> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/privileged-access-manager/references/importing-pam-resources/using-a-csv-template.md). # Using a CSV Template Use CSV data and a JSON template to create validated KeeperPAM imports. ## Choose an import path Keeper Commander supports two CSV-to-JSON workflows: 1. **CSV only** creates bare `pamMachine`, `pamDirectory`, and `pamUser` records from the values in the CSV. 2. **CSV with a JSON template** applies shared connection, rotation, and PAM Configuration settings while the CSV supplies the machine- and user-specific values. Use a JSON template for any import that must create usable SSH, RDP, or database connections. CSV-only imports do not infer a machine management port, operating system, session protocol, or credential mapping. ## Validate before importing Always validate the generated JSON before creating a PAM project: ```bash pam project import --filename /absolute/path/pam_import.json --name "My PAM Project" --dry-run ``` Use an absolute file path. Do not rely on `~` expansion in the Commander command. Confirm that the dry run reports the expected number of resources and users before running the import without `--dry-run`. For more validation and troubleshooting guidance, see Validate a PAM Project Import. ## CSV-only imports ### Required fields The minimum CSV fields are: | hostname | username | user\_path | password | | ----------------- | ------------- | ----------------- | ------------------ | | DESKTOP-001.local | | | | | | Administrator | DESKTOP-001.local | REPLACE-BEFORE-USE | `user_path` identifies the resource that owns a user. The example creates a machine named `DESKTOP-001.local` and a nested PAM user named `DESKTOP-001.local - Administrator`. A minimum CSV-only import creates a bare resource similar to this: ```json { "title": "DESKTOP-001.local", "type": "pamMachine", "host": "DESKTOP-001.local", "pam_settings": { "options": { "rotation": "off", "connections": "on", "tunneling": "off", "graphical_session_recording": "on" }, "connection": {} }, "users": [ { "title": "DESKTOP-001.local - Administrator", "login": "Administrator", "password": "REPLACE-BEFORE-USE", "type": "pamUser" } ] } ``` This record is not yet configured for an interactive connection or password rotation. Add the required advanced fields, or use a JSON template. ### Do not use empty rotation settings Omit `rotation_settings` when rotation is not configured. Do **not** use an empty object: ```json "rotation_settings": {} ``` In affected Commander versions, an empty object is interpreted as a rotation request. It can produce `Failed to load rotation schedule` warnings and stop the import while the first resource is processed. Supply a complete rotation configuration only when rotation is intended. Some versions of `pam_import_generator_v2.py` emit an empty `rotation_settings` object for CSV-only output. Remove that property from the generated JSON before importing if you are not configuring rotation. ## Configure usable machines with advanced CSV fields A usable machine needs both a management port and an interactive session configuration: * `rs.port`: management or rotation port, such as `22`, `5985`, or `5986`. * `rs.operating_system`: the machine operating system. * `rs.pam_settings.connection.protocol`: interactive protocol, such as `ssh` or `rdp`. * `rs.pam_settings.connection.port`: interactive session port, such as `22` for SSH or `3389` for RDP. * `rs.pam_settings.connection.administrative_credentials`: a PAM user title or login used for administrative operations. * `rs.pam_settings.connection.launch_credentials`: a PAM user title or login used to launch the connection. * `rs.pam_settings.connection.allow_supply_user`: allow the session user to provide a username when no launch credential is selected. Example: Windows machine with a WinRM management port and RDP session port. ```csv hostname,username,user_path,password,rs.port,rs.operating_system,rs.ssl_verification,rs.pam_settings.connection.protocol,rs.pam_settings.connection.port,rs.pam_settings.connection.allow_supply_user,rs.pam_settings.connection.administrative_credentials,rs.pam_settings.connection.launch_credentials DESKTOP-001.local,,,,5986,Windows,true,rdp,3389,true,DESKTOP-001.local - Administrator,DESKTOP-001.local - Administrator ,Administrator,DESKTOP-001.local,REPLACE-BEFORE-USE,,,,,,,, ``` Credential references must match a unique PAM user title or login. The CSV generator can de-duplicate repeated usernames globally, so use unique user titles and usernames when generating multiple local accounts. Other fields can be applied with `rs.` for resources and `usr.` for users. Examples include: ``` rs.port rs.operating_system rs.pam_settings.connection.protocol rs.pam_settings.connection.administrative_credentials usr.distinguished_name usr.rotation_settings.enabled ``` `folder_path` is only used by `pam project extend`; it is ignored by `pam project import`. ## CSV with a JSON template Use a JSON template when machines share configuration. The template defines the project, PAM Configuration, and default machine settings; the CSV supplies host- and user-specific values. Your machine template should include complete connection settings. For example: ```json { "type": "pamMachine", "title": "xxx:server", "host": "xxx:server", "port": "5986", "ssl_verification": true, "operating_system": "Windows", "pam_settings": { "options": { "rotation": "on", "connections": "on", "tunneling": "on", "graphical_session_recording": "on" }, "connection": { "protocol": "rdp", "port": "3389", "allow_supply_user": true, "administrative_credentials": "Example AD.DomainAdmin", "launch_credentials": "Example AD.DomainAdmin", "security": "any", "ignore_server_cert": true } }, "users": [ { "type": "pamUser", "title": "xxx:admin", "login": "xxx:Administrator", "password": "REPLACE-BEFORE-USE" } ] } ``` Replace values beginning with `XXX:` with your static configuration. Values beginning with `xxx:` are placeholders replaced from CSV data. Use the complete template in [Importing PAM Resources](/keeperpam/privileged-access-manager/references.md) when your import also includes a PAM Directory or shared credential configuration. ## Run the conversion Download [pam\_import\_generator\_v2.py](https://github.com/Keeper-Security/Commander/blob/master/examples/pam_import_generator_v2.py) and save it with your CSV and, if used, `import_template.json`. ```bash python3 pam_import_generator_v2.py --input-file servers_to_import.csv --output-file pam_import.json ``` For a JSON template: ```bash python3 pam_import_generator_v2.py --input-file servers_to_import.csv --template-file import_template.json --output-file pam_import.json --prefix-names ``` Before creating the project, run the generated file with `--dry-run` as shown above. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.keeper.io/keeperpam/privileged-access-manager/references/importing-pam-resources/using-a-csv-template.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.