NSF Record Commands

Nested Shared Folders SDKs for Record-level commands

Overview

With the introduction of Nested Shared Folders with Role-Based Folder Permissions, we’ve rebuilt the vault’s folder, sharing and permissions model from the ground up, delivering a more flexible and scalable experience for every user and team.

Operations Supported

The Following operations are supported by NSF Shared Folders

1. List NSF records
2. Get NSF records
3. Get records details
4. Add NSF records
5. Edit NSF records
6. Delete NSF records
7. Share records
8. Transfer records

Power Commander

Command: Add-KeeperNSFRecord

Alias: nsf-record-add

Parameters:

Parameter	Description
-Title	Title for the new record (required)
-RecordType	Record type (e.g. login, general). Defaults to general
-FolderUid	Optional folder UID to place the record in
-Notes	Optional notes for the record
-Fields	Optional field values as key=value pairs (e.g. login=admin password=secret url=https://example.com)
-GeneratePassword	generates a random password and stores it on the 'password' field
-GeneratePassphrase	Generate a random passphrase and store it on the 'password' field, Cannot be used together with -GeneratePassword.
When used alone, defaults are: 5 words, "-" separator, useCaps=true, useDigits=true.
-PassphraseRuleValues	Optional passphrase settings (also generates a passphrase when provided): WordCount, Separator, UseCaps, UseDigits. Example: -GeneratePassphrase -PassphraseRuleValues 5,-,true,true (WordCount: 5–9; separators: - . _ ! ? or space).

Examples:

PS > Add-KeeperNSFRecord -Title Test1 -RecordType login login=[e-mail] password=123                                
Record 'Test1' created successfully (UID: LXU5SkCZqwMTnqeqNBWJNyGw).
LXU5SkCZMTnqeqNBWJqwwNyGw

Power Commander

Command: Edit-KeeperNSFRecord

Alias: nsf-record-update

Parameters:

Parameter	Description
-RecordUid	UID of the record to update (required)
-Title	New title for the record
-RecordType	New record type
-Notes	New notes for the record
-Fields	Field values to add or update as key=value pairs
-GeneratePAssword	generates a random password and stores it on the 'password' field
-GeneratePassphrase	Generate a random passphrase and store it on the 'password' field, Cannot be used together with -GeneratePassword.
When used alone, defaults are: 5 words, "-" separator, useCaps=true, useDigits=true.
-PassphraseRuleValues	Optional passphrase settings (also generates a passphrase when provided): WordCount, Separator, UseCaps, UseDigits. Example: -GeneratePassphrase -PassphraseRuleValues 5,-,true,true (WordCount: 5–9; separators: - . _ ! ? or space).

Examples:

PS >  Edit-KeeperNSFRecord -RecordUid LXU5SkCZMTnqeqNBWJNyGw -Title "updated_test" -RecordType contact
Record 'LXU5SkCZMTnqeqNBWJNyGw' updated successfully.

Note : In case you are using records under a classic permission model folder, please refer Record Commands and Shared Folder Record Commands

Record Details command

Retrieves and displays record metadata (UID, title, type, version, revision) for one or more Keeper NSF records. Accepts UIDs or titles, and reports any identifiers that could not be resolved.

DotNet CLI

Command: nsf-record-details

Parameters:

Parameter	Description
--recordUids	One or more record UIDs (or titles) to retrieve details for. Accepted positionally and from remaining arguments
--format	Output format: table (default) or json

Examples:

My Vault> nsf-record-details GS3J1s9ARg1-P5LRQOeRTA q7vvkVySnDPJeYhfA5xCEA
           Record UID: GS3J1s-9ARg1-P5LRQOeRTA
                Title: Record-Share
                 Type: login
              Version: 3
             Revision: 4983790

           Record UID: q7vvkVySnDP-JeYhfA5xCEA
                Title: Rec12
                 Type: login
              Version: 3
             Revision: 4988959

