Execute a CLI command and capture output.

``GET /api/platforms/master-rotation-policy/exceptions/``.

Fetch the full platform definition (ConnectionComponents, Properties).

Fetch members of a safe. Returns list of member dicts. Excludes predefined system members. Safe names with spaces, unicode, or pre-en

Convert collected TOTP parts into otpauth:// URLs.

Return a {uid, path} dict for the first NSF folder containing *record_uid*.

Find all top Shared Folders that will contain this record. Record can be in more than two folders by having a "link" which will present a

Get action-specific parser for detailed help.

Return approvals profile when this integration supports multi-channel approvers.

Get WebAuthn assertion using Touch ID

Get biometric flag for user

POST a stringified JSON object to /api/dag/get_leafs on the KRouter The object is: { vertex: string, graphId: number }

Get device info as a dictionary (for programmatic use)

Get launch credential: resolved UID if uid=True, else string reference (title/login).

Return the list of user UIDs currently flagged is_launch_credential on the resource.

Get the parent record uid. Check the ACL edges for the one where belongs_to is True If there is a LINK edge that leads to th

Return the record key type if available (legacy AES-CBC vs AES-GCM).

Return status for ``request_id`` only if owned by ``owner_key``.

Retrieve JIT settings from the DAG DATA edge with path 'jit_settings' for a resource. This function checks if JIT settings are stored in a D

Retrieve KeeperAI settings from the DAG DATA edge with path 'ai_settings' for a resource. The settings are stored as encrypted JSON in a DAT

Return terminal size in pixels and DPI for a Guacamole 'size' instruction. Always re-queries the terminal size internally via shutil.get_terminal

Determine UI category based on device properties using rule-based mapping.

Shared KeeperApiError handler for alias commands.

Handle authentication errors with consistent messaging

Initialize routes and queue manager for the Keeper Commander Service.

Check if the given IP address is allowed based on allow/deny lists. Rules: - No lists configured → allow all - Deny list only → allow unl

Check if value is base64-encoded and decode it.

Return ``(eligible, protocol)`` for a `pam launch` candidate. Eligibility: TypedRecord v3, ``record_type`` in :data:`VALID_PAM_RECORD_TYPES`,

Return True when *folder_uid* is a Nested Share Folder.