NSF Folders Commands

Nested Shared Folders for folder-level commands

Overview

With the introduction of Nested Shared Folders with Role-Based Folder Permissions, we’ve rebuilt the vault’s folder, sharing and permissions model from the ground up, delivering a more flexible and scalable experience for every user and team.

Operations Supported

The Following operations are supported by NSF Shared Folders

1. List NSF Shared Folders
2. Get NSF Shared Folders
3. Add NSF Shared Folders
4. Edit NSF Shared Folders
5. Delete NSF Shared Folders
6. Share NSF
7. Unlink Record From Folder
8. Link Record to Folder

Note: In case you are using classic permission model, please refer to Shared Folder Commands

Create Folder command

Creates a new folder in Keeper NSF using the v3 API. Optionally places the folder under a parent, assigns a color, and controls whether permissions are inherited from the parent.

DotNet CLI

Command: nsf-mkdir

Parameters:

Parameter	Description
--name	Name of the folder to create (required)
--parent	UID of the parent folder. If omitted, the folder is created at the Keeper NSF root
--color	Optional folder color
--no-inherit	If specified, the new folder will not inherit permissions from its parent

Examples:

My Vault> nsf-mkdir "a12" --parent MQ8GwV3F1sQvGmXt-4zv2A --color green --no-inherit
Folder 'a12' created successfully (UID: SDFAcBPpPETVmRKWyD-qHw).

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();
string rootFolderUid = await vault.CreateKeeperNSFFolder(folderName);
Console.WriteLine($"Created root folder: {rootFolderUid}");
string childFolderUid = await vault.CreateKeeperNSFFolder(
    folderName: folderName,
    parentFolderUid: parentFolderUid,
    color: color);
Console.WriteLine($"Created child folder: {childFolderUid}");
string isolatedFolderUid = await vault.CreateKeeperNSFFolder(
    folderName: folderName,
    parentFolderUid: parentFolderUid,
    color: null,
    inheritPermissions: false);
Console.WriteLine($"Created isolated folder: {isolatedFolderUid}");

Power Commander

Command: New-KeeperNSFFolder

Alias: nsf-mkdir

Parameters:

Parameter	Description
-Name	Name of the folder to create (required)
-ParentFolderUid	UID of the parent folder. If omitted, the folder is created at the Keeper NSF root
-Color	Optional folder color
-NoInheritPermissions	If specified, the new folder will not inherit permissions from its parent

Examples:

PS >  New-KeeperNSFFolder -Name "KD12" -Color "red"
Folder 'KD12' created successfully (UID: cdfqw-SRqie3ZT9CdVB1ng).
cdfqw-SRqie3ZT9CdVB1ngqwe

Python CLI

Command: nsf-mkdir

Parameters:

folder Folder name (use "//" to embed a literal "/" in the name) --color {none, red, orange, yellow, green, blue, gray} Folder colour --no-inherit Do not inherit parent folder permissions

Example:

My Vault> nsf-mkdir "Test NSF New" --color red
NSF folder created: <folder_uid>
<folder_uid>
My Vault>

Python SDK

Function : create_nsf_folder

    FOLDER_PATH = "Projects/Demo"  # Use // for literal / in a name
    COLOR = None  # none, red, orange, yellow, green, blue, gray
    INHERIT_PERMISSIONS = True

    segments = [s.strip() for s in FOLDER_PATH.replace("//", "\x00").split("/") if s.strip()]
    if not segments:
        raise ValueError("Invalid folder path")

    parent_uid = None
    created_uid = None
    for idx, segment in enumerate(segments):
        segment = segment.replace("\x00", "/")
        is_leaf = idx == len(segments) - 1
        existing = nsf_management.find_nsf_child_folder(vault, segment, parent_uid)
        if existing:
            if is_leaf:
                print(f'Folder "{segment}" already exists: {existing}')
                return
            parent_uid = existing
            continue
        result = nsf_management.create_nsf_folder(
            vault,
            segment,
            parent_uid=parent_uid,
            color=COLOR if is_leaf else None,
            inherit_permissions=INHERIT_PERMISSIONS if is_leaf else True,
        )
        created_uid = result.folder_uid
        parent_uid = created_uid

Update folder command

Renames a Keeper NSF folder and/or changes its color. Folder can be referenced by UID or by name.

