Nested Shared Folder Commands

SDK commands related to Nested Shared Folders functionality

With the introduction of Nested Shared Folders with Role-Based Folder Permissions, we’ve rebuilt the vault’s folder, sharing and permissions model from the ground up, delivering a more flexible and scalable experience for every user and team.

List command

List Nested shared folders and records cached locally. By default, both folders and records are shown. Use the --folders or --records flag to filter, and --format to control the output style.

DotNet CLI

Command: nsf-list

Parameters:

Parameter	Description
--folders	Show only folders
--records	Show only records
--format	Output format: table (default), csv, or json
--output	Path to output file. Ignored for table format

Examples:

My Vault> nsf-list

=== Keeper NSF Summary ===
  Folders: 1
  Records: 1

--- Folders ---
FolderUid               Name                   ParentUid               Subfolders  Records
----------------------  ---------------------  ----------------------  ----------  -------
F1lX8kCMx--W0ndcmeaX6w  Child-folder           eRcyzWqxQhMlieLuRq29nA  0           0      

--- Records ---
RecordUid               Name          Type   Revision  Version  Shared  FileSize  ThumbnailSize
----------------------  ------------  -----  --------  -------  ------  --------  -------------
LTVdDDvuSKLmWYiNbKjrYg  Notes1234     login  5017162   3        False   0         0

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();
Console.WriteLine($"Folders: {vault.KeeperNSFFolderCount}, Records: {vault.KeeperNSFRecordCount}");
foreach (var folder in vault.KeeperNSFFolderNodes)
{
    Console.WriteLine($"[Folder] {folder.FolderUid}  {folder.Name}");
}
foreach (var record in vault.KeeperNSFRecordEntries)
{
    Console.WriteLine($"[Record] {record.RecordUid}  {record.Name}  v{record.Version}");
}
if (vault.TryGetKeeperNSFFolder("folderUid1", out var f))
{
    Console.WriteLine($"Found folder: {f.Name}");
}
if (vault.TryResolveKeeperNSFRecord("MyLogin", out var r))
{
    Console.WriteLine($"Resolved record: {r.RecordUid}");
}

Power Commander

Command: Get-KeeperNSFList

Alias: nsf-list

Parameters:

Parameter	Description
-Folders	Show only folders
-Records	Show only records
-Format	Output format: table (default), csv, or json
-Output	Path to output file. Ignored for table format

Examples:

PS > Get-KeeperNSFList
PS > nsf-list -Folders
PS > nsf-list -Records -Format json -Output nsf-records.json
PS > nsf-list -Format csv -Output nsf.csv

Python CLI

Command: nsf-list

Parameters: --folders Show only folders --records Show only records --format {table,csv,json} --output OUTPUT Path to output file (ignored for table format)

Example:

My Vault> nsf-list
  #  Item type    UID                     Title                                      Type                     Description
---  -----------  ----------------------  -----------------------------------------  -----------------------  -------------
  1  Folder       <folder_uid>            Folder Title
  2  Record       <record_uid>            new test nsf                               login

Python SDK

Function : list_nsf_items

    INCLUDE_FOLDERS = True
    INCLUDE_RECORDS = True

    rows = nsf_management.list_nsf_items(
        vault,
        include_folders=INCLUDE_FOLDERS,
        include_records=INCLUDE_RECORDS,
    )
    if not rows:
        print("No NSF folders or records found. Run sync-down first.")
        return
    print(f"{'Type':<8} {'UID':<28} {'Title':<30} {'Record Type':<15} {'Location'}")
    print("-" * 100)
    for row in rows:
        print(
            f"{row.item_type:<8} {row.uid:<28} {row.title[:28]:<30} "
            f"{(row.record_type or '')[:15]:<15}"
        )
    print(f"\nTotal items: {len(rows)}")

Get command

Retrieves detailed information about a specific Keeper NSF record or folder by UID or name. Shows metadata, user permissions, and share administrators.

