> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands/pam-workflow-commands.md).

# PAM Workflow Commands

Manage Just-In-Time (JIT) privileged access workflows for PAM resources. Workflows enforce approval-based access control with optional check-in/check-out, MFA verification and time-based access window

**Sub Commands**

* Configuration
  * [create](#pam-workflow-create)
  * [read](#pam-workflow-read)
  * [update](#pam-workflow-update)
  * [delete](#pam-workflow-delete)
  * [add-approver](#pam-workflow-add-approver)
  * [remove-approver](#pam-workflow-remove-approver)
* Approver Actions
  * [pending](#pam-workflow-pending)
  * [approve](#pam-workflow-approve)
  * [deny](#pam-workflow-deny)
* Requester Actions
  * [request](#pam-workflow-request)
  * [start](#pam-workflow-start)
  * [end](#pam-workflow-end)
* State Inspection
  * [state](#pam-workflow-state)
  * [my-access](#pam-workflow-my-access)

## PAM Workflow create

Create a workflow configuration for a PAM record. At least one approver must be added if approvals are required.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow create`

**Alias**: `pam-wf c`

**Parameters**:

<table data-search="false"><thead><tr><th width="290">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;record></code></td><td>Record UID or record name/title. Required.</td></tr><tr><td><code>-n, --approvals-needed &#x3C;int></code></td><td>Number of approvals required before access is granted. Default: <code>1</code>. Must be <code>>= 0</code>; <code>0</code> means no approval required.</td></tr><tr><td><code>--checkout</code></td><td>Flag. Enables check-in/check-out requirement (session must be explicitly checked out and later checked in).</td></tr><tr><td><code>--start-on-approval</code></td><td>Flag. Starts the access timer when the request is approved, instead of when the user checks out.</td></tr><tr><td><code>--require-reason</code></td><td>Flag. Requires the requester to supply a reason when requesting access.</td></tr><tr><td><code>--require-ticket</code></td><td>Flag. Requires the requester to supply an external ticket/reference number.</td></tr><tr><td><code>--require-mfa</code></td><td>Flag. Requires MFA verification before access is granted.</td></tr><tr><td><code>-d, --duration &#x3C;string></code></td><td>Access duration, e.g. <code>"2h"</code>, <code>"30m"</code>, <code>"1d"</code>. A bare number is treated as minutes. Default: <code>"1d"</code>.</td></tr><tr><td><code>--allowed-days &#x3C;string></code></td><td>Comma-separated allowed days, e.g. <code>"mon,tue,wed,thu,fri"</code>. Restricts when access can be used.</td></tr><tr><td><code>--time-range &#x3C;string></code></td><td>Same-day allowed time window in <code>HH:MM-HH:MM</code> format, e.g. <code>"09:00-17:00"</code>. End must be after start.</td></tr><tr><td><code>-u, --user &#x3C;email></code></td><td>Approver's user email. Can be passed multiple times for multiple approvers.</td></tr><tr><td><code>--approver &#x3C;email></code></td><td>Alias of <code>--user</code> for approver email (used interchangeably with <code>-u</code>/<code>--user</code>). Can be passed multiple times.</td></tr><tr><td><code>--format &#x3C;table|json></code></td><td>Output format. Default: <code>table</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
My Vault> pam-workflow create 0bEtV6M9nah78at9UicRzH2gSS7A --checkout --approvals-needed 1 --approver demo@example.com

Workflow created successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9nah78at9UicRzH2gSS7A )
Approvals needed: 1
Check-in/out: Yes
Duration: 1 day
Approvers: demo@example.com
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
    public static async Task CreateWorkflowConfigAsync(IAuthentication auth, WorkflowParameters parameters)
    {
      if (parameters == null)
      {
        throw new ArgumentNullException(nameof(parameters));
      }

      await PostToRouterAsync(auth, CreateWorkflowConfigPath, parameters);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `New-KeeperPamWorkflow`

