Nested Shared Folder Commands

SDK commands related to Nested Shared Folders functionality

With the introduction of Nested Shared Folders with Role-Based Folder Permissions, we’ve rebuilt the vault’s folder, sharing and permissions model from the ground up, delivering a more flexible and scalable experience for every user and team.

List command

List Nested shared folders and records cached locally. By default, both folders and records are shown. Use the --folders or --records flag to filter, and --format to control the output style.

DotNet CLI

Command: nsf-list

Parameters:

Parameter	Description
--folders	Show only folders
--records	Show only records
--format	Output format: table (default), csv, or json
--output	Path to output file. Ignored for table format

Examples:

My Vault> nsf-list

=== Keeper NSF Summary ===
  Folders: 1
  Records: 1

--- Folders ---
FolderUid               Name                   ParentUid               Subfolders  Records
----------------------  ---------------------  ----------------------  ----------  -------
F1lX8kCMx--W0ndcmeaX6w  Child-folder           eRcyzWqxQhMlieLuRq29nA  0           0      

--- Records ---
RecordUid               Name          Type   Revision  Version  Shared  FileSize  ThumbnailSize
----------------------  ------------  -----  --------  -------  ------  --------  -------------
LTVdDDvuSKLmWYiNbKjrYg  Notes1234     login  5017162   3        False   0         0

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();
Console.WriteLine($"Folders: {vault.KeeperNSFFolderCount}, Records: {vault.KeeperNSFRecordCount}");
foreach (var folder in vault.KeeperNSFFolderNodes)
{
    Console.WriteLine($"[Folder] {folder.FolderUid}  {folder.Name}");
}
foreach (var record in vault.KeeperNSFRecordEntries)
{
    Console.WriteLine($"[Record] {record.RecordUid}  {record.Name}  v{record.Version}");
}
if (vault.TryGetKeeperNSFFolder("folderUid1", out var f))
{
    Console.WriteLine($"Found folder: {f.Name}");
}
if (vault.TryResolveKeeperNSFRecord("MyLogin", out var r))
{
    Console.WriteLine($"Resolved record: {r.RecordUid}");
}

Power Commander

Command: Get-KeeperNSFList

Alias: nsf-list

Parameters:

Parameter	Description
-Folders	Show only folders
-Records	Show only records
-Format	Output format: table (default), csv, or json
-Output	Path to output file. Ignored for table format

Examples:

PS > Get-KeeperNSFList
PS > nsf-list -Folders
PS > nsf-list -Records -Format json -Output nsf-records.json
PS > nsf-list -Format csv -Output nsf.csv

Python CLI

Command: nsf-list

Parameters: --folders Show only folders --records Show only records --format {table,csv,json} --output OUTPUT Path to output file (ignored for table format)

Example:

My Vault> nsf-list
  #  Item type    UID                     Title                                      Type                     Description
---  -----------  ----------------------  -----------------------------------------  -----------------------  -------------
  1  Folder       <folder_uid>            Folder Title
  2  Record       <record_uid>            new test nsf                               login

Python SDK

Function : list_nsf_items

    INCLUDE_FOLDERS = True
    INCLUDE_RECORDS = True

    rows = nsf_management.list_nsf_items(
        vault,
        include_folders=INCLUDE_FOLDERS,
        include_records=INCLUDE_RECORDS,
    )
    if not rows:
        print("No NSF folders or records found. Run sync-down first.")
        return
    print(f"{'Type':<8} {'UID':<28} {'Title':<30} {'Record Type':<15} {'Location'}")
    print("-" * 100)
    for row in rows:
        print(
            f"{row.item_type:<8} {row.uid:<28} {row.title[:28]:<30} "
            f"{(row.record_type or '')[:15]:<15}"
        )
    print(f"\nTotal items: {len(rows)}")

Get command

Retrieves detailed information about a specific Keeper NSF record or folder by UID or name. Shows metadata, user permissions, and share administrators.

