> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/backend/backend-api/backend-api-18.1.10.md).

# Backend API 18.1.10

Released October 6, 2026

### New Features

* **Nested Shared Folder Account Transfer**: Enterprise administrators can now transfer departing user accounts containing Nested Shared Folder files, directories, and nested folder structures directly into a designated container folder in the recipient's vault, preserving access permissions and decryptability.
* **On-Demand Permanent Deletion & Empty Trash**: Users can permanently delete selected records and purge their entire trashcan in a single action, ensuring complete removal of deleted items and attachments while respecting enterprise retention rules.
* **Privileged Access Management (PAM) Workflow Audit Logging:** Comprehensive ARAM audit logging is now available for Privileged Access Management workflows, recording access request submissions, session checkouts, and session check-ins.
* **Keeper Secrets Manager (KSM) Integration with Nested Shared Folder:** Expanded Secrets Manager capabilities allow automated clients to create, update, and delete secrets and folders located directly within Nested Shared Folder shared folders based on user permissions.
* **Granular Delegated Admin Permissions for Automator:** Added stricter administrative access controls requiring the "Perform Device Approvals" privilege in addition to node management to configure or manage Keeper Automator instances.
* **Real-Time Role Enforcement Updates:** Client vaults now receive prompt notifications when administrative role enforcement policies change, immediately synchronizing policy changes across active sessions.

#### Improvements

* **KA-6786**: Adds real-time notifications to client applications whenever administrator role enforcements are updated. Allows client sessions to immediately reflect policy changes without requiring a manual logout or app restart.
* **KA-8218:** Enables sharing of Nested Shared Folder folders directly with integrated applications through existing application share workflows. Ensures seamless compatibility when managing access permissions across both standard and Drive shared folders.
* **KA-8283:** Enables Keeper Secrets Manager clients to delete secrets stored within Nested Shared  Folders based on user permissions. Ensures proper authorization checks and consistent status responses during automated secret cleanup operations.
* **KA-8284:** Allows Keeper Secrets Manager integrations to update folder properties within Nested Shared Folder directory structures. Enforces granular folder-level edit permissions to ensure secure folder management via API.
* **KA-8285:** Adds support for automated folder creation inside Nested Shared Folders via Keeper Secrets Manager. Ensures newly created subfolders inherit appropriate access rights and encryption context seamlessly.
* **KA-8329:** Enables Keeper Secrets Manager to delete folders located within Nested Shared Folder directories when permitted. Validates folder access rights and returns individual status outcomes for mixed deletion batches.
* **KA-8355:** Allows Keeper Secrets Manager to create new secrets directly inside designated Nested Shared Folders. Ensures newly created secrets adhere to folder permissions and zero-knowledge encryption standards.
* **KA-8629:** Enables enterprise administrators to securely transfer vault contents from departing employees to designated recipients. Preserves vital corporate records, folder hierarchies, and permissions while maintaining Keeper’s zero-knowledge security architecture.
* **KA-8742:** Enterprise account transfers with Nested Shared Folders now place transferred content in a dedicated top-level folder in the recipient’s drive, keeping the recipient’s root directory organized and preserving clear file provenance.
* **KA-8744:** Preserves Nested Shared Folder content, nested folder hierarchies, and file permissions during enterprise account transfers. Consolidates transferred Drive resources into a single recipient folder, ensuring immediate accessibility without orphan files.
* **KA-8916:** Introduces a secure key rotation mechanism for session token encryption. Enhances backend cryptographic hygiene and operational security without interrupting active user sessions.
* **KA-9021:** Enhances the account transfer service to support designated destination folders for Nested Shared Folder assets. Ensures all transferred folders and records are systematically organized during user offboarding workflows.
* **KA-9109:** Introduces a user-initiated "Empty Trash" feature and selective permanent deletion for individual records and folders. Ensures complete purging of deleted items and attachments while enforcing organization retention and removal policies.
* **KA-9144:** Hardens the permanent deletion sequence to ensure removal signals are broadcast before access teardown. Prevents residual ghost folders from lingering in user vaults following permanent folder deletion.
* **KA-9145:** Grants recipient accounts full ownership and decryption capabilities for all nested Nested Shared Folder records during account transfers. Ensures transferred nested records can be managed, restored from trash, and re-shared by the recipient seamlessly.
* **KA-9149:** Adds new Admin Console audit log events for Privileged Access Management workflow session start and end activities. Gives administrators full audit trail tracking for user checkout and checkin actions on privileged records.
* **KA-9158:** Improves database connection routing during folder operations to maintain strict transactional consistency. Ensures high data integrity and reliability during concurrent folder updates and permission changes.
* **KA-9171:** Enhances user deletion processing by snapshotting affected collaborator lists when deletion is initiated. Guarantees that retry attempts continue to notify all relevant collaborators promptly without missing sync events.
* **KA-9473:** Introduces cryptographic payload signing on outbound requests sent to Keeper Automator instances. Strengthens communication security and verifies the authenticity of automated administrative actions.
* **KA-9502:** Resolves event-handling errors encountered during cloud-native application protection audit event logging. Ensures continuous, error-free ingestion and reporting of security audit events.
* **KA-9577:** Adds Admin Console audit event logging for user-submitted privileged access workflow requests. Enables administrators to monitor and report on access request submissions across protected enterprise records.

