Keeper Security

https://docs.keeper.io/en
Admin
Keeper Security is a comprehensive password management and privileged access management platform...
Tokens:1,278,472
Snippets:16,546
Trust Score:9.8
Update:5 months ago
Show doc for...
Tokens:
Raw
### Example Deployment Script

Source: https://docs.keeper.io/en/keeperpam/endpoint-privilege-manager/deployment/deploy-with-windows

A simple script to silently install the agent, wait for the service to start, and then register the device with a deployment token.

```powershell
# Install silently
Start-Process msiexec.exe -ArgumentList "/i KeeperPrivilegeManager.msi /quiet /norestart" -Wait

# Give the service time to start
Start-Sleep -Seconds 20

# Register the device
Start-Process "C:\Program Files\Keeper Security\Endpoint Privilege Manager\Jobs\bin\KeeperRegistrationHelper\KeeperRegistrationHelper.exe" `
    -ArgumentList "--token YOUR_TOKEN_HERE" -Wait
```

--------------------------------

### New Machine Setup for KCM

Source: https://docs.keeper.io/en/keeper-connection-manager/pre-release-testing

Set the image pattern and run the setup script for a new KCM installation. You will be prompted for a license key.

```bash
export KCM_SETUP_IMAGE_PATTERN="keepersecurityinc/%s-dev"
sudo -E ./kcm-setup.run
```

--------------------------------

### Basic Environment Variable Setup Example

Source: https://docs.keeper.io/en/keeperpam/commander-cli/commander-installation-setup/configuration/configure-default-working-directory

Demonstrates setting the KEEPER_DATA_HOME environment variable to a custom path and launching Commander.

```bash
# Set custom data directory
export KEEPER_DATA_HOME="/opt/keeper"
keeper shell
# config.json stored in: /opt/keeper/.keeper/
```

--------------------------------

### Dynamic Documentation Query Example

Source: https://docs.keeper.io/en/keeperpam/commander-cli/service-mode-rest-api/api-usage

This example demonstrates how to perform an HTTP GET request to dynamically query documentation by appending an 'ask' parameter with a natural language question.

```http
GET https://docs.keeper.io/en/keeperpam/commander-cli/service-mode-rest-api/api-usage.md?ask=<question>
```

--------------------------------

### Initiate ManageEngine Import

Source: https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/import-and-export-commands/manageengine-import

Use this command to start the import process from a ManageEngine server. Replace the example URL with your server's address and port. You will be prompted to enter your ManageEngine API token.

```bash
$ keeper import --format=manageengine https://localhost:7272
```

--------------------------------

### Agent Instructions for Querying Documentation

Source: https://docs.keeper.io/en/enterprise-guide/event-reporting

This example demonstrates how to query the documentation dynamically using an HTTP GET request with the 'ask' query parameter. This is useful for retrieving specific information not explicitly present on the page.

```http
GET https://docs.keeper.io/en/enterprise-guide/event-reporting.md?ask=<question>
```

--------------------------------

### Querying Documentation via HTTP GET

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/gitlab-plugin

This example shows how to dynamically query the documentation using an HTTP GET request with the 'ask' query parameter. This is useful for retrieving specific information or clarifications not explicitly present on the page.

```http
GET https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/gitlab-plugin.md?ask=<question>
```

--------------------------------

### Query Documentation Example

Source: https://docs.keeper.io/en/keeper-connection-manager/advanced-configuration/guacamole.properties/duo-two-factor-authentication-configuration-properties

Demonstrates how to query the documentation dynamically using an HTTP GET request with the 'ask' query parameter. This is useful for retrieving specific information or clarifications not explicitly present on the page.

```http
GET https://docs.keeper.io/en/keeper-connection-manager/advanced-configuration/guacamole.properties/duo-two-factor-authentication-configuration-properties.md?ask=<question>
```

--------------------------------

### Automator Setup and Initialization

Source: https://docs.keeper.io/en/release-notes/developer-tools/automator/automator-version-2.1

After installing the new Automator version, use these commands from Commander to set up, initialize, and enable the service.

```bash
My Vault> automator setup XXX
My Vault> automator init XXX
My Vault> automator enable XXX
```

--------------------------------

### KCM Setup Script Commands

Source: https://docs.keeper.io/en/keeper-connection-manager/installation/auto-docker-install/service-management

