KEPM Deployment Commands

This page gives information of commands related to perform operations related to PEDM deployments

Overview

This section covers all the Keeper Commander commands for managing KEPM agent deployments. Deployments represent agent deployment configurations and provide the tokens needed to install and register KEPM agents on endpoints. These commands allow administrators to create, view, update, and delete deployment configurations.

This section supports the following commands:

Deployment List Command

Deployment Add Command

Deployment Edit Command

Deployment Delete Command

Deployment Download Command

Usage

pedm deployment command [--options] OR pedm d command [--options]

Alias: d

---

Deployment List Command

View all KEPM deployments with their details including deployment UID, name, status, creation date, and associated agent count. Useful for monitoring and managing multiple deployment configurations across the organisation.

DotNet CLI

Command: epm-deployment list

Alias: epm-dep list

Examples:

My Vault > epm-deployment lists

Get Particular deployment details

Command: epm-deployment view

Alias: epm-dep view

Parameters:

Parameter	Description
(positional)	Deployment UID or name (case-insensitive).
--name	Alternative: deployment name.

Example:

My Vault > epm-deployment view "My Deployment"

DotNet SDK

Function:

IEnumerable<EpmDeployment> allDeployments = plugin.Deployments.GetAll();

// Get a single deployment by UID
EpmDeployment deployment = plugin.Deployments.GetEntity(deploymentUid);

Power Commander

Command: Get-KeeperEpmDeploymentList

Alias: kepm-deployment-list

Example:

PS > Deployment UID         Name              Disabled Created                Modified            Agent Count
--------------              ----              -------- -------                --------            -----------
hXdaU89PDvdMxhT2oMpmTw     DEP 1                False    2026-05-04 12:13:10 2026-05-04 12:13:10           2
evd5VHCeD66VgjrGLQWj9A     DEP 2                False    2026-04-30 10:32:55 2026-04-30 10:32:55           0
VXj_WRD8Lg9JXyMDHnFODA     DEP 3                False    2026-04-22 08:40:16 2026-04-30 13:39:43           0
vvpOO8FihzHCeg4CZ-_bwA     DEP 4                False    2026-03-17 07:17:39 2026-03-17 07:17:39           0
NXpB2cmMj1D1q30U5taghg     DEP 5                False    2026-03-12 15:32:44 2026-03-12 15:32:44           0

Get Particular Deployment Full details

Command: Get-KeeperEpmDeployment

Alias: kepm-deployment-view

Parameter:

Parameter	Description
-DeploymentUidOrName	Deployment UID or deployment name (case-insensitive).

Example:

PS > Get-KeeperEpmDeployment  hXdaU89PDvdMxhT2oMpmTw
Deployment: DEP 1
  UID: hXdaU89PDvdMxhT2oMpmTw
  Status: Active
  Created: 2026-05-04 12:13:10
  Modified: 2026-05-04 12:13:10

Python SDK

Function:

from keepersdk.plugins.pedm import admin_plugin

plugin = admin_plugin.PedmPlugin(enterprise_loader)
deployments = plugin.deployments.get_all_entities()

Deployment Add Command

Create a new KEPM deployment configuration. This command generates a unique deployment token that can be used to install and register KEPM agents on endpoints. The deployment serves as a logical grouping for agents.

DotNet CLI

Command: epm-deployment add

Alias: epm-dep add

Parameters:

Parameter	Description
--name	Deployment display name.
--spiffe-cert	SPIFFE certificate file path (.cer, .der, .pem) or base64url-encoded string.
-f, --force	Allow adding a deployment whose name already exists.

Example:

My Vault> epm-deployment add --name "Test Servers"      
Deployment 'Test Servers' added.
  Added: v1V-I5PrHXwvK82epoP_Yw

DotNet SDK

Function: ModifyDeployments

Example:

public async Task<ModifyStatus> ModifyDeployments(
    IEnumerable<DeploymentDataInput> addDeployments = null,
    IEnumerable<DeploymentDataInput> updateDeployments = null,
    IEnumerable<string> removeDeployments = null)

Power Commander

Command: Add-KeeperEpmDeployment

Alias: kepm-deployment-add

Parameters:

Parameter	Description
-Name	Deployment display name.
-Force	If set, allow adding a deployment whose name already exists.

Example:

PS > Add-KeeperEpmDeployment -Name "Example Servers"                                     
Deployment 'Example Servers' added.
  Added: QNRf1KWsxDg6YkLxJaZTbA

Python SDK

Function:

from keepersdk.plugins.pedm import admin_plugin

deployment_name = 'deployment name'
plugin = admin_plugin.PedmPlugin(enterprise_loader)

ec_public_key = crypto.unload_ec_public_key(enterprise_data.enterprise_info.ec_public_key)
agent_info = pedm_shared.DeploymentAgentInformation(hash_key=plugin.agent_key, peer_public_key=ec_public_key)
spiffe_cert = cert.public_bytes(serialization.Encoding.DER)

add_rq = admin_types.AddDeployment(name=deployment_name, spiffe_cert=spiffe_cert, agent_info=agent_info)
response = plugin.modify_deployments(add_deployments=[add_rq])

Deployment Edit Command

Modify an existing KEPM deployment's settings such as name or enabled/disabled status. This command allows administrators to update deployment configurations without recreating them.

DotNet CLI

Command: epm-deployment update

Alias: epm-dep update

Parameters:

Parameter	Description
(positional)	Deployment UID or name (case-insensitive).
--name	New deployment display name.
--disabled	true or false — disable or enable the deployment.
--spiffe-cert	SPIFFE certificate file path (.cer, .der, .pem) or base64url-encoded string.

