> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/sharing-commands/record-share-command.md). # Record Share Command This Page adds more context to classic record related sharing commands ### Overview The following actions are supported by the share-record command 1. [grant](#share-record-share-command) - grants and changes permissions of a given record to given user. 2. [revoke](#share-record-revoke-command) - revoke current record share. 3. [transfer-ownership](#share-record-transfer-ownership-command) - transfers ownership to a given user. 4. [cancel](#share-cancel-command) - revoke all shares with user. Nested Shared SubFolder sharing Commands can be found [here](/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/nested-shared-folder-commands.md#share-record-command) ### Share Record - Share Command This command can be used to grant access of a record to a user. The user can be given sharing and editing permissions. The access can be limited for a time duration or upto a specific date to be automatically revoked.
DotNet CLI **Command**: `share-record` **Action:** * `share` : Share a record with a user **Flags**: * **`-s, --share`** *(bool, optional)* * Allows the recipient to re-share the record with others. * Example: `--share true` * **`-w, --write`** *(bool, optional)* * Allows the recipient to modify the record. * Example: `--write true` * **`--expire-at`** *(string, optional)* * Sets a specific date/time when the share will expire. * Format: `YYYY-MM-DD HH:mm:SS` (ISO). * Example: c * **`--expire-in`** *(string, optional)* * Sets a relative expiration period for the share. * *Format*: `mi|h|d|mo|y` * `mi` = minutes * `h` = hours * `d` = days * `mo` = months * `y` = years * Example: `--expire-in 7d` (expires in 7 days) * **`-e, --email`** *(string, required)* * Email address of the recipient (peer account). * Example: `--email user@example.com` * **`record`** *(positional, required)* * Record path or UID to be shared. * Example: `MyPasswords/Bank` or `9xL2c6aBc1234` **Example:** ```shell My Vault> share-record share --write=true --share=true --expire-at "2025-09-30 23:59:00" --email="user@email.com" ```
DotNet SDK **Function:** ```csharp public async Task ShareRecordWithUser( string recordUid, string username, IRecordShareOptions options) ``` **Arguments:** * `recordUid` - This is UID of the record which is to be shared with user * `username` - Email of the user with whom we are sharing the record * `IRecordShareOptions` - Sharing options/permissions * **IRecordShareOptions** * `CanEdit` - ***Boolean*** - whether the user with whom we are sharing can edit the record we are sharing with them * `CanShare` - ***Boolean*** - whether the user with whom we are sharing can re-share the record we are sharing with them * `Expiration` - ***DateTimeOffset*** - Share duration for which the user will have access to the record. after the expiration is hit, the shared record will no longer be shared with the user.
Power Commander **Command**: `Grant-KeeperRecordAccess` **Aliases:** `kshr` **Flags:** * `-Record` : Record Uid which needs to be shared. * `-User` : Email ID of user to be shared * `-CanEdit` : Use to grant permission of **Can Manage Records** to the user. * `-CanShare` : Use to grant permission of **Can Manage Users** to the user * `-ExpireIn` : 5 * `-ExpireAt` : Date Object **Example:** ```powershell PS > Grant-KeeperRecordAccess -Record record_uid -User "user@example.com" -CanShare -ExpireIn 5 Record "Example Record" was shared with user@example.com ```