**Alias**: `pam-workflow-new`

**Parameters**:

<table data-search="false"><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record, -r</code></td><td>PAM resource record UID or title</td></tr><tr><td><code>-ApprovalsNeeded, -n</code></td><td>Number of approvals required. Use <code>0</code> when no approvers are required. Default is <code>1</code>.</td></tr><tr><td><code>-Checkout, -co</code></td><td>Enables single-user check-in/check-out mode.</td></tr><tr><td><code>-StartOnApproval, -sa</code></td><td>Starts the access timer when approval completes instead of when the resource is checked out.</td></tr><tr><td><code>-RequireReason, -rr</code></td><td>Requires the requester to provide a reason.</td></tr><tr><td><code>-RequireTicket, -rt</code></td><td>Requires the requester to provide a ticket number.</td></tr><tr><td><code>-RequireMfa, -rm</code></td><td>Requires MFA verification.</td></tr><tr><td><code>-Duration, -d</code></td><td>Access duration, such as <code>30m</code>, <code>2h</code>, or <code>1d</code>. Default is <code>1d</code>.</td></tr><tr><td><code>-AllowedDays</code></td><td>Comma-separated days: <code>mon,tue,wed,thu,fri,sat,sun</code>.</td></tr><tr><td><code>-TimeRange</code></td><td>Same-day time range in <code>HH:MM-HH:MM</code> format.</td></tr><tr><td><code>-User, -u</code></td><td>User email to add as an approver.</td></tr><tr><td><code>-Approver</code></td><td>Compatibility option for approver email addresses. Can be repeated.</td></tr><tr><td><code>-Team, -t</code></td><td>Team UID or unique team name to add as an approver.</td></tr><tr><td><code>-Format</code></td><td>Output format: <code>table</code> or <code>json</code>.</td></tr><tr><td><code>-Help, -h</code></td><td>Displays command help.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > New-KeeperPamWorkflow `
    -Record "OZiyGTEO_KrBxG8mvMJNWw" `
    -Approver "approver@mail.com" `
    -ApprovalsNeeded 1 `
    -Checkout `
    -StartOnApproval `
    -RequireReason `
    -RequireTicket `
    -RequireMfa `
    -Duration "1d" `
    -AllowedDays "mon,tue,wed,thu,fri" `
    -TimeRange "09:00-17:00"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow update

Updates selected workflow settings while preserving values that were not supplied.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow update`

**Alias**: `pam-wf u`

**Parameters**:

<table data-search="false"><thead><tr><th>Param</th><th>Explanation</th></tr></thead><tbody><tr><td><code>&#x3C;record></code></td><td>Record UID or record name/title. Required. Workflow must already exist.</td></tr><tr><td><code>-n, --approvals-needed &#x3C;int></code></td><td>New number of approvals required. Must be <code>>= 0</code>.</td></tr><tr><td><code>--checkout &#x3C;true|false></code></td><td>Enable/disable check-in/check-out requirement.</td></tr><tr><td><code>--start-on-approval &#x3C;true|false></code></td><td>Toggle whether the access timer starts on approval vs. on check-out.</td></tr><tr><td><code>--require-reason &#x3C;true|false></code></td><td>Toggle requirement for a reason on access requests.</td></tr><tr><td><code>--require-ticket &#x3C;true|false></code></td><td>Toggle requirement for a ticket number on access requests.</td></tr><tr><td><code>--require-mfa &#x3C;true|false></code></td><td>Toggle requirement for MFA verification.</td></tr><tr><td><code>-d, --duration &#x3C;string></code></td><td>New access duration, e.g. <code>"2h"</code>, <code>"30m"</code>, <code>"1d"</code>.</td></tr><tr><td><code>--allowed-days &#x3C;string></code></td><td>New comma-separated allowed days.</td></tr><tr><td><code>--time-range &#x3C;string></code></td><td>New allowed time window (<code>HH:MM-HH:MM</code>).</td></tr><tr><td><code>--format &#x3C;table|json></code></td><td>Output format. Default: <code>table</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
My Vault> pam-workflow update 0bEtV6nah65142M9t9UicRzH2gSS7A --checkout --approvals-needed 2                                            