This table lists the available commands for the `kcm-setup.run` script, detailing their functionality for managing the Keeper Connection Manager installation.

```bash
backup
Perform an automated self-check of all services.
```

```bash
check
Perform an automated self-check of all services.
```

```bash
install
Install Keeper Connection Manager (DEFAULT).
```

```bash
logs
Display the log files from all installed services.
```

```bash
reconfigure
Modify the configuration of an existing KCM installation.
```

```bash
restart
Restart all installed services, starting any that are stopped.
```

```bash
restore
Restore database data from a prior backup.
```

```bash
start
Start all installed services that are not started.
```

```bash
status
Display the status of installed services.
```

```bash
stop
Stop all installed services that are not stopped.
```

```bash
uninstall
Completely remove the existing installation. This will delete all stored data in the database.
```

```bash
upgrade
Upgrade the existing installation by pulling the latest docker images. Your data stored in the service is retained.
```

```bash
apply
Strictly apply changes made externally to `docker-compose.yml` and do not pull new images.
```

```bash
version
Print out the version of each component of your KCM instance (`db`, `guacamole`, `guacd`, `ssl`)
```

--------------------------------

### Query Documentation API Example

Source: https://docs.keeper.io/en/enterprise-guide/event-reporting/splunk

Demonstrates how to query the documentation dynamically by making an HTTP GET request to the page URL with an 'ask' query parameter.

```http
GET https://docs.keeper.io/en/enterprise-guide/event-reporting/splunk.md?ask=<question>
```

--------------------------------

### Dynamic Documentation Query

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/secrets-manager-command-line-interface/exec-command

This example demonstrates how to query the documentation dynamically using an HTTP GET request with the `ask` query parameter. This is useful for retrieving specific information or related documentation sections.

```http
GET https://docs.keeper.io/en/keeperpam/secrets-manager/secrets-manager-command-line-interface/exec-command.md?ask=<question>
```

--------------------------------

### Example: Get All Secrets by Title

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/rust-sdk

Shows how to initialize the Secrets Manager and fetch all secrets matching a given title. Replace `your_base64_goes_here` with your actual configuration string.

```rust
use keeper_secrets_manager_core::
    core::{ClientOptions, SecretsManager},
    storage::InMemoryKeyValueStorage,
    custom_error::KSMRError;
fn main()-> Result<(), KSMRError>{
    // setup secrets manager
    let config_string = "your_base64_goes_here".to_string();
    let config = InMemoryKeyValueStorage::new_config_storage(Some(config_string))?;
    let client_options = ClientOptions::new_client_options(config);
    let mut secrets_manager = SecretsManager::new(client_options)?;

    // get all secrets matching the record title
    let matching_secrets = secrets_manager.get_secrets_by_title("My Credentials")?;
    println!("Found {} matching secrets", matching_secrets.len());

    Ok(())
}
```

--------------------------------

### Dynamic Documentation Query Example

Source: https://docs.keeper.io/en/enterprise-guide/email-address-changes

Perform an HTTP GET request to query documentation dynamically using the 'ask' query parameter. The question should be specific and self-contained.

```http
GET https://docs.keeper.io/en/enterprise-guide/email-address-changes.md?ask=<question>
```

--------------------------------

### Install Go SDK

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/golang-sdk

Install the Go SDK from GitHub. Ensure you have Go 1.16+ installed.

```bash
$ go get github.com/keeper-security/secrets-manager-go/core
```

--------------------------------

### Get Keeper Audit Report with Regex Pattern (PowerShell)

Source: https://docs.keeper.io/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/reporting-commands/audit-report-command

Use this PowerShell command to retrieve audit reports matching a specific regular expression pattern. This example filters for events starting with 'login'.

```powershell
PS > Get-KeeperAuditReport "regex:login.*"
```

--------------------------------

### Streamlined Service Creation (Basic)

Source: https://docs.keeper.io/en/keeperpam/commander-cli/service-mode-rest-api

Quickly configures the service with a specified port, command access controls, and configuration format. Defaults to foreground mode with HTTP.

```bash
service-create -p 9090 -c 'record-add,whoami' -f json
```

--------------------------------

### Install and Start Keeper Agent

Source: https://docs.keeper.io/en/keeperpam/endpoint-privilege-manager/deployment/deploy-with-linux

This script installs the Keeper Privilege Manager package, starts the service, and registers the device. It's suitable for automation tools.

```bash
#!/bin/bash
# Install package
dpkg -i keeper-privilege-manager*.deb

# Start service
systemctl start keeper-privilege-manager

# Wait for startup
sleep 20

# Register device
/opt/keeper/sbin/Jobs/bin/KeeperRegistrationHelper/KeeperRegistrationHelper --token="YOUR_TOKEN_HERE"
```