Total records retrieved: 2

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var resolved = new List<KeeperNSFRecord>();
var notFound = new List<string>();

foreach (var id in recordUidsOrTitles)
{
    if (vault.TryResolveKeeperNSFRecord(id, out var rec))
    {
        resolved.Add(rec);
    }
    else
    {
        notFound.Add(id);
    }
}

foreach (var r in resolved)
{
    Console.WriteLine($"UID:      {r.RecordUid}");
    Console.WriteLine($"Title:    {r.Name}");
    Console.WriteLine($"Version:  {r.Version}");
    Console.WriteLine($"Revision: {r.Revision}");
    Console.WriteLine();
}

if (notFound.Count > 0)
{
    Console.WriteLine($"Forbidden / not found: {string.Join(", ", notFound)}");
}

Power Commander

Command: Get-KeeperNSFRecordDetails

Alias: nsf-record-details

Parameters:

Parameter	Description
-RecordUids	One or more record UIDs (or titles) to retrieve details for. Accepted positionally and from remaining arguments
-Format	Output format: table (default) or json

Examples:

PS >  Get-KeeperNSFRecordDetails <record_uid>
           Record UID: <record_uid>
                Title: Updated_nsf
                 Type: contact
              Version: 3
             Revision: 4966123

Total records retrieved: 1

Python CLI

Command: nsf-record-details

Parameters:

record_uids Record UIDs or titles --format {table, json} Output format (default: table)

Example:

My Vault> nsf-record-details <record_uid>
Record UID: <record_uid>
  Title: Test Configuration
  Type: pamNetworkConfiguration
  Version: 6
  Revision: 3623320011

Total records retrieved: 1

Python SDK

Function : get_nsf_record_details

    RECORD_IDENTIFIERS = ["My NSF Login"]  # UIDs or titles

    result = nsf_management.get_nsf_record_details(vault, RECORD_IDENTIFIERS)
    for record in result.get("data", []):
        print(f"Record UID: {record['record_uid']}")
        print(f"  Title: {record.get('title')}")
        print(f"  Type: {record.get('type', 'Unknown')}")
        print(f"  Version: {record.get('version', 0)}")
        print(f"  Revision: {record.get('revision', 0)}")
        print()
    forbidden = result.get("forbidden_records") or []
    if forbidden:
        print(f"Forbidden records: {len(forbidden)}")
        for uid in forbidden:
            print(f"  {uid}")
    print(f"Total records retrieved: {len(result.get('data', []))}")

Add Record command

Creates a new record in Keeper NSF. Optionally sets the record type, target folder, notes, and a set of typed fields.

DotNet CLI

Command: nsf-record-add

Parameters:

Parameter	Description
-t or --type	Record type (e.g. login, general). Defaults to general
--folder	Optional folder UID to place the record in
--notes	Optional notes for the record
-g or --generate	generates a random password and stores it on the 'password' field

Examples:

My Vault> nsf-record-add "H12" --type login --notes "hello" login=a2@exam -g
Record 'H12' created successfully (UID: NBPPHWMkzjss3z_WacXoIA).

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var fields = new Dictionary<string, string>
{
    ["login"]    = login,
    ["password"] = password,
    ["url"]      = url,
};

string newRecordUid = await vault.CreateKeeperNSFRecord(
    title:       title,
    recordType:  "login",
    folderUid:   folderUid,
    notes:       notes,
    fields:      fields);

Console.WriteLine($"Created Keeper NSF record: {newRecordUid}");

Power Commander

Command: Add-KeeperNSFRecord

Alias: nsf-record-add

Parameters:

Parameter	Description
-Title	Title for the new record (required)
-RecordType	Record type (e.g. login, general). Defaults to general
-FolderUid	Optional folder UID to place the record in
-Notes	Optional notes for the record
-Fields	Optional field values as key=value pairs (e.g. login=admin password=secret url=https://example.com)
-GeneratePassword	generates a random password and stores it on the 'password' field

Examples:

PS > Add-KeeperNSFRecord -Title Test1 -RecordType login login=[e-mail] password=123                                
Record 'Test1' created successfully (UID: LXU5SkCZqwMTnqeqNBWJNyGw).
LXU5SkCZMTnqeqNBWJqwwNyGw