Workflow updated successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6nah65142M9t9UicRzH2gSS7A )
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
public static async Task UpdateWorkflowConfigAsync(IAuthentication auth, WorkflowParameters parameters)
    {
      if (parameters == null)
      {
        throw new ArgumentNullException(nameof(parameters));
      }

      await PostToRouterAsync(auth, UpdateWorkflowConfigPath, parameters);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Update-KeeperPamWorkflow`

**Alias**: `pam-workflow-edit`

**Parameters**:

<table data-search="false"><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record, -r</code></td><td>PAM resource record UID or title.</td></tr><tr><td><code>-ApprovalsNeeded, -n</code></td><td>Number of approvals required. Use <code>0</code> when no approvers are required.</td></tr><tr><td><code>-Checkout, -co</code></td><td>Enables or disables check-in/check-out mode.</td></tr><tr><td><code>-StartOnApproval, -sa</code></td><td>Controls whether the timer starts on approval.</td></tr><tr><td><code>-RequireReason, -rr</code></td><td>Enables or disables the reason requirement.</td></tr><tr><td><code>-RequireTicket, -rt</code></td><td>Enables or disables the ticket requirement.</td></tr><tr><td><code>-RequireMfa, -rm</code></td><td>Enables or disables MFA verification.</td></tr><tr><td><code>-Duration, -d</code></td><td>Access duration, such as <code>30m</code>, <code>2h</code>, or <code>1d</code>.</td></tr><tr><td><code>-AllowedDays</code></td><td>Comma-separated allowed days.</td></tr><tr><td><code>-TimeRange</code></td><td>Same-day time range in <code>HH:MM-HH:MM</code> format.</td></tr><tr><td><code>-Format</code></td><td>Output format: <code>table</code> or <code>json</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Update-KeeperPamWorkflow `
    -Record "OZiyGTrf_KrBxG8mvMJNWw" `
    -ApprovalsNeeded 2 `
    -Checkout $true `
    -StartOnApproval $true `
    -RequireReason $true `
    -RequireTicket $true `
    -RequireMfa $true `
    -Duration "2h"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow read

Reads the workflow configuration for a PAM resource record.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow read`

**Alias:** `pam-wf r`

**Parameters**:

| Param                    | Explanation                                |
| ------------------------ | ------------------------------------------ |
| `<record>`               | Record UID or record name/title. Required. |
| `--format <table\|json>` | Output format. Default: `table`.           |

**Example**:

{% code expandable="true" %}

```
My Vault> pam-workflow read 0bEtV6M9t9nahyt6a7wUicRzH2gSS7A--format json
{
 "record_uid": "0bEtV6M9t9nahyt6a7wUicRzH2gSS7A",
 "record_name": "Dotnet-Gateway-14thJuly - VNC Machine",
 "parameters": {
   "approvals_needed": 2,
   "checkout_needed": true,
   "start_access_on_approval": false,
   "require_reason": false,
   "require_ticket": false,
   "require_mfa": false,
   "access_duration": "1 day",
   "allowed_times": null
  },
 "approvers": [
   {
    "escalation": false,
    "type": "user",
    "email": "demo@example.com"
   }
  ]
}
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
    public static async Task<WorkflowConfig> ReadWorkflowConfigAsync(
      IAuthentication auth,
      string recordUid,
      string recordName = null)
    {
      var refMsg = CreateRecordRef(recordUid, recordName);
      var config = await auth.ExecuteRouter<WorkflowConfig>(ReadWorkflowConfigPath, refMsg);

      if (config == null
          || (config.Parameters == null && config.Approvers.Count == 0 && config.CreatedOn == 0))
      {
        return null;
      }

      return config;
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamWorkflow`

**Alias**: `pam-workflow-read`

**Parameters**:

<table><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record, -r</code></td><td>PAM resource record UID or title.</td></tr><tr><td><code>-Format</code></td><td>Output format: <code>table</code> or <code>json</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Get-KeeperPamWorkflow `
    -Record "OZirfTEO_KrBxG8mvMJNWw"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow delete

Deletes the workflow configuration from a PAM resource record.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow delete`

**Alias:** `pam-wf d`

**Parameters**:

| Param                    | Explanation                                |
| ------------------------ | ------------------------------------------ |
| `<record>`               | Record UID or record name/title. Required. |
| `--format <table\|json>` | Output format. Default: `table`.           |

**Example:**

{% code expandable="true" %}