--------------------------------

### Install and Start SSO Connect on Linux

Source: https://docs.keeper.io/en/sso-connect-on-prem/update-instructions

Steps for updating SSO Connect on Linux, including backing up the current installation, removing old files, extracting the new version, and starting the service. Ensure Java 11 is installed.

```bash
cd /path/to/keeper

# backup the install folder
tar czf keeperbackup.tar.gz keeper/
cd keeper/

# remove the application files but leave data and logs
rm -f *
rm -fR services/
rm -fR static/

# copy the new SSO zip and extract it without overwriting
mv /path/to/KeeperSso_java.zip .
unzip -n KeeperSso_java.zip

# this depends on how you start the service
nohup java -jar SSOConnect.jar &
```

--------------------------------

### Create a Login Record Example

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/.net-sdk

Example demonstrating the creation of a 'login' type record with username and a generated password. Replace '[FOLDER UID]' with your actual shared folder UID.

```csharp
var newRecord = new KeeperRecordData{type = "login", title = "Sample KSM Record: C#"};

newRecord.fields = new[]
{
    new KeeperRecordField { type = "login", value = new[] { "My Username" } },
    new KeeperRecordField { type = "password", value = new[] { CryptoUtils.GeneratePassword() } },
};
newRecord.notes = "This is a C# record creation example";

var recordUid = await SecretsManagerClient.CreateSecret(options, folderUid, newRecord);
```

--------------------------------

### Install and Enable haveged on CentOS/Rocky Linux

Source: https://docs.keeper.io/en/keeper-connection-manager/installation/preparing-for-installation

On CentOS or Rocky Linux, first install the EPEL repository, then install `haveged`, and finally start and enable the service.

```bash
sudo yum install epel-release
sudo yum install haveged
sudo systemctl start haveged
sudo systemctl enable haveged
```

--------------------------------

### Get Command Example

Source: https://docs.keeper.io/en/keeperpam/commander-cli/service-mode-rest-api/api-usage

This JSON object represents the successful response of a 'get' command, showing details about attachments, sharing, and record metadata.

```json
{ "command": "get", "data": { "attachments": "service_config.yaml 537b ID: XYZ", "last_modified": "2025-01-18 15:35:21", "share_admins": "<xyz@email.com>", "shared": "False", "shared_users": "<xyz@email.com> (Owner)", "title": "Commander Service Mode", "type": "", "uid": "folder_uid_string" }, "status": "success" }
```

--------------------------------

### Example: Create Service Mode with TLS Certificate

Source: https://docs.keeper.io/en/keeperpam/commander-cli/service-mode-rest-api

Demonstrates an interactive service creation process, including enabling TLS with certificate paths and passwords. This example shows a full interactive session.

```bash
My Vault> service-create
Enter Port No:9090
Enable Ngrok Tunneling? (y/n):n
Enable TLS Certificate (y/n):y
Enter Certificate Path:/Users/cert/cert.pem
Enter Certificate Password:/Users/cert/key.pem
Enable Request Queue? (y/n):y
Enable Advanced Security? (y/n):n
Select Run Mode (foreground/background):foreground
List of supported commands, Enter comma separated:whoami,record-add,tree,ls
Select configuration format (json/yaml):yaml
Generated API key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Uploading service_config.yaml ...
Commander Service starting on https://localhost:9090/api/v2/
Commander Service started with PID: 35215
```

--------------------------------

### Check and Start Keeper Service on Windows

Source: https://docs.keeper.io/en/keeperpam/endpoint-privilege-manager/setup

Use PowerShell to check the status of Keeper services and start them if they are not running. This is essential for verifying the EPM installation.

```powershell
Get-Service | Where-Object {$_.Name -match 'keeper' -or $_.DisplayName -match 'keeper'} | Select-Object Name, DisplayName, Status
```

```powershell
Get-Service | Where-Object {$_.Name -match 'keeper' -or $_.DisplayName -match 'keeper'} | Where-Object {$_.Status -ne 'Running'} | Start-Service
```

--------------------------------

### Install and Enable haveged on RHEL

Source: https://docs.keeper.io/en/keeper-connection-manager/installation/preparing-for-installation

On RHEL systems, install the `haveged` package from the EPEL repository, then start and enable the service to increase entropy generation speed.

```bash
sudo yum install haveged
sudo systemctl start haveged
sudo systemctl enable haveged
```

--------------------------------

### Example service_config.yaml Configuration

Source: https://docs.keeper.io/en/keeperpam/commander-cli/service-mode-rest-api/advanced-settings

