``GET /api/platforms/master-rotation-policy/exceptions/``.

Fetch the full platform definition (ConnectionComponents, Properties).

Fetch members of a safe. Returns list of member dicts. Excludes predefined system members. Safe names with spaces, unicode, or pre-en

Convert collected TOTP parts into otpauth:// URLs.

Return a {uid, path} dict for the first NSF folder containing *record_uid*.

Find an NSF child named *folder_name* under *parent_uid* (or vault root).

Find all top Shared Folders that will contain this record. Record can be in more than two folders by having a "link" which will present a

Get action-specific parser for detailed help.

Return approvals profile when this integration supports multi-channel approvers.

Get WebAuthn assertion using Touch ID

Get biometric flag for user

POST a stringified JSON object to /api/dag/get_leafs on the KRouter The object is: { vertex: string, graphId: number }

Get device info as a dictionary (for programmatic use)

Get launch credential: resolved UID if uid=True, else string reference (title/login).

Return the list of user UIDs currently flagged is_launch_credential on the resource.

Get the parent record uid. Check the ACL edges for the one where belongs_to is True If there is a LINK edge that leads to th

Return the record key type if available (legacy AES-CBC vs AES-GCM).

Return status for ``request_id`` only if owned by ``owner_key``.

Retrieve JIT settings from the DAG DATA edge with path 'jit_settings' for a resource. This function checks if JIT settings are stored in a D

Retrieve KeeperAI settings from the DAG DATA edge with path 'ai_settings' for a resource. The settings are stored as encrypted JSON in a DAT

Return the cached ``PublicKeys`` for a team, loading them if needed.

Return terminal size in pixels and DPI for a Guacamole 'size' instruction. Always re-queries the terminal size internally via shutil.get_terminal

Determine UI category based on device properties using rule-based mapping.

Shared KeeperApiError handler for alias commands.

Handle authentication errors with consistent messaging

Initialize routes and queue manager for the Keeper Commander Service.

Check if the given IP address is allowed based on allow/deny lists. Rules: - No lists configured → allow all - Deny list only → allow unl

Return ``(eligible, protocol)`` for a `pam launch` candidate. Eligibility: TypedRecord v3, ``record_type`` in :data:`VALID_PAM_RECORD_TYPES`,

Return True when *folder_uid* is a Nested Share Folder.

Return True when a PAM record lives in NSF caches or an NSF folder.

Return True if name fits within the enterprise name length limit; otherwise warn and return False.

Exempt = record owner OR on approver list. Pass `config` to skip a round-trip. Transport failures fail closed (non-exempt).

Yield record UIDs from classic and Nested Shared Folder caches.