> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/pedm-commands/pedm-approval-commands.md).

# KEPM Approval Commands

### Overview

This section covers all the Keeper Commander commands for managing KEPM privilege elevation approval requests. Approvals manage privilege elevation requests that require administrative approval before execution. These commands allow administrators to view pending requests and take action by approving, denying, or removing approval requests.

This section supports the following commands:

* [**Approval List Command**](#approval-list-command)
* [**Approval Action Command**](#approval-action-command)

### Usage

`pedm approval command [--options]`

***

### Approval List Command

View all privilege elevation approval requests with their status, details, and expiration information. Administrators can filter by approval status to view pending, approved, denied, or expired requests.

<details>

<summary>DotNet CLI</summary>

**Command:** `epm-approval list`&#x20;

**Parameters**:

<table><thead><tr><th width="220.99993896484375">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>--expired</code></td><td>List only expired approvals.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```bash
My Vault > epm-approval
```

{% endcode %}

**Command**: `epm-approval view`&#x20;

**Parameters**:

<table><thead><tr><th width="194">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><em>(positional)</em></td><td>Approval UID.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```bash
My Vault > epm-approval view abc123uid
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**&#x20;

{% code expandable="true" %}

```csharp
// Get status as int (0=Pending, 1=Approved, 2=Denied)
int? status = plugin.GetApprovalStatus(approvalUid);

// List all approvals
IEnumerable<EpmApproval> approvals = plugin.Approvals.GetAll();

// Get single approval
EpmApproval approval = plugin.Approvals.GetEntity(approvalUid);

// Check if expired locally
bool isExpired = approval.ExpireIn > 0 
    && DateTimeOffset.UtcNow.ToUnixTimeSeconds() > (approval.Created + approval.ExpireIn);
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command:** `Get-KeeperEpmApprovalList`&#x20;

**Alias**: `kepm-approval-list`&#x20;

**Parameters**:

| Parameter | Description                                                                         |
| --------- | ----------------------------------------------------------------------------------- |
| `-Type`   | Filter by approval status: `approved`, `denied`, `pending`, `expired`, `escalated`. |

**Examples**:

{% code expandable="true" %}

```ps1
PS > Get-KeeperEpmApprovalList

Approval UID           Approval Type Status  Agent UID              Account Info          Application Info
------------           ------------- ------  ---------              ------------          ----------------                         
bYEWk2Ido0mcPMoASh9mgw CommandLine   EXPIRED xerWlrlsaF_YLdHDx75c-g Username: mohsinnaqvi FileName: sudo, Description: sudo, FileP…
fKaUe6VE3ESDk0oXSCVIIg CommandLine   EXPIRED xerWlrlsaF_YLdHDx75c-g Username: mohsinnaqvi FileName: sudo, Description: sudo, FileP…
```

{% endcode %}

**Command**: `Get-KeeperEpmApproval`&#x20;

**Alias**: `kepm-approval-view`&#x20;

**Parameters**:

<table><thead><tr><th width="233.00006103515625">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-ApprovalUid</code></td><td>The approval record UID.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```ps
PS > Get-KeeperEpmApproval ovhhkpsKak6xExtREkSroA
Approval: ovhhkpsKak6xExtREkSroA
  Type: CommandLine
  Status: DENIED
  Agent UID: xerWlrlsaF_YLdHDx75c-g
  Account Info: Username: mohsinnaqvi
  Application Info: FileName: sudo, Description: sudo, FilePath: /usr/bin...
  Justification: text: test jira, timestamp: 05/11/2026 23:10:20
  Expire In: N/A
  Created: 2026-05-11 17:40:21
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `pedm approval list`

**Aliases:** `pedm approval l`

**Flags:**

| Flag       | Description                                                             |
| ---------- | ----------------------------------------------------------------------- |
| `--type`   | Filter by approval status (choices: approved, denied, pending, expired) |
| `--format` | Output format - json, csv, or table                                     |
| `--output` | Save output to specified file                                           |

**Example:**

```
My Vault> pedm approval list --type pending

Approval UID: approval_abc123
Approval Type: PrivilegeElevation
Status: Pending
Agent UID: agent_xyz789
Account Info: User=john.doe
Application Info: Process=powershell.exe
Justification: System maintenance
Expire In: 300
Created: 2024-11-05 10:30:00
```

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```python
from keepersdk.plugins.pedm import admin_plugin

plugin = admin_plugin.PedmPlugin(enterprise_loader)
approval_list = plugin.approvals.get_all_entities()
```

</details>

### Approval Action Command

Take action on privilege elevation approval requests by approving, denying, or removing them. This command supports bulk operations and special values like @approved, @denied, @expired, and @pending to target groups of requests.

<details>

<summary>DotNet CLI</summary>

**Command:** `epm-approval approve`&#x20;

**Parameters**:

<table><thead><tr><th width="193">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><em>(positional)</em></td><td>Approval UID.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```bash
My Vault > epm-approval approve abc123uid
```