This YAML configuration demonstrates how to set up advanced settings, including multiple API tokens with specific command lists and expiration times.

```yaml
encryption: ''
encryption_private_key: ''
ip_allowed_list: 0.0.0.0/0
ip_denied_list: ''
is_advanced_security_enabled: n
ngrok: y
ngrok_auth_token: XXXXXXXXXX
ngrok_custom_domain: myname
ngrok_public_url: ''
cloudflare: n
cloudflare_tunnel_token: 
cloudflare_custom_domain: 
cloudflare_public_url: ''
tls_certificate: n
certfile: ''
certpassword: ''
port: 9090
rate_limiting: ''
queue_enabled: y
run_mode: foreground
fileformat: yaml
records:
- api-key: XXXXXXXX
  command_list: tree,record-add
  expiration_timestamp: '9999-12-31T23:59:59'
- api-key: XXXXXXXX
  command_list: get
  expiration_timestamp: '9999-12-31T23:59:59'
```

--------------------------------

### Get Audit Events - Example Success Response

Source: https://docs.keeper.io/en/keeperpam/commander-cli/admin-rest-api/aram-events

Example JSON response for a successful retrieval of audit events. Includes event details and pagination information.

```json
{
  "has_more": true,
  "events": [
    {
      "audit_event": "login_failure",
      "remote_address": "10.15.12.197",
      "category": "ADMIN",
      "client_version": "Commander 17.1.0",
      "enterprise_id": 8560,
      "username": "admin@example.com",
      "timestamp": 1751910807587
    }
  ],
  "continuation_token": "vWiXa0eu2edoe_fonw5IJHwEbLmxXOACIvuoQRh7j4XiKuu1"
}
```

--------------------------------

### Agent Instructions: Querying Documentation

Source: https://docs.keeper.io/en/keeper-connection-manager/authentication/multiple-hostnames

Demonstrates how to query the documentation dynamically using an HTTP GET request with the 'ask' query parameter.

```http
GET https://docs.keeper.io/en/keeper-connection-manager/authentication/multiple-hostnames.md?ask=<question>
```

--------------------------------

### Example Success Response for Get Security Benchmarks

Source: https://docs.keeper.io/en/keeperpam/commander-cli/admin-rest-api/risk-management

This is an example of a successful response (200 OK) when retrieving security benchmarks. It lists various benchmarks and their current status.

```json
{
  "security_benchmarks": [
    {
      "id": "SB_DEPLOY_ACROSS_ENTIRE_ORGANIZATION",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "last_updated": "2025-12-11 23:37:29",
      "id": "SB_PREVENT_INSTALLATION_OF_UNTRUSTED_EXTENSIONS",
      "auto_resolve": false,
      "status": "RESOLVED"
    },
    {
      "id": "SB_ENABLE_ACCOUNT_TRANSFER_POLICY",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_REDUCE_ADMINISTRATOR_PRIVILEGE",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_ENSURE_OUTSIDE_SSO_ADMINISTRATOR_EXISTS",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_LOCK_DOWN_SSO_PROVIDER",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_CREATE_AT_LEAST_TWO_KEEPER_ADMINISTRATORS",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_ENSURE_TWO_FACTOR_AUTHENTICATION_ADMIN_USERS",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_ENFORCE_STRONG_MASTER_PASSWORD",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_ENSURE_TWO_FACTOR_AUTHENTICATION_FOR_END_USERS",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_CONFIGURE_IP_ALLOWLISTING",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_CREATE_ALERTS",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_DISABLE_BROWSER_PASSWORD_MANAGERS",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_DISABLE_ACCOUNT_RECOVERY",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    },
    {
      "id": "SB_ENFORCE_LEAST_PRIVILEGE_POLICY",
      "auto_resolve": false,
      "status": "UNRESOLVED"
    }
  ]
}
```

--------------------------------

### Query Documentation Example

Source: https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/import-and-export-commands/myki-import

To get additional information not present on the page, make a GET request to the page URL with the 'ask' query parameter. The question should be specific and self-contained.

```http
GET https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/import-and-export-commands/myki-import.md?ask=<question>
```

--------------------------------

### Commander Configuration File Example

Source: https://docs.keeper.io/en/keeperpam/commander-cli/commander-installation-setup/configuration/configuration