```cs
My Vault> pam-wf d 0bEtV6M9nahu78791t9UicRzH2gSS7A

Workflow deleted successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9nahu78791t9UicRzH2gSS7A)

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
    public static async Task DeleteWorkflowConfigAsync(
      IAuthentication auth,
      string recordUid,
      string recordName = null)
    {
      var refMsg = CreateRecordRef(recordUid, recordName);
      await PostToRouterAsync(auth, DeleteWorkflowConfigPath, refMsg);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Remove-KeeperPamWorkflow`

**Alias**: `pam-workflow-delete`

**Parameters**:

<table><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record, -r</code></td><td>PAM resource record UID or title.</td></tr><tr><td><code>-Format</code></td><td>Output format: <code>table</code> or <code>json</code>.</td></tr><tr><td><code>-Confirm</code></td><td>Confirms deletion without an interactive prompt.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Remove-KeeperPamWorkflow `
    -Record "OZfgGTEO_KrBxG8mvMJNWw" `
    -Confirm:$false
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow add-approver

Adds users or teams as workflow approvers.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow add-approver`

**Alias:** `pam-wf aa`

**Parameters**:

<table data-search="false"><thead><tr><th>Param</th><th>Explanation</th></tr></thead><tbody><tr><td><code>&#x3C;record></code></td><td>Record UID or record name/title. Required.</td></tr><tr><td><code>-u, --user &#x3C;email></code></td><td>User email to add as an approver. Repeatable.</td></tr><tr><td><code>--approver &#x3C;email></code></td><td>Alias of <code>--user</code>. Repeatable.</td></tr><tr><td><code>-t, --team &#x3C;name|uid></code></td><td>Team name or team UID to add as an approver. Repeatable.</td></tr><tr><td><code>-e, --escalation</code></td><td>Flag. Marks the added approver(s) as escalation approvers (only invoked if the primary approval flow is escalated).</td></tr><tr><td><code>--escalation-after &#x3C;string></code></td><td>Time before this approver's escalation kicks in, e.g. <code>"30m"</code>, <code>"1h"</code>. <strong>Requires</strong> <code>--escalation</code>.</td></tr><tr><td><code>--format &#x3C;table|json></code></td><td>Output format. Default: <code>table</code>.</td></tr></tbody></table>

*(At least one of `--`*`user`*/`--`*`approver` *or `--`*`team` *is required.)*

**Example:**

{% code expandable="true" %}

```csharp
My Vault> pam-wf aa 0bEtV6M9tanhqy679UicRzH2gSS7A --approver demo@example.com                                           

Approvers added successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9tanhqy679UicRzH2gSS7A )
Added 1 approver(s)c#
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
    public static async Task AddWorkflowApproversAsync(
      IAuthentication auth,
      string recordUid,
      string recordName,
      IEnumerable<string> users = null,
      IEnumerable<string> teamUids = null,
      bool isEscalation = false,
      long escalationAfterMs = 0)
    {
      var config = BuildApproverConfig(recordUid, recordName, users, teamUids, isEscalation, escalationAfterMs);
      if (config.Approvers.Count == 0)
      {
        return;
      }

      await PostToRouterAsync(auth, AddWorkflowApproversPath, config);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Add-KeeperPamWorkflowApprover`

**Alias**: `pam-workflow-add-approver`

**Parameters**:

<table data-search="false"><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record, -r</code></td><td>PAM resource record UID or title.</td></tr><tr><td><code>-User, -u</code></td><td>User email to add as an approver. Can be repeated.</td></tr><tr><td><code>-Approver</code></td><td>Compatibility option for approver email addresses.</td></tr><tr><td><code>-Team, -t</code></td><td>Team UID or unique team name. Can be repeated.</td></tr><tr><td><code>-Escalation, -e</code></td><td>Marks the supplied approvers as escalation approvers.</td></tr><tr><td><code>-EscalationAfter</code></td><td>Escalation delay, such as <code>30m</code>, <code>2h</code>, or <code>1d</code>. Requires <code>-Escalation</code>.</td></tr><tr><td><code>-Format</code></td><td>Output format: <code>table</code> or <code>json</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Add-KeeperPamWorkflowApprover `
    -Record "OZiyGTEO_KffgG8mvMJNWw" `
    -User "approver@mail.com" `
    -Team "TestTeam"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow remove-approver

Removes users or teams from the workflow approver list.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow remove-approver`

**Alias:** `pam-wf ra`

**Parameters**:

| Param                    | Explanation                                                 |
| ------------------------ | ----------------------------------------------------------- |
| `<record>`               | Record UID or record name/title. Required.                  |
| `-u, --user <email>`     | User email to remove from approvers. Repeatable.            |
| `--approver <email>`     | Alias of `--user`. Repeatable.                              |
| `-t, --team <name\|uid>` | Team name or team UID to remove from approvers. Repeatable. |
| `--format <table\|json>` | Output format. Default: `table`.                            |

*(At least one of `--`*`user`*/`--`*`approver` *or `--`*`team` *is required.)*

**Example***:*

{% code expandable="true" %}