Python CLI

Command: nsf-record-add

Parameters:

fields Load record type data from strings with dot notation --syntax-help Display help on field parameters. -f, --force Ignore warnings -t, --title TITLE record title -rt, --record-type RECORD_TYPE -n, --notes NOTES record notes --folder FOLDER folder name or UID to store record

Examples:

My Vault> nsf-record-add -t Test_record_add -n "Test and demo how to create records" -rt login --folder <folder_uid>
NSF record created: <record_uid>

Python SDK

Function : create_nsf_record

    TITLE = "My NSF Login"
    RECORD_TYPE = "login"  # e.g. login, password, general
    FOLDER_UID_OR_NAME = "Projects"  # NSF folder name or UID; None for root
    NOTES = "Created via SDK"
    FIELDS = {
        "login": "[e-mail]",
        "password": "changeme",
        "url": "https://example.com",
    }

    folder_uid = None
    if FOLDER_UID_OR_NAME:
        folder_uid = nsf_management.resolve_nsf_folder_uid(vault, FOLDER_UID_OR_NAME)
        if not folder_uid:
            raise ValueError(f"NSF folder not found: {FOLDER_UID_OR_NAME}")

    result = nsf_management.create_nsf_record(
        vault,
        title=TITLE,
        record_type=RECORD_TYPE,
        folder_uid=folder_uid,
        fields=FIELDS,
        notes=NOTES,
    )
    print(f"NSF record created: {result.record_uid} (status: {result.status})")

Update Record command

Updates an existing Keeper NSF record. Only the supplied parameters are changed; everything else is preserved. At least one of -Title, -RecordType, -Notes, or field values must be specified.

DotNet CLI

Command: nsf-record-update

Parameters:

Parameter	Description
-RecordUid	UID of the record to update (required)
--title	New title for the record
-t or --type	New record type
--notes	New notes for the record
-g or --generate	generates a random password and stores it on the 'password' field

Examples:

My Vault> nsf-record-update "NBPPHWMkzjss3z_WacXoIA" --type login --notes "hello" login=a3@exam -g --title "H134"
Record 'NBPPHWMkzjss3z_WacXoIA' updated successfully.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var fields = new Dictionary<string, string>
{
    ["password"] = newPassword,
};

await vault.UpdateKeeperNSFRecord(
    recordUid:   recordUid,
    title:       newTitle,
    recordType:  null,
    notes:       newNotes,
    fields:      fields);

Console.WriteLine("Keeper NSF record updated.");

Power Commander

Command: Edit-KeeperNSFRecord

Alias: nsf-record-update

Parameters:

Parameter	Description
-RecordUid	UID of the record to update (required)
-Title	New title for the record
-RecordType	New record type
-Notes	New notes for the record
-Fields	Field values to add or update as key=value pairs
-GeneratePAssword	generates a random password and stores it on the 'password' field

Examples:

PS >  Edit-KeeperNSFRecord -RecordUid LXU5SkCZMTnqeqNBWJNyGw -Title "updated_test" -RecordType contact
Record 'LXU5SkCZMTnqeqNBWJNyGw' updated successfully.

Python CLI

Command: nsf-record-update

Parameters:

fields Load record type data from strings with dot notation --syntax-help Display help on field parameters. -f, --force Ignore warnings -t, --title Modify record title -rt, --record-type RECORD_TYPE -n, --notes NOTES modify record notes -r, --record RECORD record UID or title

Example:

My Vault> nsf-record-update -t Test_record_add_nsf -n "Test and demo how to create records" -rt login -r <record_uid>
NSF record updated: <record_uid> (RS_SUCCESS)

Python SDK

Function : update_nsf_record

    RECORD_UID_OR_TITLE = "My NSF Login"
    NEW_TITLE = "My NSF Login (updated)"
    FIELDS = {"password": "new-secret-value"}
    NOTES = "Updated via SDK"

    result = nsf_management.update_nsf_record(
        vault,
        RECORD_UID_OR_TITLE,
        title=NEW_TITLE,
        fields=FIELDS,
        notes=NOTES,
    )
    print(f"NSF record updated: {result.record_uid} (status: {result.status})")

Remove/Unlink Record command

Removes one or more Keeper NSF records using the v3 remove API. Always runs a preview first, prints the impact, and asks for confirmation unless -Force is supplied.