This is a comprehensive example of the Commander configuration file, showing various parameters that can be set for server connection, authentication, and operational settings.

```json
{
    "server": "keepersecurity.eu",
    "user": "services@company.com",
    "password": "your_password_here",
    "private_key": "yaeK4jMeIGNkSR2pi4xf2XGmYM094YMUoE8-QEW9CAA",
    "device_token": "g6RDMxr1t-bcVdBeBpz-xQ",
    "mfa_duration": "forever",
    "proxy": "http://proxy_user:proxy_password@host:port",
    "sso_master_password": false,
    "skip_records": false,
    "debug": false,
    "plugins": [],
    "commands": [],
    "timedelay": 0
}
```

--------------------------------

### Install Docker on Linux

Source: https://docs.keeper.io/en/sso-connect-cloud/device-approvals/automator/docker-on-linux

Installs Docker using yum. Ensure Docker service is running and configured to start automatically. Optionally, grant non-root users access to the Docker socket.

```bash
sudo yum install docker
```

```bash
sudo service docker start
```

```bash
sudo systemctl enable docker.service
```

```bash
sudo chmod 666 /var/run/docker.sock
```

--------------------------------

### Show PAM Launch Help

Source: https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/keeperpam-commands

Displays help information for the 'pam launch' command, outlining available options and arguments for initiating a privileged session.

```bash
My Vault> pam launch -h                                                                                                                                   
usage: pam [-h] [--no-trickle-ice] [--credential LAUNCH_CREDENTIAL] [--host CUSTOM_HOST] [--host-record HOST_RECORD] [--stdin] [--normalize-crlf]
           [--scale SCALE]
           record

Launch a connection to a PAM resource

positional arguments:
  record                Record path or UID of the PAM resource to launch

options:
  -h, --help            show this help message and exit
  --no-trickle-ice, -nti
                        Disable trickle ICE for WebRTC connections. By default, trickle ICE is enabled for real-time candidate exchange.
  --credential LAUNCH_CREDENTIAL, -cr LAUNCH_CREDENTIAL
                        Record (UID, path, or title) for launch credentials
  --host CUSTOM_HOST, -H CUSTOM_HOST
                        Host and port in format host:port (e.g. -H=192.168.1.1:22 or -H=[::1]:22 for IPv6). Requires allowSupplyHost. Mutually exclusive
                        with --host-record.
  --host-record HOST_RECORD, -hr HOST_RECORD
                        Record (UID, path, or title) with a host or pamHostname field containing hostName and port. Requires allowSupplyHost. Mutually
                        exclusive with --host.
  --stdin               Send typed input via stdin pipe bytes (pipe/blob/end, kcm-cli style) instead of the default Guacamole key-event mode. Paste and
                        Ctrl+C double-tap behave the same in both modes.
  --normalize-crlf, -n  Normalize decoded Guacamole STDOUT: CRLF to LF and downstream LF cleanup. Use when you see double new lines from the remote. By
                        default we keep raw CR/LF on STDOUT (lower overhead). Alternatively, tune sending double newlines to the remote with environment
                        variable PAM_LAUNCH_CRLF_MERGE_DELAY_MS: [50..500] ms which controls local Enter coalescing (split CRLF across reads).
  --scale SCALE, -s SCALE
                        Scale pixel width/height by this percentage (e.g. 50 = half canvas, 200 = double). Range: [40-400]. Helps when fullscreen TUI
                        programs show garbled layout.
```

--------------------------------

### Example: Get All Secrets

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/rust-sdk

Initializes the SecretsManager with a one-time token and file-based storage, then retrieves and prints all secrets.

```rust
use keeper_secrets_manager_core::{
    core::{ClientOptions, SecretsManager},
    custom_error::KSMRError,
    storage::FileKeyValueStorage
};

fn main()-> Result<(), KSMRError>{
    let token = "<Your One time token>".to_string();
    let file_name = FileKeyValueStorage::new_config_storage("test.json".to_string())?;
    let client_options = ClientOptions::new_client_options_with_token(token, file_name);
    
    let mut secrets_manager = SecretsManager::new(client_options)?;
    let secrets = secrets_manager.get_secrets(Vec::new())?;

    for secret in secrets {
        secret.print();
        println!("---");
    }
    Ok(())
}
```

--------------------------------

### Clone Example Branding Repository

Source: https://docs.keeper.io/en/keeper-connection-manager/using-keeper-connection-manager/custom-branding

Use git to clone the example repository for custom branding. Navigate into the cloned directory afterwards.

```bash
git clone https://github.com/Keeper-Security/kcm-branding.git
cd kcm-branding
```