```csharp
My Vault> pam-wf ra 0bEtV6M9t9Unah87icRzH2gSS7A --approver demo@example.com

Approvers removed successfully

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9t9Unah87icRzH2gSS7A )
Removed 1 approver(s)
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

{% code expandable="true" %}

```csharp
public static async Task DeleteWorkflowApproversAsync(
      IAuthentication auth,
      string recordUid,
      string recordName,
      IEnumerable<string> users = null,
      IEnumerable<string> teamUids = null)
    {
      var config = BuildApproverConfig(recordUid, recordName, users, teamUids);
      if (config.Approvers.Count == 0)
      {
        return; 
      }

      await PostToRouterAsync(auth, DeleteWorkflowApproversPath, config);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Remove-KeeperPamWorkflowApprover`

**Alias**: `pam-workflow-remove-approver`

**Parameters**:

<table><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record, -r</code></td><td>PAM resource record UID or title.</td></tr><tr><td><code>-User, -u</code></td><td>User email to remove. Can be repeated.</td></tr><tr><td><code>-Approver</code></td><td>Compatibility option for approver email addresses.</td></tr><tr><td><code>-Team, -t</code></td><td>Team UID or unique team name to remove.</td></tr><tr><td><code>-Format</code></td><td>Output format: <code>table</code> or <code>json</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Remove-KeeperPamWorkflowApprover `
    -Record "OZiyGrfO_KrBxG8mvMJNWw" `
    -User "approver@mail.com"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow pending

List all pending workflow approval requests assigned to the current user.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow pending`

**Alias:** `pam-wf p`

**Parameters**:

| Param                    | Explanation                      |
| ------------------------ | -------------------------------- |
| `--format <table\|json>` | Output format. Default: `table`. |

**Example**:

{% code expandable="true" %}

```csharp
My Vault> pam-wf p  0bEtV6M9tnajaut9UicRzH2gSS7A                                            

Record Name                            Record UID              Flow UID                Requested By                            Reason  Ticket  Started  Expires  Duration
-------------------------------------  ----------------------  ----------------------  --------------------------------------  ------  ------  -------  -------  --------
Dotnet-Gateway-14thJuly - RDP Machine  0nahay67wd7s9NnujjRMyGA  v2UD_gpdAW_HJvEN57SH2g  demo1@example.com                                            

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
    public static async Task<ApprovalRequests> GetApprovalRequestsAsync(IAuthentication auth)
    {
      return await auth.ExecuteRouter<ApprovalRequests>(GetApprovalRequestsPath);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamWorkflowPending`

**Alias:** `pam-workflow-pending`

**Example:**

{% code expandable="true" %}

```powershell
PS > Get-KeeperPamWorkflowPending
PS > pam-workflow-pending
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow approve

Approve a pending workflow access request using the flow UID from the `pending` command.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow approve`

**Alias:** `pam-wf a`

**Parameters**:

| Param                    | Explanation                                                              |
| ------------------------ | ------------------------------------------------------------------------ |
| `<flow_uid>`             | The flow UID of the pending request (obtained from `pending`). Required. |
| `--format <table\|json>` | Output format. Default: `table`.                                         |

**Example**:

{% code expandable="true" %}