DotNet CLI

Command: nsf-get

Parameters:

Parameter	Description
--uid	Record or folder UID to look up
--name	Record or folder name to search for (case-insensitive; falls back to partial match)
--format	Output format: detail (default) or json

Examples:

MyVault> nsf-get --uid GS3J1s9ARg1-P5LRQOeRTA

                  UID: GS3J1s9ARg1-P5LRQOeRTA
                 Type: login
                Title: Record-Share
             Password: ********
           Folder UID: AAAAAAAAAAAAAAAAAALjjA
          Folder Name: (unknown)
          Folder Path:
          
          User Permissions:

                 User: [e-mail]
                Owner: Yes
            Shareable: Yes
            Read-Only: No

                 User: [e-mail]
                 Role: full-manager
            Shareable: Yes
            Read-Only: No

                 User: [e-mail]
                 Role: viewer
            Shareable: No
            Read-Only: Yes

Share Admins (5, showing first 2):
  [e-mail]
  [e-mail]
  ... and 3 more

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();
if (vault.TryGetKeeperNSFRecord(recordUid, out var record))
{
    Console.WriteLine($"Record: {record.RecordUid} ({record.Name}) v{record.Version}");
    foreach (var access in vault.Storage.KdRecordAccesses.GetLinksForSubject(record.RecordUid))
    {
        Console.WriteLine($"  user-uid={access.AccessTypeUid}  owner={access.Owner}  " +
                          $"edit={access.CanEdit}  view={access.CanView}  delete={access.CanDelete}");
    }
}
if (vault.TryResolveKeeperNSFFolder(folderUidOrName, out var folder))
{
    var stored = vault.Storage.KdFolders.GetEntity(folder.FolderUid);
    Console.WriteLine($"Folder: {folder.FolderUid} ({folder.Name})  owner={stored?.OwnerUsername}");
}

Power Commander

Command: Get-KeeperNSFRecord

Alias: nsf-get

Parameters:

Parameter	Description
-Uid	Record or folder UID to look up
-Name	Record or folder name to search for (case-insensitive; falls back to partial match)
-Format	Output format: detail (default) or json

Examples:

PS > nsf-get oqf7DOKZvSYuwhwFc6qvOw
                                                   
                  UID: oqf7DOKZvSYuwhyqtewFc6qvOw
                 Type: databaseCredentials
                Title: 1234
             Password: ********
                 Host: hostName: 1.2.3.4, port: 1234
           Folder UID: wbxwceZdbqhusyPVcyuR-7IybjA
          Folder Name: QWE-test
          Folder Path: /QWE-test

     User Permissions:

                 User: [e-mail]
                Owner: Yes
            Shareable: Yes
            Read-Only: No

                 User: [e-mail]
                 Role: full-manager
            Shareable: Yes
            Read-Only: No

                 User: [e-mail]
                 Role: viewer
            Shareable: No
            Read-Only: Yes


Share Admins (5, showing first 2):
  [e-mail]
  [e-mail]
  ... and 3 more

Python CLI

Command: nsf-get

Parameters:

uid Record UID, folder UID, or title --format {detail, json} Output format: detail (default) or json --verbose, -v Show full permission breakdown for each accessor --unmask Reveal masked field values (passwords, secrets)

Example:

My Vault> nsf-get <record_uid>

                 UID: <record_uid>
                Type: pamNetworkConfiguration
               Title: Test Configuration
              Folder: Folder - Users
        Pamresources: controllerUid: <controller_uid>, folderUid: <folder_uid>

User Permissions:

  User: [e-mail]
  Owner: Yes
  Shareable: Yes
  Read-Only: No

Python SDK

Function : get_nsf_item

    ITEM_UID_OR_TITLE = "<record_uid_or_title>"  # Record/folder UID or title

    detail = nsf_management.get_nsf_item(vault, ITEM_UID_OR_TITLE)
    print(json.dumps(detail, indent=2, default=str))

Shortcut command

Scans all Keeper NSF folder-record links and reports records that exist in two or more folders. Optionally filters by a specific record (UID/title) or folder (UID/name).

DotNet CLI

Command: nsf-shortcut-list

Parameters:

Parameter	Description
position 0	Optional record UID, record title, folder UID, or folder name to filter results
-Format	Output format: table (default), csv, or json
-Output	Path to output file. Ignored for table format

Examples:

My Vault> nsf-shortcut-list
No shortcut records found.