--------------------------------

### Example: Delete a Secret

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/rust-sdk

This example demonstrates the full setup required to initialize the Secrets Manager and delete a secret using its UID. Ensure you replace '<RECORD UID>' with the actual UID of the secret you wish to delete.

```rust
use keeper_secrets_manager_core::
    core::{ClientOptions, SecretsManager},
    storage::InMemoryKeyValueStorage,
    custom_error::KSMRError;
fn main()-> Result<(), KSMRError>{
    // setup secrets manager
    let config_string = "your_base64_goes_here".to_string();
    let config = InMemoryKeyValueStorage::new_config_storage(Some(config_string))?;
    let client_options = ClientOptions::new_client_options(config);
    let mut secrets_manager = SecretsManager::new(client_options)?;

    // delete a specific secret by UID
    let secret_to_delete = secrets_manager.delete_secret(["<RECORD UID>".to_string()])?;
    Ok(())
}
```

--------------------------------

### Read Folders Example

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/rust-sdk

An example demonstrating how to set up the Secrets Manager and retrieve all folders.

```APIDOC
```rust
use keeper_secrets_manager_core::{
    core::{ClientOptions, SecretsManager},
    storage::InMemoryKeyValueStorage,
    custom_error::KSMRError
};
fn main()-> Result<(), KSMRError>{
    // setup secrets manager
    let config_string = "your_base64_goes_here".to_string();
    let config = InMemoryKeyValueStorage::new_config_storage(Some(config_string))?;
    let client_options = ClientOptions::new_client_options(config);
    let mut secrets_manager = SecretsManager::new(client_options)?;
    
    // get all folder
    let folders = secrets_manager.get_folders()?;
    Ok(())
}
```
```

--------------------------------

### Create Working Directory and Navigate

Source: https://docs.keeper.io/en/keeper-connection-manager/installation/podman-install

Creates a directory for KCM and changes the current directory to it. This is the first step in setting up the KCM environment.

```bash
sudo mkdir -p /opt/kcm && cd /opt/kcm
```

--------------------------------

### Slack App Integration Setup Complete

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/slack-app

This output confirms the successful completion of the Slack App integration setup, listing the resources created during the process.

```bash
✓ Slack App Integration Setup Complete!

Resources Created:
  Phase 1 - Commander Service:
    • Shared Folder: Commander Service Mode - Slack App
    • KSM App: Commander Service Mode - KSM App (with edit permissions)
    • Config Record: XXXXXX
    • KSM Base64 Config: ✓ Generated
  Phase 2 - Slack App:
    • Slack Config Record: XXXXXX
    • Approvals Channel: XXXXXX
    • PEDM Integration: false
    • Device Approval: false
```

--------------------------------

### Install Keeper Skills to Multiple Agents

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/ai-agents/manual-install

Install Keeper skills to multiple agents (e.g., Claude Code, Cursor, Codex) by iterating through their respective skill directories. This simplifies setup for users with multiple AI tools.

```bash
# Claude Code + Cursor + Codex
for dir in ~/.claude/skills ~/.cursor/skills ~/.codex/skills; do
  mkdir -p "$dir"
  cp -r plugins/*/skills/* "$dir/"
done
```

--------------------------------

### Full Example: Get Record and Remove Specific Files (Java)

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/java-sdk

This comprehensive Java example shows how to retrieve a record with its files and then remove specific files using their UIDs. It utilizes `QueryOptions` to request files and `UpdateOptions` for the removal.

```java
import com.keepersecurity.secretsManager.core.*;
import java.util.*;

// Get record with files
QueryOptions queryOptions = new QueryOptions(
    Arrays.asList(recordUid),
    Collections.emptyList(),
    true  // request files
);

KeeperSecrets secrets = SecretsManager.getSecrets2(options, queryOptions);
KeeperRecord record = secrets.getRecords().get(0);

// Remove specific files
List<String> fileUidsToRemove = Arrays.asList("fileUid1", "fileUid2");

UpdateOptions updateOptions = new UpdateOptions(
    null,              // transactionType
    fileUidsToRemove  // linksToRemove
);

SecretsManager.updateSecretWithOptions(options, record, updateOptions);
```

--------------------------------

### Initial SFTP Sync Setup

Source: https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/connection-commands/sftp-sync

Use this command the first time you run an SFTP sync. It requires specifying the plugin type, remote path, and the Keeper record containing SFTP credentials. Commander will save these settings for future use.

```bash
rsync "path/to/files_location/" --plugin sftp --remote-path "/path/to/files" --record "credentials/SFTP creds"
```