```c#
My Vault> pam-wf a v2UD_gpdAW_HJvEN5nahudyr7SH2g

Access request approved

Flow UID: v2UD_gpdAW_HJvEN5nahudyr7SH2g

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
   public static async Task ApproveWorkflowAccessAsync(IAuthentication auth, byte[] flowUidBytes)
    {
      await ApproveOrDenyWorkflowAccessAsync(auth, flowUidBytes, deny: false, denialReasonEncrypted: null);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Approve-KeeperPamWorkflowAccess`

**Alias:** `pam-workflow-approve`

**Parameters:**

| Param               | Explanation                                                                                                |
| ------------------- | ---------------------------------------------------------------------------------------------------------- |
| `-FlowUid <string>` | Flow UID of the pending request (obtained from `Get-KeeperPamWorkflowPending`). Mandatory, positional (0). |

**Examples:**

{% code expandable="true" %}

```ps
PS > Approve-KeeperPamWorkflowAccess -FlowUid "<flow-uid>"
PS > pam-workflow-approve "<flow-uid>"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow deny

Deny a pending workflow access request

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow deny`

**Alias:** `pam-wf dn`

**Parameters**:

| Param                    | Explanation                                                                                                                                      |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `<flow_uid>`             | The flow UID of the pending request. Required.                                                                                                   |
| `-r, --reason <string>`  | Optional reason for denial. Encrypted and shown to the requester if encryption succeeds; otherwise the denial proceeds without a visible reason. |
| `--format <table\|json>` | Output format. Default: `table`.                                                                                                                 |

**Example**:

{% code expandable="true" %}

```
My Vault> pam-wf dn <flow_UID>
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
    public static async Task DenyWorkflowAccessAsync(
      IAuthentication auth,
      byte[] flowUidBytes,
      ByteString denialReasonEncrypted = null)
    {
      await ApproveOrDenyWorkflowAccessAsync(auth, flowUidBytes, deny: true, denialReasonEncrypted);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Deny-KeeperPamWorkflowAccess`

**Alias:** `pam-workflow-deny`

**Parameters:**

| Param               | Explanation                                                                                                                                                    |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-FlowUid <string>` | Flow UID of the pending request. Mandatory, positional (0).                                                                                                    |
| `-Reason <string>`  | Optional reason shown to the requester. Encrypted for the requester; if encryption fails, a warning is shown and the denial proceeds without a visible reason. |

**Examples:**

{% code expandable="true" %}

```powershell
PS > Deny-KeeperPamWorkflowAccess -FlowUid "<flow-uid>" -Reason "Not authorized"
PS > pam-workflow-deny "<flow-uid>" -r "Not authorized"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow request

Request access to a workflow-protected PAM resource. Supports escalation of pending requests and cancellation of active requests.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow request`

**Alias:** `pam-wf rq`

**Parameters**:

| Param                    | Explanation                                                                                                                                              |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<record>`               | Record UID or record name/title. Required.                                                                                                               |
| `-r, --reason <string>`  | Reason for the access request. Cannot be combined with `--cancel`.                                                                                       |
| `--ticket <string>`      | External ticket/reference number tied to the request. Cannot be combined with `--cancel`.                                                                |
| `--escalate`             | Flag. Escalates an existing pending request to escalation approvers, instead of submitting a new request. Mutually exclusive with `--cancel`.            |
| `-c, --cancel`           | Flag. Cancels an active/pending workflow request for the record instead of submitting one. Mutually exclusive with `--escalate`, `--reason`, `--ticket`. |
| `--format <table\|json>` | Output format. Default: `table`.                                                                                                                         |

**Example**:

{% code expandable="true" %}

```csharp
My Vault> pam-workflow request 0bEtV6M9t9UnahticRzH2gSS7A

Access request sent

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9najaytt9UicRzH2gSS7A)