DotNet CLI

Command: nsf-rndir

Parameters:

Parameter	Description
--name	New folder name
--color	New folder color: none, red, orange, yellow, green, blue, gray, grey

Examples:

My Vault> nsf-rndir MQ8GwV3F1sQvGmXt-4zv2A --color yellow         
Keeper NSF folder updated.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

if (vault.TryResolveKeeperNSFFolder(folderUidOrName, out var folder))
{
    var result = await vault.UpdateKeeperNSFFolder(
        folderUidOrName: folder.FolderUid,
        newName: newName,
        color: color);

    VaultOnline.ValidateFolderModifyResult(result);
    Console.WriteLine("Keeper NSF folder updated.");
}

Power Commander

Command: Set-KeeperNSFFolder

Alias: nsf-rndir

Parameters:

Parameter	Description
-Folder	Folder UID or name (required)
-Name	New folder name
-Color	New folder color: none, red, orange, yellow, green, blue, gray, grey

Examples:

PS > Set-KeeperNSFFolder -Folder cdfqw-SRqie3ZT9CdVB1ng -Name "Updated_name1"
Keeper NSF folder updated.
PS > Set-KeeperNSFFolder -Folder cdfqw-SRqie3ZT9CdVB1ng -Color red            
Keeper NSF folder updated.

Python CLI

Command: nsf-rndir

Parameters:

folder folder path or UID -n, --name NAME - folder new name --color {none, red, orange, yellow, green, blue, gray} Folder color -q, --quiet Suppress success message

Example:

My Vault> nsf-rndir <folder_uid> -n "New Name" --color gray
Folder "Name" has been renamed to "New Name"
My Vault>

Python SDK

Function : update_nsf_folder

    FOLDER_UID_OR_NAME = "Demo"
    NEW_NAME = "Demo Renamed"  # Set to None to only change color
    COLOR = None  # none, red, orange, yellow, green, blue, gray

    result = nsf_management.update_nsf_folder(
        vault,
        FOLDER_UID_OR_NAME,
        folder_name=NEW_NAME,
        color=COLOR,
    )

Remove folder command

Removes one or more Keeper NSF folders. Always runs a preview first, prints the impact, and asks for confirmation unless -Force is supplied.

DotNet CLI

Command: nsf-rmdir

Parameters:

Parameter	Description
-o or --operation	folder-trash (default, recoverable) or delete-permanent (irreversible cascade delete)
-f or --force	Skip the confirmation prompt after preview
--dry-run	Preview only; do not remove folders

Examples:

My Vault> nsf-rmdir EhJ3-aznCbIAX9YzG8PIHg          

=== Keeper NSF Folder Remove Preview ===

Folder: EhJ3-aznCbIAX9YzG8PIHg
  Status: Success
  Impact:
    Folders:          1
    Records:          1
    Affected users:   1
    Affected teams:   0
Are you sure you want to remove the folder(s) above? (yes/No) y

Removing folders...

Keeper NSF folder removal completed.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var removals = new List<KeeperNSFFolderRemoval>();
foreach (var name in folderUidsOrNames)
{
    if (vault.TryResolveKeeperNSFFolder(name, out var folder))
    {
        removals.Add(new KeeperNSFFolderRemoval
        {
            FolderUid = folder.FolderUid,
            Operation = KeeperNSFFolderRemoveOperation.FolderTrash,
        });
    }
}

var preview = await vault.RemoveKeeperNSFFolders(removals, dryRun: true);
VaultOnline.ValidateRemoveResponse(preview.PreviewResponse, throwOnWarnings: false);

var confirm = await vault.RemoveKeeperNSFFolders(removals, dryRun: false);
if (!confirm.Confirmed)
{
    throw new InvalidOperationException("Folder removal was not confirmed by the server.");
}

await vault.SyncDown(false);

Power Commander

Command: Remove-KeeperNSFFolder

Alias: nsf-rmdir

Parameters:

Parameter	Description
-Folder	One or more folder UIDs or names. Accepts pipeline input
-Operation	folder-trash (default, recoverable) or delete-permanent (irreversible cascade delete)
-Force	Skip the confirmation prompt after preview
-DryRun	Preview only; do not remove folders

Examples:

PS > Remove-KeeperNSFFolder -Folder <folder_uid> -Force

=== Keeper NSF Folder Remove Preview ===

Folder: <folder_uid>
  Status: Success
  Impact:
    Folders:          1
    Records:          0
    Affected users:   1
    Affected teams:   0

Removing folders...