--------------------------------

### Create Login Record Example

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/rust-sdk

Example demonstrating how to create a 'login' type record with a password field. Requires setting up the Secrets Manager client with configuration.

```rust
use keeper_secrets_manager_core::{
    core::{ClientOptions, SecretsManager},
    storage::InMemoryKeyValueStorage,
    custom_error::KSMRError,
    dto::{dtos::RecordCreate, field_structs::RecordField},
    utils
};
use serde_json::{self, json, Number, Value};

fn main()-> Result<(), KSMRError>{
    // setup secrets manager
    let config_string = "your_base64_goes_here".to_string();
    let config = InMemoryKeyValueStorage::new_config_storage(Some(config_string))?;
    let client_options = ClientOptions::new_client_options(config);
    let mut secrets_manager = SecretsManager::new(client_options)?;

    // This is how we create a Record
    let mut created_record =  RecordCreate::new("login".to_string(), "Login Record RUST_LOG_TEST".to_string(), Some("Dummy Notes".to_string()));
    
    // This is how we create a single field 
    let password_field = RecordField::new_record_field_with_options("password".to_string(), Value::String(utils::generate_password()?), Some("Random password label".to_string()), false, true);

    //This is one way to create all fields directly in a vector
    let fields = vec![
        RecordField::new_record_field("login".to_string(), Value::String("login@email.com".to_string()), Some("My Custom Login lbl".to_string())),

        password_field,
     ];

    created_record.fields = Some(fields);
  
    // Make the API call
    let _ = secrets_manager.create_secret("Shared_folder_uid".to_string(), created_record)?;
    Ok(())
}
```

--------------------------------

### Get Keeper Action Report - Locked Users Example

Source: https://docs.keeper.io/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/reporting-commands/action-report-command

This PowerShell example shows how to report on 'Locked' user accounts older than a specified number of days. It includes administrative action details and a sample output for locked users.

```powershell
Admin Action Taken:
        COMMAND: NONE (No action specified)
        STATUS: n/a
        SERVER MESSAGE: n/a
        AFFECTED: 0

Note: the following reflects data prior to any administrative action being applied
0 User(s) With "Locked" Status Older Than 90 Day(s): 
 
       User ID  Email                      Name    Status    Transfer Status    Node
--------------  -------------------------  ------  --------  -----------------  ---------------
70411693850646  user1@example.com  Sharad  Locked    Transfer accepted  Keeper Security
```

--------------------------------

### Display Import Instructions

Source: https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/import-and-export-commands

Show instructions and examples for importing data using CSV or JSON formats.

```bash
import --display-csv
```

--------------------------------

### Activate Keeper CLI Shell

Source: https://docs.keeper.io/en/keeperpam/commander-cli/commander-installation-setup/installation-on-linux

Starts the Keeper Commander CLI shell after installation, allowing you to interact with Keeper services.

```bash
keeper shell
```

--------------------------------

### Example: Generate and Update Password

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/golang-sdk

Demonstrates how to retrieve records, generate a new random password using the SDK, update a record with the new password, and save the changes.

```go
// get a record
allRecords, err := sm.GetSecrets([]string{})
if err != nil {
  fmt.Printf("Error: %v\n", err)
  return
}

if len(allRecords) == 0 {
  fmt.Println("No records found")
  return
}

record := allRecords[0]

// generate a random password
password, err := ksm.GeneratePassword(64, "", "", "", "", "")
if err != nil {
  fmt.Printf("Error generating password: %v\n", err)
  return
}

// update record with new password
record.SetPassword(password)

// save changes
err = sm.Save(record)
if err != nil {
  fmt.Printf("Error saving record: %v\n", err)
  return
}
```

--------------------------------

### Clone Keeper SDK .NET Repository

Source: https://docs.keeper.io/en/keeperpam/commander-cli/commander-installation-setup/net-developer-sdk/.net-commander-cli

Clone the official Keeper SDK .NET repository from GitHub to get started.

```bash
git clone https://github.com/Keeper-Security/keeper-sdk-dotnet.git
cd keeper-sdk-dotnet
```

--------------------------------

### Example: Get Secrets With a Filter

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/rust-sdk

Initializes the SecretsManager and retrieves secrets matching specific UIDs provided in a filter vector.

```rust
use keeper_secrets_manager_core::{
    core::{ClientOptions, SecretsManager},
    custom_error::KSMRError,
    storage::FileKeyValueStorage
};

fn main()-> Result<(), KSMRError>{
    let token = "<Your One time token>".to_string();
    let file_name = FileKeyValueStorage::new_config_storage("test.json".to_string())?;
    let client_options = ClientOptions::new_client_options_with_token(token, file_name);
    
    let mut secrets_manager = SecretsManager::new(client_options)?;
    let records_filter = vec!["record_uid1","record_uid2"]; // add record filters of needed based on UID
    let secrets = secrets_manager.get_secrets(records_filter)?;

    for secret in secrets {
        secret.print();
        println!("---");
    }
    Ok(())
}
```