Approvers have been notified.
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
    public static async Task RequestWorkflowAccessAsync(
      IAuthentication auth,
      string recordUid,
      string recordName,
      byte[] recordKey,
      string reason = null,
      string ticket = null)
    {
      var needsEncrypted = !string.IsNullOrEmpty(reason) || !string.IsNullOrEmpty(ticket);
      if (needsEncrypted && (recordKey == null || recordKey.Length == 0))
      {
        throw new InvalidOperationException(
          "Record key not available — cannot encrypt reason/ticket. " +
          "You do not have sufficient access to this record to send encrypted parameters.");
      }

      var accessRequest = new WorkflowAccessRequest
      {
        Resource = CreateRecordRef(recordUid, recordName),
      };
      if (!string.IsNullOrEmpty(reason))
      {
        accessRequest.Reason = ByteString.CopyFrom(
          CryptoUtils.EncryptAesV2(System.Text.Encoding.UTF8.GetBytes(reason), recordKey));
      }

      if (!string.IsNullOrEmpty(ticket))
      {
        accessRequest.Ticket = ByteString.CopyFrom(
          CryptoUtils.EncryptAesV2(System.Text.Encoding.UTF8.GetBytes(ticket), recordKey));
      }

      await PostToRouterAsync(auth, RequestWorkflowAccessPath, accessRequest);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Request-KeeperPamWorkflowAccess`

**Alias:** `pam-workflow-request`

**Parameters:**

| Param              | Explanation                                                                                                                                  |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `-Record <string>` | PAM resource record UID or title. Mandatory, positional (0).                                                                                 |
| `-Reason <string>` | Reason for the access request. Cannot be combined with `-Cancel`.                                                                            |
| `-Ticket <string>` | External ticket/reference number. Cannot be combined with `-Cancel`.                                                                         |
| `-Escalate`        | Switch. Escalates an already-pending request to escalation approvers instead of submitting a new request. Cannot be combined with `-Cancel`. |
| `-Cancel`          | Switch. Cancels your own pending/active workflow request for the record. Cannot be combined with `-Escalate`, `-Reason`, or `-Ticket`.       |

**Notes:** Record owners and approvers are exempt from workflow restrictions and get an "exempt" message instead of submitting a request.

**Example:**

{% code expandable="true" %}

```ps
PS > Request-KeeperPamWorkflowAccess -Record "<uid>" -Reason "Need access to investigate an incident"
PS > Request-KeeperPamWorkflowAccess -Record "<uid>" -Escalate
PS > Request-KeeperPamWorkflowAccess -Record "<uid>" -Cancel
PS > pam-workflow-request "<uid>" -re "reason text"

```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow start

Start a workflow session (check-out). This is required before connecting to the resource when check-in/check-out is enabled.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow start`

**Alias:** `pam-wf s`

**Parameters**:

| Param                    | Explanation                                                                      |
| ------------------------ | -------------------------------------------------------------------------------- |
| `<record_or_flow_uid>`   | Record UID/name, or a flow UID if the record isn't resolvable locally. Required. |
| `--format <table\|json>` | Output format. Default: `table`.                                                 |

**Example**:

{% code expandable="true" %}

```csharp
My Vault> pam-wf start 0bEtV6M9t9UicRzH2gSS7A

Workflow started (checked out)

Record: Dotnet-Gateway-14thJuly - VNC Machine (0bEtV6M9t9UicRzH2gSS7A)
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
   public static async Task StartWorkflowAsync(IAuthentication auth, WorkflowState state)
    {
      if (state == null)
      {
        throw new ArgumentNullException(nameof(state));
      }

      await PostToRouterAsync(auth, StartWorkflowPath, state);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Start-KeeperPamWorkflow`

**Alias:** `pam-workflow-start`

**Parameters:**

| Param           | Explanation                                                                                                                  |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| `-Uid <string>` | Record UID, record title, or Flow UID. Mandatory, positional (0). If not resolvable as a record, it's treated as a flow UID. |

**Example**:

{% code expandable="true" %}

```ps
PS > Start-KeeperPamWorkflow -Uid "<record-or-flow-uid>"
PS > pam-workflow-start "<uid>"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow end

End a workflow session (check-in). Credentials may be rotated after check-in.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow end`