Keeper NSF folder removal completed.

Python CLI

Command: Not implemented

Parameters:

FOLDER Folder UID(s) or name(s) to remove (max 100) --operation, -o {folder-trash, delete-permanent} Removal operation (default: folder-trash) -q, --quiet Suppress per-folder impact detail --force, -f Skip confirmation after preview --dry-run Preview only; do not delete

Example:

My Vault> nsf-rmdir <folder_uid>

The following folder will be folder-trash:
  New Name [<folder_uid>]
  This will affect: 1 sub-folder(s), 1 user(s)
Do you want to proceed with the folder deletion? [y/n]: y
Folder removal completed.
My Vault>

Python SDK

Function : remove_nsf_folders

    FOLDER_IDENTIFIERS = ["Demo Renamed"]  # UIDs or names
    OPERATION = "folder-trash"  # folder-trash, delete-permanent
    FORCE = True
    DRY_RUN = False

    removals = []
    for identifier in FOLDER_IDENTIFIERS:
        folder_uid = nsf_management.resolve_nsf_folder_uid(vault, identifier)
        if not folder_uid:
            raise ValueError(f'Folder "{identifier}" not found')
        removals.append({"folder_uid": folder_uid, "operation_type": OPERATION})

    preview = nsf_management.remove_nsf_folders(vault, removals, dry_run=True)
    for pr in preview.preview_results:
        print(f"  {pr.item_uid}: {pr.error or 'ok to remove'}")
    if DRY_RUN:
        print("[Dry-run] No folders were deleted.")
        return
    if not FORCE:
        answer = input("Proceed with folder deletion? [y/N]: ").strip().lower()
        if answer not in ("y", "yes"):
            print("Aborted.")
            return
    result = nsf_management.remove_nsf_folders(vault, removals, dry_run=False)

Share Folder command

Grants or removes user access on a Keeper NSF folder.

DotNet CLI

Command: nsf-share-folder

Parameters:

Parameter	Description
position 0	UID of the folder to share (required)
--action	grant (default) or remove
--email	One or more user email addresses to grant or revoke access for (required)
--role	Access role for grant: viewer (default), shared-manager, content-manager, content-share-manager, full-manager

Examples:

My Vault> nsf-share-folder MQ8GwV3F1sQvGmXt-4zv2A --action grant --email [e-mail] --role
 viewer
Granted 'viewer' access to '[e-mail]' on folder 'MQ8GwV3F1sQvGmXt-4zv2A'.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

foreach (var entry in vault.GetKeeperNSFShortcuts())
{
    Console.WriteLine($"{entry.RecordUid}  {entry.Title}  [{entry.Folders.Count} folders]");
    foreach (var f in entry.Folders)
    {
        Console.WriteLine($"  - {f.Name} ({f.FolderUid})");
    }
}

var keepResult = await vault.KeepKeeperNSFRecordInFolder(recordUid, keepFolderUid);
foreach (var removal in keepResult.Removals)
{
    Console.WriteLine($"{(removal.Success ? "[OK]" : "[FAIL]")} {removal.FolderName} ({removal.FolderUid})");
}

Power Commander

Command: Set-KeeperNSFFolderAccess

Alias: nsf-share-folder

Parameters:

Parameter	Description
-FolderUid	UID of the folder to share (required)
-Action	grant (default) or remove
-Email	One or more user email addresses to grant or revoke access for (required)
-Role	Access role for grant: viewer (default), shared-manager, content-manager, content-share-manager, full-manager

Examples:

PS > Set-KeeperNSFFolderAccess -FolderUid wbxwceZdbPVcyuR-7IybjA -Email [e-mail]  -Role viewer
Granted 'viewer' access to '[e-mail]' on folder 'wbxwceZdbPVcyuR-7IybjA'.

