Linked Credentials

Information about retrieving credentials linked to PAM resource records with the Secrets Manager SDKs.

About

Records in Keeper can be linked to one another through GraphSync. The most common use is Privileged Access Manager: a PAM resource record (a PAM Machine, Database, Directory, or Remote Browser) links to the pamUser records that operate it, along with metadata describing what each user is allowed to do.

The Secrets Manager SDKs expose these links on each record so you can discover, for example, which users administer a given machine and which one is the launch credential.

Links are returned only when you ask for them. Retrieving links increases response size and processing time, so request them only when you need them.

Retrieving Linked Records

Pass a request-links option to the secrets query. Each SDK exposes this through its query-options object; the method and flag names per language are in the Cross-SDK Reference below.

from keeper_secrets_manager_core import SecretsManager
from keeper_secrets_manager_core.storage import FileKeyValueStorage
from keeper_secrets_manager_core.dto.payload import QueryOptions

secrets_manager = SecretsManager(config=FileKeyValueStorage('ksm-config.json'))

# request links along with the records
# QueryOptions takes records_filter and folders_filter first; pass None for both to fetch everything
query = QueryOptions(records_filter=None, folders_filter=None, request_links=True)
records = secrets_manager.get_secrets_with_options(query)

for record in records:
    for link in record.links:
        print(f"{record.title} ({record.type}) -> {link['recordUid']}")
        if link.get('path'):
            print(f"  path: {link['path']}")

You only get links if you request them. Empty-vs-absent behavior differs by SDK: Java/Kotlin return null when links were not requested and an empty list when requested but none exist; Python and Rust return an empty collection in both cases (so you cannot tell "not requested" from "none exist"). Check for emptiness before iterating.

Links appear on resource records (PAM Machine/Database/Directory/Remote Browser). A pamUser record's own links are always empty — there is no back-reference. To find every machine a user operates, iterate the resource records.

Link Object Structure

Each link is an object with three fields:

Field	Type	Description
recordUid	String	UID of the linked record
data	String (optional)	Base64-encoded link payload; null when the edge carries no data
path	String (optional)	Identifies what data means; null for a basic user link

The path value determines how to interpret data:

path	data contents	Notes
null / empty	User-link metadata, JSON (snake_case)	recordUid is the linked pamUser. Admin / launch / IAM / rotation flags.
meta	Resource's own settings, JSON (camelCase)	recordUid is the resource's own UID (self-reference).
ai_settings	Encrypted blob	Decrypt with the resource record's own key.
jit_settings	Encrypted blob	Just-In-Time access config; decrypt with the record's own key.
domain	Link edge	Machine → directory reference used by JIT lookups.

User-link data (path is null)

Decoded JSON, snake_case keys. All fields optional — treat missing as false/absent.

{
  "is_admin": true,
  "is_launch_credential": true,
  "is_iam_user": false,
  "belongs_to": true,
  "rotation_settings": { "schedule": "", "disabled": false, "noop": false }
}

Meta-link data (path is "meta")

Decoded JSON, camelCase keys.

{
  "version": 1,
  "allowedSettings": {
    "rotation": true,
    "connections": true,
    "portForwards": true,
    "sessionRecording": true,
    "typescriptRecording": true,
    "aiEnabled": false
  },
  "rotateOnTermination": false
}

User-link data uses snake_case keys; meta-link data uses camelCase. SDKs that return links untyped (everything except Java/Kotlin) leave this translation to you.

Cross-SDK Reference

All SDKs that support linked records expose the same wire fields; the surface differs by language.

	Query method	Request-links flag	Links accessor	Link shape
Java / Kotlin	getSecrets2(opts, qopts)	requestLinks	record.getLinks()	typed KeeperRecordLink (22 helper methods)
Python	get_secrets_with_options(qopts)	request_links	record.links	list of dicts
JavaScript	getSecrets2(opts, qopts)	requestLinks	record.links	{recordUid, data?, path?}
.NET	GetSecrets2(opts, qopts)	RequestLinks	record.Links	typed KeeperRecordLink (properties)
Go	GetSecretsWithOptions(qopts)	RequestLinks	record.Links	typed RecordLink struct
Rust	get_secrets_with_options(qopts)	request_links	record.links	Vec<HashMap<String, Value>>

Only the Java/Kotlin SDK provides typed accessor methods over the link data today. The other SDKs return the raw {recordUid, data, path} structure and you parse data yourself. For the full typed surface, see the Java Linked Credentials reference.

Method Reference (Java / Kotlin)

The typed KeeperRecordLink methods, for reference. Other SDKs read the same underlying wire fields shown above.

Method	Returns	Description
getRecordUid()	String	Target record UID
getPath()	String	Link metadata type
getData()	String	Raw Base64 link data
isAdminUser()	boolean	User has admin privileges
isLaunchCredential()	boolean	This is a launch credential
allowsRotation()	boolean	Password rotation allowed
allowsConnections()	boolean	Connections allowed
allowsPortForwards()	boolean	Port forwarding allowed
allowsSessionRecording()	boolean	Session recording enabled
allowsTypescriptRecording()	boolean	Typescript recording enabled
allowsRemoteBrowserIsolation()	boolean	RBI allowed
rotatesOnTermination()	boolean	Rotates on session termination
getDecodedData()	String	Base64 decode without decryption
getDecryptedData(byte[])	String	Decrypt data using the record key
getAiSettingsData(byte[])	Map	AI settings access
getJitSettingsData(byte[])	Map	JIT settings access
getSettingsForPath(String, byte[])	Map	Generic settings access by path

Important Notes

• linksToRemove removes files, not record links. The linksToRemove parameter in update options removes file attachments; it does not delete GraphSync record links.
• Encryption. ai_settings and jit_settings payloads are encrypted with the resource record's own key — decrypt with that key, not a vertex/keychain key.
• Performance. Requesting links increases response size and processing time; filter records when you can.