Command: nsf-shortcut-keep

Description: For a record that appears in multiple Keeper NSF folders, keeps it in the specified folder and unlinks it from all others.

Parameters:

Parameter	Description
position 0	Record UID or title of the record (required)
position 1	Folder UID or folder name to keep the record in (required)
--force	Skip the confirmation prompt

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

foreach (var entry in vault.GetKeeperNSFShortcuts())
{
    Console.WriteLine($"{entry.RecordUid}  {entry.Title}  [{entry.Folders.Count} folders]");
    foreach (var f in entry.Folders)
    {
        Console.WriteLine($"  - {f.Name} ({f.FolderUid})");
    }
}

var keepResult = await vault.KeepKeeperNSFRecordInFolder(recordUid, keepFolderUid);
foreach (var removal in keepResult.Removals)
{
    Console.WriteLine($"{(removal.Success ? "[OK]" : "[FAIL]")} {removal.FolderName} ({removal.FolderUid})");
}

Power Commander

Command: Get-KeeperNSFShortcut

Alias: nsf-shortcut-list

Parameters:

Parameter	Description
-Target	Optional record UID, record title, folder UID, or folder name to filter results
-Format	Output format: table (default), csv, or json
-Output	Path to output file. Ignored for table format

Examples:

PS > Get-KeeperNSFShortcut                    
No shortcut records found.

Command: Set-KeeperNSFShortcutKeep

Alias: nsf-shortcut-keep

Description: For a record that appears in multiple Keeper NSF folders, keeps it in the specified folder and unlinks it from all others.

Parameters:

Parameter	Description
-RecordUid	Record UID or title of the record (required)
-FolderUid	Folder UID or folder name to keep the record in (required)
-Force	Skip the confirmation prompt

Examples:

PS > Set-KeeperNSFShortcutKeep -RecordUid <RECORD_UID> -FolderUid <FOLDER_UID>
PS > nsf-shortcut-keep <RECORD_TITLE> <FOLDER_NAME> -Force

Python CLI

Command: nsf-shortcut

Parameters:

target record UID or title

folder folder to keep (default: current)

-f, --force Skip confirmation prompt

Example:

My Vault> nsf-shortcut keep <record_uid> <folder_uid>
Will keep record in <record_uid> and remove from 1 other folder(s).
Do you want to proceed? [y/n]: y
Removed record from 1 folder link(s).
My Vault>

Python SDK

Function : list_nsf_shortcuts & keep_nsf_shortcut_in_folder

##### NSF SHORTCUT LIST
    TARGET_FILTER = None  # Optional record or folder filter

    rows = nsf_folder_records.list_nsf_shortcuts(vault, target=TARGET_FILTER)
    if not rows:
        print("No NSF shortcut records found")
        return
    view = vault.nsf_data
    for row in rows:
        folder_names = []
        for fuid in row.folder_uids:
            folder = view.get_folder(fuid) if view else None
            fname = folder.name if folder and folder.name else fuid
            folder_names.append(f"{fname} ({fuid})")
        print(f"{row.record_uid} | {row.title} | {', '.join(folder_names)}")
        
        
#### NSF SHORTCUT KEEP
    RECORD_UID_OR_TITLE = "My NSF Login"
    FOLDER_UID_OR_NAME = "Projects"  # Folder to keep the record in
    FORCE = True

    shortcuts = nsf_folder_records.get_nsf_shortcut_map(vault)
    record_uid = nsf_management.resolve_nsf_record_uid(vault, RECORD_UID_OR_TITLE)
    if not record_uid:
        raise ValueError(f'Record "{RECORD_UID_OR_TITLE}" not found')
    keep_folder = nsf_management.resolve_nsf_folder_uid(vault, FOLDER_UID_OR_NAME) or FOLDER_UID_OR_NAME
    to_remove = [f for f in shortcuts.get(record_uid, set()) if f != keep_folder]
    if not to_remove:
        print("Nothing to do — record is already in only one folder.")
        return
    if not FORCE:
        answer = input(
            f"Keep record in {FOLDER_UID_OR_NAME} and remove from {len(to_remove)} folder(s)? [y/N]: "
        ).strip().lower()
        if answer not in ("y", "yes"):
            print("Aborted.")
            return
    results = nsf_folder_records.keep_nsf_shortcut_in_folder(
        vault, RECORD_UID_OR_TITLE, FOLDER_UID_OR_NAME
    )
    print(f"Removed record from {len(results)} folder link(s).")

