);
      var request = new PamProto.PAMGenericUidRequest
      {
        Uid = ByteString.CopyFrom(uidBytes),
      };

      var response = (PamProto.PAMRemoveControllerResponse)await auth.ExecuteAuthRest(
        RemoveControllerEndpoint,
        request,
        typeof(PamProto.PAMRemoveControllerResponse));

      var controller = response?.Controllers?.FirstOrDefault(x =>
        x.ControllerUid != null && x.ControllerUid.ToByteArray().SequenceEqual(uidBytes));
      if (controller != null)
      {
        throw new KeeperApiException("remove_controller", controller.Message);
      }
}

Power Commander

Command: Remove-KeeperPamGateway

Alias: pam-gateway-remove / pam-gw-remove / pam-gateway-rm

Parameters:

Parameter	Description
-Gateway, -g	Gateway UID or name

Examples:

PS > Remove-KeeperPamGateway -Gateway "ssPtYpO4TmnjauetA4-iKLEsqPnVDEA"
Gateway Production Gateway has been removed.

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon

Gateway set-max-instances command

Defines maximum gateway pool instances. Used for High Availability integrations.

DotNet CLI

Command: pam-gateway set-max-instances

Alias: pam-gw set-max-instances / pam-gw smi

Parameters:

Parameter	Description
--gateway, -g	Gateway UID or name
--max-instances, -m	Maximum number of gateway instances (must be >= 1)

Examples:

My Vault>  pam-gateway set-max-instances --gateway "ygE7xsutS0haunet460-qZEIGZ-33qfQ" --max-instances 3
NG1 Gateway: max instance count set to 3

DotNet SDK

Function:

public static async Task SetGatewayMaxInstancesAsync(IAuthentication auth, string gatewayUid, int maxInstanceCount)
    {
      if (maxInstanceCount < 1)
      {
        throw new ArgumentOutOfRangeException(nameof(maxInstanceCount), "Max instances must be at least 1");
      }

      var request = new PamProto.PAMSetMaxInstanceCountRequest
      {
        ControllerUid = ByteString.CopyFrom(DecodeGatewayUid(gatewayUid)),
        MaxInstanceCount = maxInstanceCount,
      };

      await auth.ExecuteAuthRest(SetMaxInstanceCountEndpoint, request, null);
}

Power Commander

Command: Set-KeeperPamGatewayMaxInstances

Alias: pam-gateway-set-max-instances / pam-gw-set-max-instances

Parameters:

Parameter	Description
-Gateway, -g	Gateway UID or name
-MaxInstances, -m	Maximum number of gateway instances (must be >= 1)

Examples:

PS > Set-KeeperPamGatewayMaxInstances -Gateway "ygE7xsutnahuyete-S0qZEIGZ-33qfQ" -MaxInstances 3
NG1 Gateway: max instance count set to 3

Python CLI

Command: Coming Soon

Python SDK

Command: Coming Soon