Python CLI

Command: nsf-share-folder

Parameters:

folder folder UID or name -a, --action {grant, remove} grant (default) or remove access -e, --email USER email, team name/UID, or @existing for all folder accessors -r, --role {viewer, share-manager, content-manager, content-share-manager, full-manager} --expire-at TIMESTAMP --expire-in PERIOD

Example:

My Vault> nsf-share-folder -a grant -r full-manager -e [e-mail] <folder_uid>
[e-mail]: Access granted successfully
My Vault>

Python SDK

Function : grant_nsf_folder_access

    FOLDER_UID_OR_NAME = "Projects"
    RECIPIENT_EMAIL = "[e-mail]"
    ACTION = "grant"  # grant or remove
    ROLE = "viewer"  # viewer, share-manager, content-manager, content-share-manager, full-manager
    EXPIRATION_TIMESTAMP = None  # Unix ms; optional for grant

    if ACTION == "remove":
        result = nsf_sharing.revoke_nsf_folder_access(
            vault, FOLDER_UID_OR_NAME, RECIPIENT_EMAIL
        )
    else:
        result = nsf_sharing.grant_nsf_folder_access(
            vault,
            FOLDER_UID_OR_NAME,
            RECIPIENT_EMAIL,
            role=ROLE,
            expiration_timestamp=EXPIRATION_TIMESTAMP,
        )

Link Record to Folder command

Links (hard-links) a Keeper NSF record into a Keeper NSF folder, so the record appears in additional folders without being copied.

DotNet CLI

Command: nsf-ln

Parameters:

Parameter	Description
position 0	Record UID or title (required)
position 1	Destination folder UID, name, or / for the Keeper NSF root (required)

Examples:

My Vault> nsf-ln BZ--Sa17UztyFkh5JWWgBg  MQ8GwV3F1sQvGmXt-4zv2A                 
Keeper NSF record linked into folder.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var result = await vault.LinkKeeperNSFRecordToFolder(
    recordUidOrTitle: recordUidOrTitle,
    folderUidOrName:  folderUidOrName);

VaultOnline.ValidateFolderRecordUpdateResult(result);
await vault.SyncDown(false);
Console.WriteLine("Keeper NSF record linked into folder.");

Power Commander

Command: Link-KeeperNSFRecord

Alias: nsf-ln

Parameters:

Parameter	Description
-Record	Record UID or title (required)
-Folder	Destination folder UID, name, or / for the Keeper NSF root (required)

Examples:

PS > Link-KeeperNSFRecord -Record "0UWhXh5vjjlpaw9BpFR0mA" -Folder "ynvMwZsAU5JtTn5RSr1F0Q"
Keeper NSF record linked into folder.

Python CLI

Command: nsf-ln

Parameters:

src record UID or title dst destination folder UID or name

Example:

My Vault> nsf-ln <record_uid> <folder_uid>
Record <record_uid> linked to folder <folder_uid>

Python SDK

Function : link_nsf_record_to_folder

    RECORD_UID_OR_TITLE = "My NSF Login"
    FOLDER_UID_OR_NAME = "Archive"

    result = nsf_folder_records.link_nsf_record_to_folder(
        vault, RECORD_UID_OR_TITLE, FOLDER_UID_OR_NAME
    )
    print(f"Record {result.record_uid} linked to folder {result.folder_uid}")

Remove/Unlink Record command

Removes one or more Keeper NSF records using the v3 remove API. Always runs a preview first, prints the impact, and asks for confirmation unless -Force is supplied.

DotNet CLI

Command: nsf-rm

Parameters:

Parameter	Description
--folder	Folder UID or name that provides context (required for unlink)
-o or --operation	owner-trash (default), folder-trash, or unlink
-f or --force	Skip the confirmation prompt after preview
--dry-run	Preview only; do not remove records

Examples:

My Vault> nsf-rm NBPPHWMkzjss3z_WacXoIA

=== Keeper NSF Remove Preview ===

Record: NBPPHWMkzjss3z_WacXoIA
  Folder context: AAAAAAAAAAAAAAAAAALjjA
  Status: Success
  Impact:
    Folders:          0
    Records:          1
    Affected users:   1
    Affected teams:   0
    Other locations:  1
    Warning: Record will be removed from all folders and moved to owner's trash
Are you sure you want to move the record(s) above to your trash? (yes/No) yes

Removing records...