DotNet CLI

Command: nsf-rm

Parameters:

Parameter	Description
--folder	Folder UID or name that provides context (required for unlink)
-o or --operation	owner-trash (default), folder-trash, or unlink
-f or --force	Skip the confirmation prompt after preview
--dry-run	Preview only; do not remove records

Examples:

My Vault> nsf-rm NBPPHWMkzjss3z_WacXoIA

=== Keeper NSF Remove Preview ===

Record: NBPPHWMkzjss3z_WacXoIA
  Folder context: AAAAAAAAAAAAAAAAAALjjA
  Status: Success
  Impact:
    Folders:          0
    Records:          1
    Affected users:   1
    Affected teams:   0
    Other locations:  1
    Warning: Record will be removed from all folders and moved to owner's trash
Are you sure you want to move the record(s) above to your trash? (yes/No) yes

Removing records...

Keeper NSF record removal completed.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var removals = new List<KeeperNSFRecordRemoval>();
foreach (var name in recordUidsOrTitles)
{
    if (!vault.TryResolveKeeperNSFRecord(name, out var record)) continue;

    vault.TryResolveKeeperNSFRecordRemovalFolder(
        record.RecordUid,
        folderUidOrName,
        KeeperNSFRecordRemoveOperation.FolderTrash,
        out var folderUid);

    removals.Add(new KeeperNSFRecordRemoval
    {
        RecordUid = record.RecordUid,
        FolderUid = folderUid,
        Operation = KeeperNSFRecordRemoveOperation.FolderTrash,
    });
}

var preview = await vault.RemoveKeeperNSFRecords(removals, dryRun: true);
VaultOnline.ValidateRemoveResponse(preview.PreviewResponse, throwOnWarnings: false);

var confirm = await vault.RemoveKeeperNSFRecords(removals, dryRun: false);
if (!confirm.Confirmed)
{
    throw new InvalidOperationException("Record removal was not confirmed by the server.");
}

await vault.SyncDown(false);

Power Commander

Command: Remove-KeeperNSFRecord

Alias: nsf-rm

Parameters:

Parameter	Description
-Record	One or more record UIDs or titles. Accepts pipeline input
-Folder	Folder UID or name that provides context (required for unlink)
-Operation	owner-trash (default), folder-trash, or unlink
-Force	Skip the confirmation prompt after preview
-DryRun	Preview only; do not remove records

Examples:

PS > Remove-KeeperNSFRecord -Record LXU5SAWkCZMTnqeqNBWJNyGw

=== Keeper NSF Remove Preview ===

Record: LXU5SkCZMTnqeqNBWJNyGw
  Folder context: AA123424ASSGREGGBJYAAAAALjjA
  Status: Success
  Impact:
    Folders:          0
    Records:          1
    Affected users:   1
    Affected teams:   0
    Other locations:  1
    Warning: Record will be removed from all folders and moved to owner's trash
Are you sure you want to move the record(s) above to your trash? (yes/No): y

Removing records...

Keeper NSF record removal completed.

Python CLI

Command: nsf-rm

Parameters:

RECORD Record UID(s) or title(s) to remove (max 500) --folder FOLDER Folder UID or name for operation context --operation, -o {owner-trash,folder-trash,unlink} Removal operation (default: owner-trash) --force, -f Skip confirmation after preview --dry-run Preview only; do not delete

Example:

My Vault> nsf-ln <record_uid> <folder_uid>
Record <record_uid> linked to folder <folder_uid>