DotNet CLI

Command: nsf-get

Parameters:

Parameter	Description
--uid	Record or folder UID to look up
--name	Record or folder name to search for (case-insensitive; falls back to partial match)
--format	Output format: detail (default) or json

Examples:

MyVault> nsf-get --uid GS3J1s9ARg1-P5LRQOeRTA

                  UID: GS3J1s9ARg1-P5LRQOeRTA
                 Type: login
                Title: Record-Share
             Password: ********
           Folder UID: AAAAAAAAAAAAAAAAAALjjA
          Folder Name: (unknown)
          Folder Path:
          
          User Permissions:

                 User: [e-mail]
                Owner: Yes
            Shareable: Yes
            Read-Only: No

                 User: [e-mail]
                 Role: full-manager
            Shareable: Yes
            Read-Only: No

                 User: [e-mail]
                 Role: viewer
            Shareable: No
            Read-Only: Yes

Share Admins (5, showing first 2):
  [e-mail]
  [e-mail]
  ... and 3 more

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();
if (vault.TryGetKeeperNSFRecord(recordUid, out var record))
{
    Console.WriteLine($"Record: {record.RecordUid} ({record.Name}) v{record.Version}");
    foreach (var access in vault.Storage.KdRecordAccesses.GetLinksForSubject(record.RecordUid))
    {
        Console.WriteLine($"  user-uid={access.AccessTypeUid}  owner={access.Owner}  " +
                          $"edit={access.CanEdit}  view={access.CanView}  delete={access.CanDelete}");
    }
}
if (vault.TryResolveKeeperNSFFolder(folderUidOrName, out var folder))
{
    var stored = vault.Storage.KdFolders.GetEntity(folder.FolderUid);
    Console.WriteLine($"Folder: {folder.FolderUid} ({folder.Name})  owner={stored?.OwnerUsername}");
}

Power Commander

Command: Get-KeeperNSFRecord

Alias: nsf-get

Parameters:

Parameter	Description
-Uid	Record or folder UID to look up
-Name	Record or folder name to search for (case-insensitive; falls back to partial match)
-Format	Output format: detail (default) or json

Examples:

PS > nsf-get oqf7DOKZvSYuwhwFc6qvOw
                                                   
                  UID: oqf7DOKZvSYuwhyqtewFc6qvOw
                 Type: databaseCredentials
                Title: 1234
             Password: ********
                 Host: hostName: 1.2.3.4, port: 1234
           Folder UID: wbxwceZdbqhusyPVcyuR-7IybjA
          Folder Name: QWE-test
          Folder Path: /QWE-test

     User Permissions:

                 User: [e-mail]
                Owner: Yes
            Shareable: Yes
            Read-Only: No

                 User: [e-mail]
                 Role: full-manager
            Shareable: Yes
            Read-Only: No

                 User: [e-mail]
                 Role: viewer
            Shareable: No
            Read-Only: Yes


Share Admins (5, showing first 2):
  [e-mail]
  [e-mail]
  ... and 3 more

Python CLI

Command: nsf-get

Parameters:

uid Record UID, folder UID, or title --format {detail, json} Output format: detail (default) or json --verbose, -v Show full permission breakdown for each accessor --unmask Reveal masked field values (passwords, secrets)

Example:

My Vault> nsf-get <record_uid>

                 UID: <record_uid>
                Type: pamNetworkConfiguration
               Title: Test Configuration
              Folder: Folder - Users
        Pamresources: controllerUid: <controller_uid>, folderUid: <folder_uid>

User Permissions:

  User: [e-mail]
  Owner: Yes
  Shareable: Yes
  Read-Only: No

Python SDK

Function : get_nsf_item

    ITEM_UID_OR_TITLE = "<record_uid_or_title>"  # Record/folder UID or title

    detail = nsf_management.get_nsf_item(vault, ITEM_UID_OR_TITLE)
    print(json.dumps(detail, indent=2, default=str))

Shortcut command

Scans all Keeper NSF folder-record links and reports records that exist in two or more folders. Optionally filters by a specific record (UID/title) or folder (UID/name).

DotNet CLI

Command: nsf-shortcut-list

Parameters:

Parameter	Description
position 0	Optional record UID, record title, folder UID, or folder name to filter results
-Format	Output format: table (default), csv, or json
-Output	Path to output file. Ignored for table format

Examples:

My Vault> nsf-shortcut-list
No shortcut records found.

Command: nsf-shortcut-keep

Description: For a record that appears in multiple Keeper NSF folders, keeps it in the specified folder and unlinks it from all others.