Grant/Revoke Record Permissions command

Bulk grants or revokes record-level sharing permissions for every record inside a Keeper NSF folder. Fetches current access for each record, computes the required changes, displays a plan, and applies the changes after confirmation.

DotNet CLI

Command: nsf-record-permission

Parameters:

Parameter	Description
position 0	Folder UID or name containing the records. If omitted, operates on root-level records
--action	grant or revoke (required)
--role	Access role: viewer, shared-manager, content-manager, content-share-manager, full-manager. Required for grant; for revoke, optionally restricts the revoke to users with that role
--recursive	Include records in subfolders
--force	Skip the confirmation prompt
-dry-run	Show what would change without applying any modifications

Examples:

My Vault> nsf-record-permission MQ8GwV3F1sQvGmXt-4zv2A --action grant --role viewer

Request to GRANT 'viewer' permission(s) in 'MQ8GwV3F1sQvGmXt-4zv2A' folder only
No permission changes are needed.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var plan = await vault.UpdateKeeperNSFRecordPermissions(
    folderUid: folderUid,
    action:    "grant",
    role:      "viewer",
    recursive: true,
    dryRun:    true);

Console.WriteLine($"Plan: {plan.Grants.Count} grants, {plan.Revokes.Count} revokes, {plan.Skipped.Count} skipped");

if (plan.Grants.Count + plan.Revokes.Count > 0)
{
    var result = await vault.UpdateKeeperNSFRecordPermissions(
        folderUid: folderUid,
        action:    "grant",
        role:      "viewer",
        recursive: true,
        dryRun:    false);

    foreach (var g in result.Grants)
    {
        Console.WriteLine($"{(g.Success ? "[OK]" : "[FAIL]")} {g.RecordUid}  {g.Email}  {g.CurrentRole} -> {g.NewRole}");
    }
}

Power Commander

Command: Set-KeeperNSFRecordPermission

Alias: nsf-record-permission

Parameters:

Parameter	Description
-FolderUid	Folder UID or name containing the records. If omitted, operates on root-level records
-Action	grant or revoke (required)
-Role	Access role: viewer, shared-manager, content-manager, content-share-manager, full-manager. Required for grant; for revoke, optionally restricts the revoke to users with that role
-Recursive	Include records in subfolders
-Force	Skip the confirmation prompt
-DryRun	Show what would change without applying any modifications

Examples:

PS > Set-KeeperNSFRecordPermission -FolderUid wbxwceZdbPVcyuR-7IybjA -Action grant -Role viewer -Recursive

Request to GRANT 'viewer' permission(s) in 'wbxwceZdbPVcyuR-7IybjA' folder recursively

  PLANNED GRANTS (1):
    oqf7DOKZvSYuwhwFc6qvOw  [e-mail]  shared-manager -> viewer
Are you sure you want to apply the above changes? (yes/No): yes

  GRANT (1):
    [OK] oqf7DOKZvSYuwhwFc6qvOw  [e-mail]  shared-manager -> viewer

Summary: 1 succeeded, 0 failed, 0 skipped

Python CLI

Command: nsf-record-permission

Parameters:

folder Folder UID or name

--dry-run Display changes without executing

-f, --force Skip confirmation prompts -R, --recursive Include records in subfolders -a, --action {grant, revoke} -r, --role {viewer, share-manager, content-manager, content-share-manager, full-manager}

Example:

My Vault> nsf-record-permission -a revoke <folder_uid>

REVOKE:
  <record_uid> [e-mail] content-manager
Do you want to proceed with these permission changes? [y/n]: y
revokes <record_uid> [e-mail]: ok
My Vault>