Python SDK

Function : remove_nsf_records

    RECORD_IDENTIFIERS = ["My NSF Login"]  # UIDs or titles
    OPERATION = "owner-trash"  # owner-trash, folder-trash, unlink
    FOLDER_UID_OR_NAME = None  # Required when OPERATION is unlink
    FORCE = True  # Skip confirmation after preview
    DRY_RUN = False  # Preview only

    if OPERATION == "unlink" and not FOLDER_UID_OR_NAME:
        raise ValueError('--folder is required when operation is "unlink"')

    removals = nsf_management.build_nsf_record_removals(
        vault,
        RECORD_IDENTIFIERS,
        operation_type=OPERATION,
        folder_uid=FOLDER_UID_OR_NAME,
    )
    preview = nsf_management.remove_nsf_records(vault, removals, dry_run=True)
    for pr in preview.preview_results:
        print(f"  {pr.item_uid}: {pr.error or 'ok to remove'}")
    if DRY_RUN:
        print("[Dry-run] No records were deleted.")
        return
    if not FORCE:
        answer = input("Proceed with deletion? [y/N]: ").strip().lower()
        if answer not in ("y", "yes"):
            print("Aborted.")
            return
    result = nsf_management.remove_nsf_records(vault, removals, dry_run=False)
    if result.confirmed:
        print("Record removal completed.")
    else:
        print("Record removal was not confirmed by the server.")

Share Record command

Shares or unshares a Keeper NSF record with one or more users. When granting, the record key is encrypted for and sent to each recipient.

DotNet CLI

Command: nsf-share-record

Parameters:

Parameter	Description
position 0	UID of the record to share or unshare (required)
--action	grant (default) or revoke
--email	One or more user email addresses (required)
--role	Access role for grant: viewer (default), shared-manager, content-manager, content-share-manager, full-manager

Examples:

My Vault> nsf-share-record BZ--Sa17UztyFkh5JWWgBg --action grant --email [e-mail] --role
Granted 'viewer' access to '[e-mail]' on record 'BZ--Sa17UztyFkh5JWWgBg'.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

foreach (var email in emails)
{
    await vault.ShareKeeperNSFRecord(
        recordUid: recordUid,
        userEmail: email,
        role:      "content-manager");
}

await vault.UnshareKeeperNSFRecord(
    recordUid: recordUid,
    userEmail: emailToRemove);

Power Commander

Command: Set-KeeperNSFRecordAccess

Alias: nsf-share-record

Parameters:

Parameter	Description
-RecordUid	UID of the record to share or unshare (required)
-Action	grant (default) or revoke
-Email	One or more user email addresses (required)
-Role	Access role for grant: viewer (default), shared-manager, content-manager, content-share-manager, full-manager

Examples:

PS > Set-KeeperNSFRecordAccess -RecordUid ykGAnzx6n1VRMcH-SPTtsA -Email [e-mail] -Role viewer
Granted 'viewer' access to '[e-mail]' on record 'ykGAnzx6n1VRMcH-SPTtsA'.

Python CLI

Command: Not implemented

Parameters:

record record UID, title, or folder -e, --email recipient email (repeatable) -a, --action {grant, revoke, owner} -r, --role {viewer, share-manager, content-manager, content-share-manager, full-manager} -R, --recursive apply command to shared folder hierarchy --dry-run display the permissions changes without committing them --expire-at EXPIRE_AT share expiration: never or UTC datetime --expire-in [(mi)nutes|(h)ours|(d)ays|(mo)nths|(y)ears] share expiration: never or period

Example:

My Vault> nsf-share-record -e [e-mail] -a grant -r content-manager --expire-in 45mi <record_uid>
Record <record_uid> permissions grant for [e-mail]
My Vault>

Python SDK

Function : share_nsf_record_with_action

    RECORD_UID_OR_TITLE = "My NSF Login"
    RECIPIENT_EMAIL = "[e-mail]"
    ACTION = "grant"  # grant, revoke, owner
    ROLE = "viewer"  # Required for grant
    RECURSIVE = False
    EXPIRATION_TIMESTAMP = None

    record_uids = nsf_sharing.resolve_nsf_share_record_uids(
        vault, RECORD_UID_OR_TITLE, recursive=RECURSIVE
    )
    for record_uid in record_uids:
        result, effective = nsf_sharing.share_nsf_record_with_action(
            vault,
            record_uid,
            RECIPIENT_EMAIL,
            action=ACTION,
            role=ROLE,
            expiration_timestamp=EXPIRATION_TIMESTAMP,
        )
        if result.success:
            print(f"Record {record_uid} permissions {effective} for {RECIPIENT_EMAIL}")
        else:
            msg = result.results[0]["message"] if result.results else "failed"
            print(f"Share failed for {record_uid}: {msg}")