Parameters:

Parameter	Description
position 0	Record UID or title of the record (required)
position 1	Folder UID or folder name to keep the record in (required)
--force	Skip the confirmation prompt

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

foreach (var entry in vault.GetKeeperNSFShortcuts())
{
    Console.WriteLine($"{entry.RecordUid}  {entry.Title}  [{entry.Folders.Count} folders]");
    foreach (var f in entry.Folders)
    {
        Console.WriteLine($"  - {f.Name} ({f.FolderUid})");
    }
}

var keepResult = await vault.KeepKeeperNSFRecordInFolder(recordUid, keepFolderUid);
foreach (var removal in keepResult.Removals)
{
    Console.WriteLine($"{(removal.Success ? "[OK]" : "[FAIL]")} {removal.FolderName} ({removal.FolderUid})");
}

Power Commander

Command: Get-KeeperNSFShortcut

Alias: nsf-shortcut-list

Parameters:

Parameter	Description
-Target	Optional record UID, record title, folder UID, or folder name to filter results
-Format	Output format: table (default), csv, or json
-Output	Path to output file. Ignored for table format

Examples:

PS > Get-KeeperNSFShortcut                    
No shortcut records found.

Command: Set-KeeperNSFShortcutKeep

Alias: nsf-shortcut-keep

Description: For a record that appears in multiple Keeper NSF folders, keeps it in the specified folder and unlinks it from all others.

Parameters:

Parameter	Description
-RecordUid	Record UID or title of the record (required)
-FolderUid	Folder UID or folder name to keep the record in (required)
-Force	Skip the confirmation prompt

Examples:

PS > Set-KeeperNSFShortcutKeep -RecordUid <RECORD_UID> -FolderUid <FOLDER_UID>
PS > nsf-shortcut-keep <RECORD_TITLE> <FOLDER_NAME> -Force

Python CLI

Command: nsf-shortcut

Parameters:

target record UID or title

folder folder to keep (default: current)

-f, --force Skip confirmation prompt

Example:

My Vault> nsf-shortcut keep <record_uid> <folder_uid>
Will keep record in <record_uid> and remove from 1 other folder(s).
Do you want to proceed? [y/n]: y
Removed record from 1 folder link(s).
My Vault>

Python SDK

Function : list_nsf_shortcuts & keep_nsf_shortcut_in_folder

##### NSF SHORTCUT LIST
    TARGET_FILTER = None  # Optional record or folder filter

    rows = nsf_folder_records.list_nsf_shortcuts(vault, target=TARGET_FILTER)
    if not rows:
        print("No NSF shortcut records found")
        return
    view = vault.nsf_data
    for row in rows:
        folder_names = []
        for fuid in row.folder_uids:
            folder = view.get_folder(fuid) if view else None
            fname = folder.name if folder and folder.name else fuid
            folder_names.append(f"{fname} ({fuid})")
        print(f"{row.record_uid} | {row.title} | {', '.join(folder_names)}")
        
        
#### NSF SHORTCUT KEEP
    RECORD_UID_OR_TITLE = "My NSF Login"
    FOLDER_UID_OR_NAME = "Projects"  # Folder to keep the record in
    FORCE = True

    shortcuts = nsf_folder_records.get_nsf_shortcut_map(vault)
    record_uid = nsf_management.resolve_nsf_record_uid(vault, RECORD_UID_OR_TITLE)
    if not record_uid:
        raise ValueError(f'Record "{RECORD_UID_OR_TITLE}" not found')
    keep_folder = nsf_management.resolve_nsf_folder_uid(vault, FOLDER_UID_OR_NAME) or FOLDER_UID_OR_NAME
    to_remove = [f for f in shortcuts.get(record_uid, set()) if f != keep_folder]
    if not to_remove:
        print("Nothing to do — record is already in only one folder.")
        return
    if not FORCE:
        answer = input(
            f"Keep record in {FOLDER_UID_OR_NAME} and remove from {len(to_remove)} folder(s)? [y/N]: "
        ).strip().lower()
        if answer not in ("y", "yes"):
            print("Aborted.")
            return
    results = nsf_folder_records.keep_nsf_shortcut_in_folder(
        vault, RECORD_UID_OR_TITLE, FOLDER_UID_OR_NAME
    )
    print(f"Removed record from {len(results)} folder link(s).")

Grant/Revoke Record Permissions command

Bulk grants or revokes record-level sharing permissions for every record inside a Keeper NSF folder. Fetches current access for each record, computes the required changes, displays a plan, and applies the changes after confirmation.