Keeper NSF record removal completed.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var removals = new List<KeeperNSFRecordRemoval>();
foreach (var name in recordUidsOrTitles)
{
    if (!vault.TryResolveKeeperNSFRecord(name, out var record)) continue;

    vault.TryResolveKeeperNSFRecordRemovalFolder(
        record.RecordUid,
        folderUidOrName,
        KeeperNSFRecordRemoveOperation.FolderTrash,
        out var folderUid);

    removals.Add(new KeeperNSFRecordRemoval
    {
        RecordUid = record.RecordUid,
        FolderUid = folderUid,
        Operation = KeeperNSFRecordRemoveOperation.FolderTrash,
    });
}

var preview = await vault.RemoveKeeperNSFRecords(removals, dryRun: true);
VaultOnline.ValidateRemoveResponse(preview.PreviewResponse, throwOnWarnings: false);

var confirm = await vault.RemoveKeeperNSFRecords(removals, dryRun: false);
if (!confirm.Confirmed)
{
    throw new InvalidOperationException("Record removal was not confirmed by the server.");
}

await vault.SyncDown(false);

Power Commander

Command: Remove-KeeperNSFRecord

Alias: nsf-rm

Parameters:

Parameter	Description
-Record	One or more record UIDs or titles. Accepts pipeline input
-Folder	Folder UID or name that provides context (required for unlink)
-Operation	owner-trash (default), folder-trash, or unlink
-Force	Skip the confirmation prompt after preview
-DryRun	Preview only; do not remove records

Examples:

PS > Remove-KeeperNSFRecord -Record LXU5SAWkCZMTnqeqNBWJNyGw

=== Keeper NSF Remove Preview ===

Record: LXU5SkCZMTnqeqNBWJNyGw
  Folder context: AA123424ASSGREGGBJYAAAAALjjA
  Status: Success
  Impact:
    Folders:          0
    Records:          1
    Affected users:   1
    Affected teams:   0
    Other locations:  1
    Warning: Record will be removed from all folders and moved to owner's trash
Are you sure you want to move the record(s) above to your trash? (yes/No): y

Removing records...

Keeper NSF record removal completed.

Python CLI

Command: nsf-rm

Parameters:

RECORD Record UID(s) or title(s) to remove (max 500) --folder FOLDER Folder UID or name for operation context --operation, -o {owner-trash,folder-trash,unlink} Removal operation (default: owner-trash) --force, -f Skip confirmation after preview --dry-run Preview only; do not delete

Example:

My Vault> nsf-ln <record_uid> <folder_uid>
Record <record_uid> linked to folder <folder_uid>

Python SDK

Function : remove_nsf_records

    RECORD_IDENTIFIERS = ["My NSF Login"]  # UIDs or titles
    OPERATION = "owner-trash"  # owner-trash, folder-trash, unlink
    FOLDER_UID_OR_NAME = None  # Required when OPERATION is unlink
    FORCE = True  # Skip confirmation after preview
    DRY_RUN = False  # Preview only

    if OPERATION == "unlink" and not FOLDER_UID_OR_NAME:
        raise ValueError('--folder is required when operation is "unlink"')

    removals = nsf_management.build_nsf_record_removals(
        vault,
        RECORD_IDENTIFIERS,
        operation_type=OPERATION,
        folder_uid=FOLDER_UID_OR_NAME,
    )
    preview = nsf_management.remove_nsf_records(vault, removals, dry_run=True)
    for pr in preview.preview_results:
        print(f"  {pr.item_uid}: {pr.error or 'ok to remove'}")
    if DRY_RUN:
        print("[Dry-run] No records were deleted.")
        return
    if not FORCE:
        answer = input("Proceed with deletion? [y/N]: ").strip().lower()
        if answer not in ("y", "yes"):
            print("Aborted.")
            return
    result = nsf_management.remove_nsf_records(vault, removals, dry_run=False)
    if result.confirmed:
        print("Record removal completed.")
    else:
        print("Record removal was not confirmed by the server.")