Example:

My Vault > epm-deployment update "Test Servers" --name "Test1 Servers"      
Deployment 'v1V-I5PrHXwvK82epoP_Yw' updated.
  Updated: v1V-I5PrHXwvK82epoP_Yw

DotNet SDK

Function: ModifyDeployments

Example:

public async Task<ModifyStatus> ModifyDeployments(
    IEnumerable<DeploymentDataInput> addDeployments = null,
    IEnumerable<DeploymentDataInput> updateDeployments = null,
    IEnumerable<string> removeDeployments = null)

Power Commander

Command: Update-KeeperEpmDeployment

Alias: kepm-deployment-edit

Parameters:

Parameter	Description
-DeploymentUidOrName	Deployment UID or deployment name (case-insensitive).
-Name	New deployment display name.
-Enable	Use on or off to enable or disable the deployment.

Example:

PS > Update-KeeperEpmDeployment -DeploymentUidOrName "Example Servers" -Name "Renamed Deployment"
Deployment 'QNRf1KWsxDg6YkLxJaZTbA' updated.
  Updated: QNRf1KWsxDg6YkLxJaZTbA

Python SDK

Function:

from keepersdk.plugins.pedm import admin_plugin

deployment_name = 'deployment name'
plugin = admin_plugin.PedmPlugin(enterprise_loader)

deployment = plugin.deployments.get_entity(deployment_name)
spiffe_cert = cert.public_bytes(serialization.Encoding.DER)

name= 'new name'
disable = True ## or false
update_rq = admin_types.UpdateDeployment(
            deployment_uid=deployment.deployment_uid, name=name, disabled=disabled, spiffe_cert=spiffe_cert)
response = plugin.modify_deployments(update_deployments=[update_rq])

Deployment Delete Command

Remove one or more KEPM deployments from the system. This command permanently deletes deployment configurations and should be used with caution, especially when agents are still associated with the deployment.

DotNet CLI

Command: epm-deployment remove

Alias: epm-dep remove, epm-deployment delete

Parameters:

Parameter	Description
(positional)	Deployment UID or name (case-insensitive).
-f, --force	Skip confirmation prompt before delete.

Example:

My Vault> epm-deployment remove "Test1 Servers"
Do you want to delete 1 deployment(s)? [y/n]: y
  Removed: v1V-I5PrHXwvK82epoP_Yw

DotNet SDK

Function: ModifyDeployments

Example:

public async Task<ModifyStatus> ModifyDeployments(
    IEnumerable<DeploymentDataInput> addDeployments = null,
    IEnumerable<DeploymentDataInput> updateDeployments = null,
    IEnumerable<string> removeDeployments = null)

Power Commander

Command: Remove-KeeperEpmDeployment

Alias: kepm-deployment-delete

Parameters:

Parameter	Description
-DeploymentUidOrName	Deployment UID or deployment name (case-insensitive).
-Force	Skip confirmation prompt before delete.

Example:

PS > Remove-KeeperEpmDeployment "Renamed Deployment"

Confirm
Are you sure you want to perform this action?
Performing the operation "Delete" on target "deployment 'Renamed Deployment'".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y
Deployment 'QNRf1KWsxDg6YkLxJaZTbA' deleted.
  Removed: QNRf1KWsxDg6YkLxJaZTbA

Python SDK

Function:

from keepersdk.plugins.pedm import admin_plugin

deployment_name = 'deployment name'
plugin = admin_plugin.PedmPlugin(enterprise_loader)

deployment = plugin.deployments.get_entity(deployment_name)
response = plugin.modify_deployments(remove_deployments=[deployment.uid])

Deployment Download Command

Retrieve the deployment token needed for KEPM agent installation. This command can display the token on screen or save it to a file, and optionally show download URLs for agent installation packages for Windows, MacOS, and Linux platforms.

DotNet CLI

Command: epm-deployment download

Alias: epm-dep download

Parameters:

Parameter	Description
(positional)	Deployment UID or name (case-insensitive).
--file	File path to write deployment token and download URLs (tab-separated, UTF-8).
--verbose	Verbose output.

Example:

My Vault > epm-deployment download "Production Servers"

DotNet SDK

Function: Not Supported

Power Commander

Command:Get-KeeperEpmDeploymentDownload

Alias: kepm-deployment-download

Parameters:

Parameter	Description
-DeploymentUidOrName	Deployment UID or deployment name (case-insensitive).
-File	Optional path to write token and download URLs (tab-separated) as UTF-8.

Example:

PS > Get-KeeperEpmDeploymentDownload "EPMTEST"
WARNING: The deployment token contains a private key. Treat it as a secret and do not share it insecurely.
Windows download URL    https://keepersecurity.com/pam/pedm/core/1.2.0.291/KeeperPrivilegeManagerWindows.zip
MacOS download URL      https://keepersecurity.com/pam/pedm/core/1.2.0.291/KeeperPrivilegeManagerMacOS.zip
Linux download URL      https://keepersecurity.com/pam/pedm/core/1.2.0.291/KeeperPrivilegeManagerLinux.zip
Deployment Token        keepersecurity.com:vvpOOn80jdyb8FihzHCeg4CZ-_bwA:f34Ull-C_Fqwerraoykg78012lh2O2tJOjONaE1YvNRoKU2lHy60J8090w6k

Python SDK

Function: Not Supported