Transfer Record command

Transfers ownership of one or more Keeper NSF records to another user. Positional arguments: one or more record UIDs (or titles) followed by the new owner's email address. After a successful transfer you no longer own the record(s).

DotNet CLI

Command: nsf-transfer-record

Parameters:

Parameter	Description
position 0	One or more record UIDs or titles, then the new owner's email address as the last positional argument (required)
--force	Skip the safety warning prompt

Examples:

My Vault> nsf-transfer-record BZ--Sa17UztyFkh5JWWgBg [e-mail]

*** WARNING ***
After ownership is transferred you will lose owner rights on the record(s).
You may still see the record(s) if you retain access via a shared folder or admin role; otherwise they will disappear after sync.
Make sure the new owner is correct before continuing.

Are you sure you want to transfer ownership to '[e-mail]'? This action cannot be undone. (yes/No) y
Record 'BZ--Sa17UztyFkh5JWWgBg' ownership transferred to [e-mail].
You no longer own this record. Run sync-down to refresh; it will remain visible only if you retain accessvia a shared folder or admin role.

DotNet SDK

Function:

var vault = new VaultOnline(auth);
await vault.SyncDown();

var records = new List<string> { recordUidOrTitle1, recordUidOrTitle2 };

var results = await vault.TransferKeeperNSFRecordOwnership(
    recordUidOrTitles: records,
    newOwnerEmail:     newOwnerEmail);

VaultOnline.ValidateKeeperNSFTransferResults(results);

foreach (var result in results)
{
    Console.WriteLine($"Record '{result.RecordUid}' ownership transferred to {result.Username}.");
}

await vault.SyncDown(false);

Power Commander

Command: Transfer-KeeperNSFRecordOwnership

Alias: nsf-transfer-record

Parameters:

Parameter	Description
-ArgumentList	One or more record UIDs or titles, then the new owner's email address as the last positional argument (required)
-Force	Skip the safety warning prompt

Examples:

PS > Transfer-KeeperNSFRecordOwnership oqf7DOKZvSYuwhwFc6qvOw [e-mail]

*** WARNING ***
After ownership is transferred you will lose owner rights on the record(s).
You may still see the record(s) if you retain access via a shared folder or admin role; otherwise they will disappear after sync.
Make sure the new owner is correct before continuing.

Are you sure you want to transfer ownership to '[e-mail]'? This action cannot be undone. (yes/No): y
Record 'oqf7DOKZvSYuwhwFc6qvOw' ownership transferred to [e-mail].
You no longer own this record. Run Sync-Keeper to refresh; it will remain visible only if you retain access via a shared folder or admin role.

Python CLI

Command: nsf-transfer-record

Parameters:

record_uids record UID(s) or title(s)

new_owner_email new owner email

Example:

My Vault> nsf-transfer-record <record_uid> [e-mail]
Record '<record_uid>' transferred to [e-mail]
You will no longer have access to this record!
My Vault>

Python SDK

Function : transfer_nsf_record_ownership

    RECORD_IDENTIFIERS = ["My NSF Login"]
    NEW_OWNER_EMAIL = "[e-mail]"

    for identifier in RECORD_IDENTIFIERS:
        result = nsf_sharing.transfer_nsf_record_ownership(
            vault, identifier, NEW_OWNER_EMAIL
        )
        for row in result.results:
            if row.get("success"):
                print(f"Record '{row['record_uid']}' transferred to {NEW_OWNER_EMAIL}")
                print("You will no longer have access to this record!")
            else:
                print(f"Transfer failed: {row.get('message')}")