Python CLI **Command**: `share-record --action=<> --email=` **Parameters:** * `record` : \ of record to be shared * `-e, --email` : Email of user to give access to * `-a, --action` : Grant, revoke, owner and cancel - permission set for record **Options**: * `-s, --share` : Allow user to share record * `-w, --write` : Allow user to edit record * `-R, --recursive` : Apply command to the shared folder hierarchy * `--expire-at` : Share expiration: "never" or ISO date-time "YYYY-MM-DD hh:flag\_mm:ss" * `--expire-in` : Share expiration: "never" or period \\[(m)inutes | (h)ours | (d)ays | (y)ears] * `-roe, --rotate-on-expiration` : Rotate `pamUser` password when share access expires. Requires `--expire-at` or `--expire-in`. Cannot be used with `never`. Only valid for `pamUser` records. * `--dry-run` : Show the permission changes without applying them * `--contact-only` : Share with known contacts only, prompts for matching contacts with other domains * `-f, --force` : Skip asking prompts **Example:** ```sh My Vault> share-record -e user@example.com --expire-in 7d --rotate-on-expiration Record "" access permissions has been granted to user 'user@example.com' ```
Python SDK **Example:** ```python import sqlite3 from keepersdk.vault import ( sqlite_storage, vault_online, shares_management, share_management_utils, ) def share_pam_user_with_roe( keeper_auth_context, record_uid: str, user_email: str, expire_in: str = '7d', can_edit: bool = True, can_share: bool = False, enterprise_data=None, ): """ Share a pamUser record with rotate-on-expiration enabled. CLI equivalent: share-record -e user@example.com --expire-in 7d -roe -a grant """ conn = sqlite3.Connection('file::memory:', uri=True) vault_storage = sqlite_storage.SqliteVaultStorage( lambda: conn, vault_owner=bytes(keeper_auth_context.auth_context.username, 'utf-8'), ) vault = vault_online.VaultOnline(keeper_auth_context, vault_storage) vault.sync_down() try: # 1. Parse expiration (required for ROE — not "never") share_expiration = share_management_utils.get_share_expiration( expire_at=None, expire_in=expire_in, ) # 2. Build request — prep_request validates ROE rules internally request = shares_management.RecordShares.prep_request( vault=vault, emails=[user_email], action=shares_management.ShareAction.GRANT.value, uid_or_name=record_uid, # pamUser record UID or path share_expiration=share_expiration, dry_run=False, enterprise=enterprise_data, enterprise_access=False, recursive=False, can_edit=can_edit, can_share=can_share, rotate_on_expiration=True, # sets rotateOnExpiration on share proto ) # 3. Send success, failed = shares_management.RecordShares.send_requests(vault, [request]) print('Success:', success) print('Failed:', failed) vault.sync_down() except share_management_utils.ShareValidationError as err: print(f'Validation error: {err}') raise except ValueError as err: print(f'Error: {err}') raise finally: vault.close() keeper_auth_context.close() # Usage (after your login flow): # keeper_auth_context = ... # share_pam_user_with_roe( # keeper_auth_context, # record_uid='IQ_yourPamUserRecordUid', # user_email='contractor@example.com', # expire_in='7d', # ) ```
JavaScript SDK **Function:** `shareRecord` ```python public async shareRecord(input: ShareRecordInput): Promise { const auth = this.getAuthOrThrow() const record = this.getRecordByUid(input.recordUid) || this.findRecord(input.recordUid) if (!record) { return { recordUid: input.recordUid, email: input.email, success: false, status: VaultStatus.RecordNotFound, message: `Record "${input.recordUid}" not found`, } } ```
### Share Record- Cancel Command This command can be used to remove all shares with the given user
DotNet CLI **Command**: `share-record` **Action:** * `cancel` : cancel a record share with user **Flags**: * **`-e, --email`** *(string, required)* * Email address of the recipient (peer account). * Example: `--email user@example.com` **Example:** ```shell Vault> share-record cancel user@email.com Do you want to cancel all shares with user "user@email.com"? (Yes/No) : yes ```
DotNet SDK **Function:** ```csharp Task CancelSharesWithUser(string username); ``` **Arguments:** `username` - username of user with whom we will cancel all shares **Exception:** ```csharp Authentication.KeeperApiException ```
Power Commander **Command** : `Revoke-KeeperSharesWithUser -User [-Confirm]` **Alias:** `kcancelshare` **Parameters:**
ParameterRequiredDescription
UserYesEmail address of the user with whom to cancel all shares.
ConfirmNoBy default, PowerShell prompts for confirmation (high impact). Use -Confirm:$false to skip the prompt.