Python SDK

Function : apply_nsf_record_permissions

    FOLDER_UID_OR_NAME = "Projects"
    ACTION = "grant"  # grant or revoke
    ROLE = "viewer"  # Required for grant
    RECURSIVE = False
    FORCE = True
    DRY_RUN = False

    plan = nsf_sharing.plan_nsf_record_permissions(
        vault,
        FOLDER_UID_OR_NAME,
        action=ACTION,
        role=ROLE,
        recursive=RECURSIVE,
        current_user=current_user,
    )
    if not plan.updates and not plan.creates and not plan.revokes:
        print("No permission changes are needed.")
        return
    for label, items in (
        ("SKIP", plan.skipped),
        ("GRANT/UPDATE", plan.updates + plan.creates),
        ("REVOKE", plan.revokes),
    ):
        if not items:
            continue
        print(f"\n{label}:")
        for item in items:
            line = f"  {item.get('record_uid')} {item.get('email', '')} {item.get('cur_role', '')}"
            if item.get("new_role"):
                line += f" -> {item['new_role']}"
            print(line)
    if DRY_RUN:
        return
    if not FORCE:
        answer = input("Proceed with permission changes? [y/N]: ").strip().lower()
        if answer not in ("y", "yes"):
            print("Aborted.")
            return
    outcomes = nsf_sharing.apply_nsf_record_permissions(vault, plan)
    for bucket, rows in outcomes.items():
        for item, result in rows:
            status = "ok" if result.get("success") else result.get("message")
            print(f"{bucket} {item.get('record_uid')} {item.get('email')}: {status}")

Move Command

Moves a single Keeper NSF (Nested Share Folder) record or folder into a different folder. You give it the thing you want to move and the folder you want it moved into — the command figures out on its own whether what you gave it is a folder or a record.

DotNet CLI

Command: nsf-move

Parameters:

Position	Name	Description
0	Src	UID or name of the record or folder to move.
1	Dst	UID or name of the destination folder, or the literal root to move the item to the top of the Nested Share Folder tree.

Example:

My Vault> nsf-move AbCdEfGhIjnagKlMnOp123 XyZ987654321UjuhaidHere

DotNet SDK

Function: Record Move

public async Task<KeeperNSFRecordMoveResult> MoveKeeperNSFRecord(
            string recordUidOrTitle, string sourceFolderUidOrName, string targetFolderUidOrName)
        {
            if (string.IsNullOrWhiteSpace(recordUidOrTitle))
            {
                throw new ArgumentException("Record UID or title is required.", nameof(recordUidOrTitle));
            }

            if (sourceFolderUidOrName == null)
            {
                throw new ArgumentException(
                    "Source folder UID or name is required; use \"\", \"/\", or \"root\" for the Keeper NSF root.",
                    nameof(sourceFolderUidOrName));
            }

            if (targetFolderUidOrName == null)
            {
                throw new ArgumentException(
                    "Target folder UID or name is required; use \"\", \"/\", or \"root\" for the Keeper NSF root.",
                    nameof(targetFolderUidOrName));
            }

            var record = recordUidOrTitle.Trim();
            var sourceFolder = sourceFolderUidOrName.Trim();
            var targetFolder = targetFolderUidOrName.Trim();

            var move = new KeeperNSFRecordMoveRequest
            {
                SourceFolderUid = sourceFolder,
                TargetFolderUid = targetFolder,
                RecordUid = record,
            };

            var results = await MoveKeeperNSFRecords(new[] { move }).ConfigureAwait(false);
            return results.FirstOrDefault() ?? new KeeperNSFRecordMoveResult
            {
                SourceFolderUid = sourceFolder,
                TargetFolderUid = targetFolder,
                RecordUid = record,
                Status = "unknown",
                Message = "No response received",
                Success = false,
            };
        }

Function: Folder Move

        public async Task<KeeperNSFFolderMoveResult> MoveKeeperNSFFolder(
            string folderUidOrName, string targetParentUidOrName)
        {
            if (string.IsNullOrWhiteSpace(folderUidOrName))
            {
                throw new ArgumentException("Folder UID or name is required.", nameof(folderUidOrName));
            }

            if (targetParentUidOrName == null)
            {
                throw new ArgumentException(
                    "Target parent UID or name is required; use \"\", \"/\", or \"root\" for the Keeper NSF root.",
                    nameof(targetParentUidOrName));
            }

            var folder = folderUidOrName.Trim();
            var targetParent = targetParentUidOrName.Trim();

            var move = new KeeperNSFFolderMoveRequest
            {
                FolderUid = folder,
                TargetParentUid = targetParent,
            };

            var results = await MoveKeeperNSFFolders(new[] { move }).ConfigureAwait(false);
            return results.FirstOrDefault() ?? new KeeperNSFFolderMoveResult
            {
                FolderUid = folder,
                TargetParentUid = targetParent,
                Status = "unknown",
                Message = "No response received",
                Success = false,
            };
        }