**Alias:** `pam-wf e`

**Parameters**:

| Param                    | Explanation                                                                                         |
| ------------------------ | --------------------------------------------------------------------------------------------------- |
| `<record_or_flow_uid>`   | Record UID/name, or flow UID. Required.                                                             |
| `-f, --force`            | Flag. Force checks-in another user's active session for this record/flow (administrative override). |
| `--format <table\|json>` | Output format. Default: `table`.                                                                    |

**Example**:

{% code expandable="true" %}

```csharp
My Vault> pam-wf end 0bEtV6M9t9UicRzH2gSS7A  
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
   public static async Task EndWorkflowAsync(IAuthentication auth, GraphSyncRef flowOrResourceRef)
    {
      if (flowOrResourceRef == null)
      {
        throw new ArgumentNullException(nameof(flowOrResourceRef));
      }

      await PostToRouterAsync(auth, EndWorkflowPath, flowOrResourceRef);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Stop-KeeperPamWorkflow`

**Alias:** `pam-workflow-end`

**Parameters:**

| Param           | Explanation                                                                                                                                            |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-Uid <string>` | Record UID, record title, or Flow UID. Mandatory, positional (0).                                                                                      |
| `-Force`        | Switch. Force checks-in another user's active session on behalf of another user when single-user checkout is enabled (requires approver/admin rights). |

**Example**:

{% code expandable="true" %}

```ps
PS > Stop-KeeperPamWorkflow -Uid "<record-or-flow-uid>"
PS > Stop-KeeperPamWorkflow -Uid "<uid>" -Force
PS > pam-workflow-end "<uid>"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow state

Returns the current workflow state for a PAM resource record.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow state`

**Alias:** `pam-wf st`

**Parameters**:

| Param                    | Explanation                                |
| ------------------------ | ------------------------------------------ |
| `<record>`               | Record UID or record name/title. Required. |
| `--format <table\|json>` | Output format. Default: `table`.           |

**Example**:

{% code expandable="true" %}

```csharp
My Vault> pam-wf state 0bEtV6M9t9UicRzH2gSS7A 

You are exempt from workflow restrictions on this record.
As a record owner or approver, you can access this resource directly.

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function**:

{% code expandable="true" %}

```csharp
    public static async Task<WorkflowState> GetWorkflowStateByRecordAsync(
      IAuthentication auth,
      string recordUid,
      string recordName = null)
    {
      var request = new WorkflowState
      {
        Resource = CreateRecordRef(recordUid, recordName),
      };
      return await auth.ExecuteRouter<WorkflowState>(GetWorkflowStatePath, request);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamWorkflowState`

**Alias**: `pam-workflow-state`

**Parameters**:

<table><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Record, -r</code></td><td>PAM resource record UID or title.</td></tr><tr><td><code>-Format</code></td><td>Output format: <code>table</code> or <code>json</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Get-KeeperPamWorkflowState `
    -Record "OZiyGTrf_KrBxG8mvMJNWw"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>

## PAM Workflow my-access

Lists the current user’s active workflow access states.

<details>

<summary>DotNet CLI</summary>

**Command**: `pam-workflow my-access`

**Alias:** `pam-wf ma`

**Parameters**:

| Param                    | Explanation                     |
| ------------------------ | ------------------------------- |
| `--format <table\|json>` | Output format. Default: `table` |

**Example**:

{% code expandable="true" %}

```csharp
My Vault> pam-wf my-access                   

No active workflows

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**

{% code expandable="true" %}

```csharp
    public static async Task<UserAccessState> GetUserAccessStateAsync(IAuthentication auth)
    {
      return await auth.ExecuteRouter<UserAccessState>(GetUserAccessStatePath);
    }
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command**: `Get-KeeperPamWorkflowMyAccess`

**Alias**: `pam-workflow-my-access`

**Parameters**:

<table><thead><tr><th width="287">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Format</code></td><td>Output format: <code>table</code> or <code>json</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```powershell
PS > Get-KeeperPamWorkflowMyAccess
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command: Coming Soon**

</details>

<details>

<summary>Python SDK</summary>

**Command: Coming Soon**

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/keeperpam-commands/pam-workflow-commands.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.