**Example:** ```powershell PowerCommander> Revoke-KeeperSharesWithUser -User am@ml.com Confirm Are you sure you want to perform this action? Performing the operation "Cancel" on target "all record shares with user"am@ml.com"". [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): y All record shares with user "am@ml.com" have been cancelled. ```
Python CLI **Command:** `share-record` **Parameters:** * `record` : \ of record to be shared * `-e, --email` : Email of user to give access to * `-a, --action` : Grant, revoke, owner and cancel - permission set for record **Example:** ```sh Vault> share-record --action=cancel --email=user@email.com ```
Python SDK **Command** : ```python request = shares_management.RecordShares.prep_request( vault=vault, emails=[user_email], action=shares_management.ShareAction.CANCEL.value, uid_or_name=record_uid, share_expiration=share_expiration, dry_run=False, enterprise=enterprise_data, enterprise_access=False, recursive=False, can_edit=can_edit, can_share=can_share, ) # Send the request shares_management.RecordShares.send_requests(vault, [request]) ```
JavaScript SDK **Function:** comming soon ```python ```
### Share Record - Revoke Command This command can be used to revoke access of a record to a user.
DotNet CLI **Command**: `share-record` **Action:** * `revoke` : revoke a record share access from user **Flags**: * **`-e, --email`** *(string, required)* * Email address of the recipient (peer account). * Example: `--email user@example.com` * **`record`** *(positional, required)* * Record path or UID to be shared. * Example: `MyPasswords/Bank` or `9xL2c6aBc1234` **Example:** ```shell My Vault> share-record revoke uidaabbcc22556tbuid --email="user@email.com" ```
DotNet SDK **Function:** ```csharp Task RevokeShareFromUser(string recordUid, string username); ``` **Arguments:** * `recordUid` - This is UID of the record which is to be revoked from user * `username` - Email of the user from whom we are revoking the share
Power Commander **Command**: `Revoke-KeeperRecordAccess` **Flags:** * `-Record` : Record Uid * `-User` : Email ID of user to be shared **Example:** ```powershell PS > Revoke-KeeperRecordAccess adscsvv1314dca -User user@email.com Record "some_record" share has been removed from ```
Python SDK **Command** : ```python request = shares_management.RecordShares.prep_request( vault=vault, emails=[user_email], action=shares_management.ShareAction.REVOKE.value, uid_or_name=record_uid, share_expiration=share_expiration, dry_run=False, enterprise=enterprise_data, enterprise_access=False, recursive=False, can_edit=can_edit, can_share=can_share, ) # Send the request shares_management.RecordShares.send_requests(vault, [request]) ```
### Share Record - Transfer Ownership Command This command can be used to grant owner access of a record to a user.
DotNet CLI **Command**: `share-record` **Action:** * `transfer` : Transfer a record / change record ownership. **Flags**: * **`-e, --email`** *(string, required)* * Email address of the recipient (peer account). * Example: `--email user@example.com` * **`record`** *(positional, required)* * Record path or UID to be shared. * Example: `MyPasswords/Bank` or `9xL2c6aBc1234` **Example:** ```shell My Vault> share-record transfer aabbcc2266hyy --email="user@email.com" ```
DotNet SDK **Function:** ```csharp Task TransferRecordToUser(string recordUid, string username) ``` **Arguments:** * `recordUid` - This is UID of the record which is to be shared with user. * `username` - Email of the user with whom we are sharing the record. **Exception:** ```csharp KeeperApiException ```
Power Commander **Command**: `Move-KeeperRecordOwnership` **Flags:** * `-Record` : Record Uid which needs to be shared. * `-User` : Email ID of user to be shared **Example:** ```powershell PS > Move-KeeperRecordOwnership record_uid -User user@email.com Record "" was transfered to user@email.com The new record owner can edit or remove your access to this record. ```
Python SDK **Command** : ```python request = shares_management.RecordShares.prep_request( vault=vault, emails=[user_email], action=shares_management.ShareAction.OWNER.value, uid_or_name=record_uid, share_expiration=share_expiration, dry_run=False, enterprise=enterprise_data, enterprise_access=False, recursive=False, can_edit=can_edit, can_share=can_share, ) # Send the request shares_management.RecordShares.send_requests(vault, [request]) ```
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/sharing-commands/record-share-command.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.