Power Commander

Command: Move-KeeperNSFItem

Alias: nsf-move

Parameters:

Position	Name	Description
0	Src	UID or name of the record or folder to move.
1	Dst	UID or name of the destination folder, or the literal root to move the item to the top of the Nested Share Folder tree.

Example:

PS > Move-KeeperNSFItem -Src "Invoices 2024" -Dst "Archive"
PS > nsf-move <recordUid> <targetFolderUid>

Python CLI

Command: coming soon

Python SDK

Function : coming soon

Load Folder and Record access details

Fetch and store the access details for all nsf records and folder in cache to decrease the dependence on frequent API calls

Python CLI

Command: nsf-load-access

Flags:

--folders Load access details for folders

--records Load access details for records

Example:

My Vault> nsf-load-access --folders --records
Loaded access details for 15 folder(s) and 27 record(s) into the NSF cache
My Vault>

Python SDK

Function: load_nsf_access_details

Example:

nsf_management.load_nsf_access_details(vault, load_folder=load_folder, load_record=load_record)

Fetch Folder and Record access details

Function to fetch the access details for nsf records and folder from cache without API calls

Python SDK

def nsf_access_list(
    vault: vault_online.VaultOnline,
    folder_uids: List[str],
    record_uids: List[str],
) -> None:
    load_folder = bool(folder_uids)
    load_record = bool(record_uids)
    view = vault.nsf_data
    if view is None:
        print("NSF storage is not available on this vault.")
        return
    nsf_management.load_nsf_access_details(vault, load_folder=load_folder, load_record=load_record)

    for folder_uid in folder_uids:
        folder = view.get_folder(folder_uid)
        print(f"\nFolder: {folder.name if folder else '(NSF Folder)'}")
        print(f"UID:    {folder_uid}")
        folder_access_detail = view.get_nsf_folder_access_detail(folder_uid)
        accessors = (folder_access_detail or {}).get("accessors")
        if not accessors:
            print("Access: No cached access details found.")
            continue
        print("Access:")
        for access in accessors:
            print(
                f"  - accessor_uid={access.get('accessor_uid')}"
                f" | access_type={access.get('access_type')}"
                f" | role={access.get('role')}"
                f" | inherited={access.get('inherited')}"
                f" | hidden={access.get('hidden')}"
                f" | owner={access.get('owner', False)}"
            )
            permissions = access.get("permissions")
            if permissions:
                print(f"    permissions={json.dumps(permissions)}")

    for record_uid in record_uids:
        print(f"\nRecord UID: {record_uid}")
        record_access_detail = view.get_nsf_record_access_detail(record_uid)
        if not record_access_detail:
            print("Access: No cached access details found.")
            continue
        print("Access:")
        for access in record_access_detail:
            print(
                f"  - accessor_uid={access.get('access_type_uid')}"
                f" | access_type={access.get('access_type')}"
                f" | role={access.get('access_role_type')}"
                f" | owner={access.get('owner')}"
                f" | inherited={access.get('inherited')}"
                f" | denied={access.get('denied_access')}"
            )
            permissions = {
                "can_view_title": access.get("can_view_title"),
                "can_view": access.get("can_view"),
                "can_edit": access.get("can_edit"),
                "can_list_access": access.get("can_list_access"),
                "can_update_access": access.get("can_update_access"),
                "can_delete": access.get("can_delete"),
                "can_change_ownership": access.get("can_change_ownership"),
                "can_request_access": access.get("can_request_access"),
                "can_approve_access": access.get("can_approve_access"),
            }
            print(f"    permissions={json.dumps(permissions)}")