DotNet CLI

Command: nsf-record-permission

Parameters:

Parameter	Description
position 0	Folder UID or name containing the records. If omitted, operates on root-level records
--action	grant or revoke (required)
--role	Access role: viewer, shared-manager, content-manager, content-share-manager, full-manager. Required for grant; for revoke, optionally restricts the revoke to users with that role
--recursive	Include records in subfolders
--force	Skip the confirmation prompt
-dry-run	Show what would change without applying any modifications

Examples:

My Vault> nsf-record-permission MQ8GwV3F1sQvGmXt-4zv2A --action grant --role viewer

Request to GRANT 'viewer' permission(s) in 'MQ8GwV3F1sQvGmXt-4zv2A' folder only
No permission changes are needed.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var plan = await vault.UpdateKeeperNSFRecordPermissions(
    folderUid: folderUid,
    action:    "grant",
    role:      "viewer",
    recursive: true,
    dryRun:    true);

Console.WriteLine($"Plan: {plan.Grants.Count} grants, {plan.Revokes.Count} revokes, {plan.Skipped.Count} skipped");

if (plan.Grants.Count + plan.Revokes.Count > 0)
{
    var result = await vault.UpdateKeeperNSFRecordPermissions(
        folderUid: folderUid,
        action:    "grant",
        role:      "viewer",
        recursive: true,
        dryRun:    false);

    foreach (var g in result.Grants)
    {
        Console.WriteLine($"{(g.Success ? "[OK]" : "[FAIL]")} {g.RecordUid}  {g.Email}  {g.CurrentRole} -> {g.NewRole}");
    }
}

Power Commander

Command: Set-KeeperNSFRecordPermission

Alias: nsf-record-permission

Parameters:

Parameter	Description
-FolderUid	Folder UID or name containing the records. If omitted, operates on root-level records
-Action	grant or revoke (required)
-Role	Access role: viewer, shared-manager, content-manager, content-share-manager, full-manager. Required for grant; for revoke, optionally restricts the revoke to users with that role
-Recursive	Include records in subfolders
-Force	Skip the confirmation prompt
-DryRun	Show what would change without applying any modifications

Examples:

PS > Set-KeeperNSFRecordPermission -FolderUid wbxwceZdbPVcyuR-7IybjA -Action grant -Role viewer -Recursive

Request to GRANT 'viewer' permission(s) in 'wbxwceZdbPVcyuR-7IybjA' folder recursively

  PLANNED GRANTS (1):
    oqf7DOKZvSYuwhwFc6qvOw  [e-mail]  shared-manager -> viewer
Are you sure you want to apply the above changes? (yes/No): yes

  GRANT (1):
    [OK] oqf7DOKZvSYuwhwFc6qvOw  [e-mail]  shared-manager -> viewer

Summary: 1 succeeded, 0 failed, 0 skipped

Python CLI

Command: Not implemented

Parameters:

folder Folder UID or name

--dry-run Display changes without executing

-f, --force Skip confirmation prompts -R, --recursive Include records in subfolders -a, --action {grant, revoke} -r, --role {viewer, share-manager, content-manager, content-share-manager, full-manager}

Example:

My Vault> nsf-record-permission -a revoke <folder_uid>

REVOKE:
  <record_uid> [e-mail] content-manager
Do you want to proceed with these permission changes? [y/n]: y
revokes <record_uid> [e-mail]: ok
My Vault>

Python SDK

Function : apply_nsf_record_permissions

    FOLDER_UID_OR_NAME = "Projects"
    ACTION = "grant"  # grant or revoke
    ROLE = "viewer"  # Required for grant
    RECURSIVE = False
    FORCE = True
    DRY_RUN = False

    plan = nsf_sharing.plan_nsf_record_permissions(
        vault,
        FOLDER_UID_OR_NAME,
        action=ACTION,
        role=ROLE,
        recursive=RECURSIVE,
        current_user=current_user,
    )
    if not plan.updates and not plan.creates and not plan.revokes:
        print("No permission changes are needed.")
        return
    for label, items in (
        ("SKIP", plan.skipped),
        ("GRANT/UPDATE", plan.updates + plan.creates),
        ("REVOKE", plan.revokes),
    ):
        if not items:
            continue
        print(f"\n{label}:")
        for item in items:
            line = f"  {item.get('record_uid')} {item.get('email', '')} {item.get('cur_role', '')}"
            if item.get("new_role"):
                line += f" -> {item['new_role']}"
            print(line)
    if DRY_RUN:
        return
    if not FORCE:
        answer = input("Proceed with permission changes? [y/N]: ").strip().lower()
        if answer not in ("y", "yes"):
            print("Aborted.")
            return
    outcomes = nsf_sharing.apply_nsf_record_permissions(vault, plan)
    for bucket, rows in outcomes.items():
        for item, result in rows:
            status = "ok" if result.get("success") else result.get("message")
            print(f"{bucket} {item.get('record_uid')} {item.get('email')}: {status}")