Python SDK 17.3.0

• KSM-992: Added typed KeeperRecordLink linked-credential accessors. record.get_links() returns typed link objects exposing user and permission flags, encryption detection, AES-256-GCM decryption, and meta/ai_settings/jit_settings settings access, matching the Java SDK's KeeperRecordLink API. Purely additive: the raw record.links list is unchanged.
• KSM-877: Added automatic throttle retry with exponential backoff. HTTP 403 throttle responses are retried up to 5 times (11s, 22s, 44s, 88s, 176 s ±25% jitter); retry_after in the response is honored. Raises KeeperThrottleError once retries are exhausted. No caller changes required.
• KSM-932: Added custom server public key support for isolated deployments; key can be supplied programmatically via SecretsManager parameters, embedded in the one-time token (4-segment format), or set in the config file before the first call.
• KSM-807: Fixed partial config file left behind after a failed initialization (expired or already-consumed One-Time Token). The SDK now automatically removes the incomplete file on failure and raises a clear error instructing the user to generate a fresh token.
• KSM-808: Missing config keys now raise KeeperError naming the specific missing field instead of a cryptic TypeError.
• KSM-813: Fixed Windows ACL sequence in set_config_mode() to fully remove Everyone read access from config files (previously only Full Control was removed).
• KSM-819: Fixed RecordCreate.to_dict() silently dropping "custom": [] when no custom fields are set. Records now correctly include the empty list, matching Commander and Vault behavior.
• KSM-1004: KSMCache now resolves the cache path from KSM_CACHE_DIR at call time, so the environment variable is honored even when set after import. Default behavior is unchanged.

Helper Package:

• 1.1.2: Bumped to require keeper-secrets-manager-core>=17.3.0

Links:

• PyPI Core Package
• PyPI Helper Package
• See Python SDK Documentation