--------------------------------

### Display SSO Connect Help Information

Source: https://docs.keeper.io/en/sso-connect-on-prem/installation-and-setup/installation-linux/linux-command-line-config

Use the -h or -help flag to display all available command-line parameters and their descriptions. This is useful for understanding the full range of configuration options.

```bash
$ java -jar SSOConnect.jar -h 

Usage: java -jar path_to_jars/SSOConnect.jar [option [option_argument]][option [option_argument]][...]
```

--------------------------------

### Get All Keeper Records

Source: https://docs.keeper.io/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/miscellaneous-commands

Retrieves all records from the Keeper Vault. This data can then be processed, for example, using regular expressions for matching.

```javascript
var records = Vault.KeeperRecords;
```

--------------------------------

### Create Enterprise User Command Example

Source: https://docs.keeper.io/en/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/enterprise-management-commands

This example demonstrates how to use the `create-user` command to add a new enterprise user. It specifies the user's email, full name, and the node to which they should be assigned.

```bash
My Vault> create-user user@example.com --name "John Doe" --node "Engineering"
```

--------------------------------

### Login Record Example

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/developer-sdk-library/golang-sdk

Example demonstrating how to create a 'login' type record with a username and a generated password using the Golang SDK. It also shows how to set the record notes.

```APIDOC
## Login Record Example

### Description
This example creates a login type record with a login value and a generated password. Replace `[FOLDER UID]` with the actual UID of a shared folder accessible by Secrets Manager.

### Code Example
```go
// create a new login record
newLoginRecord := ksm.NewRecordCreate("login", "Sample KSM Record: Go SDK")

// generate password
password, err := ksm.GeneratePassword(32, "", "", "", "", "")
if err != nil {
  fmt.Printf("Error generating password: %v\n", err)
  return
}

// fill in login and password fields
newLoginRecord.Fields = append(newLoginRecord.Fields,
  ksm.NewLogin("username@email.com"),
  ksm.NewPassword(password))

// fill in notes
newLoginRecord.Notes = "This is a Go record creation example"

// create the new record
recordUid, err := sm.CreateSecretWithRecordData("", "[FOLDER UID]", newLoginRecord)
if err != nil {
  fmt.Printf("Error creating record: %v\n", err)
  return
}

fmt.Printf("Record created with UID: %s\n", recordUid)
```
```

--------------------------------

### Docker Run Example with Mounted KSM Config File

Source: https://docs.keeper.io/en/keeperpam/commander-cli/service-mode-rest-api/docker-deployment

An example demonstrating how to run the Keeper Commander service by mounting a local KSM configuration file. Replace `/path/to/local/ksm-config.json` with the actual path on your system.

```bash
docker run -d -p 9007:9007 \
  -v /path/to/local/ksm-config.json:/home/commander/ksm-config.json \
  keeper/commander:latest \
  service-create -p 9007 -c 'ls,tree' -f json \
  --ksm-config /home/commander/ksm-config.json \
  --record ABC123-DEF456-GHI789
```

--------------------------------

### Download Latest Installer Script

Source: https://docs.keeper.io/en/keeper-connection-manager/installation/auto-docker-install/adding-packages

Use this command to download the latest version of the kcm-setup.run installer script.

```bash
curl -O https://keepersecurity.com/kcm/kcm-setup.run
```

--------------------------------

### Query Documentation Dynamically

Source: https://docs.keeper.io/en/keeper-connection-manager/using-keeper-connection-manager/session-recording

Example of how to perform an HTTP GET request to query the documentation dynamically. Replace `<question>` with your specific query.

```http
GET https://docs.keeper.io/en/keeper-connection-manager/using-keeper-connection-manager/session-recording.md?ask=<question>
```

--------------------------------

### Slack App Setup with Custom Names

Source: https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/slack-app

Use the `slack-app-setup` command with custom parameters for folder and app names, and to specify a custom timeout duration for device registration.

```bash
slack-app-setup --folder-name "My Slack Integration" --timeout 7d
```

--------------------------------

### Create Service Mode with Interactive Configuration

Source: https://docs.keeper.io/en/keeperpam/commander-cli/service-mode-rest-api

Initiates the service creation process with interactive prompts for configuration. Use this for a guided setup.

```bash
service-create
```
Tokens:
Raw