Fetch single account details including linkedAccounts. LinkedAccounts (logonAccount, reconcileAccount, enableAccount) are only availa

Fetch all CyberArk vault users (excluding component / service accounts). Returns a list of dicts: ``{"id", "username", "email", "type

Fetch the CyberArk Master Policy settings.

Convert an ``AccessRoleType`` to a Nested Share Folder display role label. Accepts either the proto enum name (``'SHARED_MANAGER'``) or its integ

Generate authentication options

Get list of available biometric credentials

Get stored credential ID for user from Windows registry

Get the path corresponding to a folder uid.

Resolve gateway UID for a PAM resource record (pamMachine, etc.). Lookup flow: record_uid -> PAM_LINK DAG -> config_uid -> gateway (controller)

Detect Keeper Commander installation method. Returns: str: 'binary' (PyInstaller frozen), 'pip' (installed via pip), or 'source' (de

Get platform handler for current system

Get a map of all the available plugins. This will first get the latest catalog from the GitHub repo. The catalog will contain the plugin

Return the referenced record cache

Generic function to retrieve settings from a DAG DATA edge with the specified path for a resource. The settings are stored as encrypted JSON

Grant a user *or team* access to a Nested Share Folder.

Register NSF folders on a KSM application. KSM and the Gateway only see records in folders carrying a direct ``AT_APPLICATION`` grant - unlik

Handle 'no data found' scenarios for different output formats. Args: fmt (str): Output format ('json', 'table', etc.) me

Checks if all attributes (not on skiplist) are None

Check if a CyberArk account is missing required fields for PAM import.

Check if this config uses OAuth authentication.

Terminates a process by PID without using psutil.

Flatten any of the three Master Policy response shapes. - **Self-Hosted ``/Policies/1``** → ``{"DualControl": {"Value": true}}`` be

Normalize root folder UIDs to a consistent ``'root'`` or empty string.

Trigger a clipboard paste to the remote session.

Pick which linked account populates Keeper's launch_credentials slot. CyberArk PSM uses the logonAccount to establish the initial connection

Report status codes from list of folder_pb2.*Response.

Resolve a team name/UID to ``(team_uid_b64, team_uid_bytes)`` or ``None``.

Resolve a user email or account UID to raw account UID bytes. Only UID-shaped strings are decoded — never display names.

Save configuration to file.

Return rotation schedule list from a PAM configuration defaultRotationSchedule field.

Keep local NSF caches consistent right after folder creation.

Send email via SMTP. Args: to: Recipient email address subject: Email subject body: Email body

Acknowledge receipt of data on a stream. Args: stream_index: The index of the stream. message: Human-readabl

Update the record linking ACL with control_services

Save JIT settings on a PAM resource. Primary path: POSTs the encrypted settings to krouter's `/api/user/configure_resource` (Layer-B, pe

Start reading input in a background thread.

Log one line with total elapsed (e.g. at end of tunnel open or command).