{% endcode %}

**Command**: `epm-approval deny`&#x20;

**Parameters**:

<table><thead><tr><th width="211.99993896484375">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><em>(positional)</em></td><td>Approval UID.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```bash
My Vault > epm-approval deny abc123uid
```

{% endcode %}

**Command**: `epm-approval remove`

**Parameters**:

<table><thead><tr><th width="206">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><em>(positional)</em></td><td>Approval UID.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```bash
My Vault > epm-approval remove abc123uid
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

**Function:**&#x20;

{% code expandable="true" %}

```csharp
public Task<ModifyStatus> ModifyApprovals(
    IEnumerable<string> toApproveUids = null,
    IEnumerable<string> toDenyUids = null,
    IEnumerable<string> toRemoveUids = null)
```

{% endcode %}

</details>

<details>

<summary>Power Commander</summary>

**Command:** `Approve-KeeperEpmApproval`&#x20;

**Alias**: `kepm-approval-approve`&#x20;

**Parameters**:

<table><thead><tr><th width="161.99993896484375">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-ApprovalUid</code></td><td>The approval record UID.</td></tr></tbody></table>

**Example**:

{% code expandable="true" %}

```ps1
PS > Approve-KeeperEpmApproval "abc123uid"
```

{% endcode %}

**Command**: `Deny-KeeperEpmApproval`&#x20;

**Alias**: `kepm-approval-deny`&#x20;

**Parameters**:

<table><thead><tr><th width="161.99993896484375">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-ApprovalUid</code></td><td>The approval record UID.</td></tr></tbody></table>

**Example**:

{% code expandable="true" %}

```ps1
PS > Deny-KeeperEpmApproval "abc123uid"
```

{% endcode %}

**Command**: `Remove-KeeperEpmApproval`&#x20;

**Alias**: `kepm-approval-remove`&#x20;

**Parameters**:

<table><thead><tr><th width="187">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-ApprovalUid</code></td><td>The approval record UID.</td></tr><tr><td><code>-Force</code></td><td>Skip confirmation prompt before delete.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```ps1
PS > Remove-KeeperEpmApproval "abc123uid"
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `pedm approval action`

**Aliases:** `pedm approval a`

**Flags:**

| Flag        | Description                                                                                         |
| ----------- | --------------------------------------------------------------------------------------------------- |
| `--approve` | Request UIDs to approve - can be repeated                                                           |
| `--deny`    | Request UIDs to deny - can be repeated                                                              |
| `--remove`  | Request UIDs to remove, or special values: @approved, @denied, @expired, @pending - can be repeated |

**Examples:**

```
My Vault> pedm approval action --approve approval_abc123

Approval request approved successfully
```

```
My Vault> pedm approval action --deny approval_def456

Approval request denied successfully
```

```
My Vault> pedm approval action --remove @expired

All expired approval requests removed successfully
```

</details>

<details>

<summary>Python SDK</summary>

**Function:**

```python
from keepersdk.plugins.pedm import admin_plugin

plugin = admin_plugin.PedmPlugin(enterprise_loader)

def verify_uid(uids: Any) -> Optional[List[bytes]]:
    if isinstance(uids, str):
        uids = [uids]
    if isinstance(uids, list):
        to_uid = []
        for uid in uids:
            approve_uid = utils.base64_url_decode(uid)
            if len(approve_uid) == 16:
                to_uid.append(approve_uid)
            else:
                logger.warning(f'Invalid UID: {uid}')
        if len(to_uid) > 0:
            return to_uid
    return None

list_approve = ['names or uids of approval requests to approve']
list_deny = ['names or uids of approval requests to deny']
list_remove = ['names or uids of approval requests to remove']
to_approve = verify_uid([list('')])
to_deny = verify_uid(kwargs.get('deny'))
to_remove = kwargs.get('remove')
if to_remove:
    if isinstance(to_remove, str):
        to_remove = [to_remove]
    to_remove_set: Set[bytes] = set()
    to_resolve = []
    for uid in to_remove:
        if uid == '@approved':
            to_remove_set.update(
                (utils.base64_url_decode(x.approval_uid) for x in plugin.storage.approval_status.get_all_entities() if x.approval_status == NotificationCenter_pb2.NAS_APPROVED))
        elif uid == '@denied':
            to_remove_set.update(
                (utils.base64_url_decode(x.approval_uid) for x in plugin.storage.approval_status.get_all_entities() if x.approval_status == NotificationCenter_pb2.NAS_DENIED))
        elif uid == '@pending':
            to_remove_set.update(
                (utils.base64_url_decode(x.approval_uid) for x in plugin.storage.approval_status.get_all_entities() if x.approval_status == NotificationCenter_pb2.NAS_UNSPECIFIED))
        else:
            to_resolve.append(uid)
    if len(to_resolve) > 0:
        to_remove = verify_uid(to_resolve)
        if isinstance(to_remove, list):
            to_remove_set.update(to_remove)
    to_remove = list(to_remove_set)

status_rs = plugin.modify_approvals(to_approve=to_approve, to_deny=to_deny, to_remove=to_remove)
```

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/pedm-commands/pedm-approval-commands.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.