### Bugs

* **KA-8961:** Fixed an issue where parent folder references continued to sync to client vaults after access was revoked. Ensures user vaults cleanly remove revoked parent folders while properly maintaining explicitly granted child folders.
* **KA-8965:** Fixed an API error where sharing records without required encryption keys returned a server error instead of a validation error. The endpoint now returns a clean bad request response, improving client-side error handling and diagnostics.
* **KA-8966:** Fixed an API issue where providing an invalid or truncated record key triggered an unexpected server failure. Requests with invalid key parameters are now properly validated and return appropriate client-side error codes.
* **KA-9017:** Resolved an issue where revoking access to a parent folder inadvertently removed user access from nested folders. Child folders with explicit, independent user permissions now remain accessible in the user’s vault as expected.
* **KA-9071:** Fixed a defect where deleting Nested Shared Folder records via Secrets Manager prevented them from appearing in the trashcan. Deleted Drive records now correctly move to the owner’s trash folder and are available for recovery.
* **KA-9077:** Resolved an issue where expiration of a Privileged Access Management trial incorrectly disabled standalone add-on licenses. Active standalone licenses for Secrets Manager, Connection Manager, and Remote Browser Isolation now remain active.
* **KA-9132:** Fixed an issue where records deleted by a Full Manager did not automatically update in the record owner’s vault. Vault synchronization now immediately reflects shared record deletions across all participants without requiring a manual sync.
* **KA-9172:** Resolved an issue where secrets granted via direct application shares remained accessible via Secrets Manager after deletion. Trashed Nested Shared Folder records are now properly hidden from secret retrieval until restored by an authorized user.
* **KA-9298:** Ensured shared folder record removal restrictions are properly enforced for Nested Shared Folder records in Secrets Manager. Prevents automated or restricted clients from deleting records from shared folders when policy restrictions apply.
* **KA-9471:** Fixed an access control oversight by requiring the "Perform Device Approvals" administrative permission for Automator management. Ensures delegated administrators can only configure and manage Automators on nodes where they hold explicit approval authority.
* **KA-9535:** Optimized vault synchronization queries for Nested Shared Folder records by eliminating unnecessary data payload fetching. Significantly reduces data transfer overhead, lowering network latency and improving sync responsiveness.
* **KA-9551:** Resolved an issue where performing consecutive folder moves within deep folder structures disrupted subsequent vault syncs. Folder hierarchy reorganizations now maintain consistent folder positioning and accurate synchronization state across clients.
* **KA-9596:** Fixed an input validation issue where removing an account from the account switch list succeeded even with an empty username. The API now validates the username parameter and returns a bad request response when required fields are missing.
* **KA-9611:** Fixed a synchronization issue occurring after repeatedly toggling user permissions on nested shared folders. Ensures that restoring folder access after prior revocations properly updates client vaults and folder visibility.

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/release-notes/backend/backend-api/backend-api-18.1.10.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.