---
title: BeyondTrust Password Safe
slug: connectors/beyondtrust-password-safe
docTags: 
createdAt: 2026-06-09T16:30:17.593Z
---

The BeyondTrust Password Safe connector allows for secure management and automation of privileged credentials, integrating seamlessly with security workflows.

BeyondTrust Password Safe is a comprehensive privileged access management solution that secures and manages credentials, ensuring only authorized individuals have access to sensitive systems. This connector allows Swimlane Turbine users to automate credential management, access requests, and system updates, enhancing security and compliance. By integrating with BeyondTrust Password Safe, Swimlane Turbine users can streamline privileged account operations, reduce manual overhead, and rapidly respond to access-related incidents within their security workflows.

### Limitations

None to date.

### Supported Versions

This BeyondTrust Password Safe connector uses the latest Version API.

### Additional Docs

- [BeyondTrust Password Safe API Documentation Link](https://docs.beyondtrust.com/bips/docs/password-safe-ap)

## Configuration

### Prerequisites

To effectively utilize the BeyondTrust Password Safe connector with Swimlane Turbine, ensure you have the following:

- API Key Authentication with the necessary parameters:
  - URL: The endpoint URL for the BeyondTrust Password Safe API.
  - Key: Your unique API key to authenticate requests.
  - Run As: The username of the user performing actions via the API.
  - Password: The password associated with the 'Run As' user.

## Authentication Methods

The BeyondTrust Password Safe connector uses the API Key authentication method to connect to the BeyondTrust Password Safe API.

The following are required to set up the asset:

1. **API Key**: The API key generated from BeyondTrust Password Safe.
2. **RunAs Username**: The username of the account that has permissions to use the API key.
3. **RunAs Password**: The password for the RunAs user account.
4. **API Endpoint**: The URL endpoint for the BeyondTrust Password Safe API.

Example configuration in `apikey.yaml`:

```yaml
apikey: c479a66f…c9484d
runas_username: doe-main\johndoe
runas_password: un1qu3
api_endpoint: https://your-beyondtrust-instance/api/public/v3
```

## Capabilities

This BeyondTrust Password Safe connector provides the following capabilities:

- Check in or Release a Request
- Get Credentials
- Get Managed Accounts
- Get Managed Systems
- Update Credentials

### Check in or Release a Request

BeyondTrust Password Safe's documentation for this action can be found [here](https://docs.beyondtrust.com/bips/docs/password-safe-api#put-requestsidcheckin).

- Required Roles: Requestor role to managed account referenced by the request.

### Get Credentials

BeyondTrust Password Safe's documentation for this action can be found [here](https://docs.beyondtrust.com/bips/docs/password-safe-api#get-credentialsrequestid).

- Required Permissions: None.

### Get Managed Accounts

BeyondTrust Password Safe's documentation for this action can be found [here](https://docs.beyondtrust.com/bips/docs/password-safe-api#get-managedaccounts).

- Required Roles: Requestor, Requestor/Approver, or ISA role.

### Get Managed Systems

BeyondTrust Password Safe's documentation for this action can be found [here](https://docs.beyondtrust.com/bips/docs/password-safe-api#get-managedsystems).

- Required Permissions: Password Safe System Management (Read).

### Update Credentials

BeyondTrust Password Safe's documentation for this action can be found [here](https://docs.beyondtrust.com/bips/docs/password-safe-api#put-managedaccountsmanagedaccountidcredentials).

- Required Permissions:
  - Password Safe Account Management (Read/Write).
  - ISA Role or Credentials Manager Role on a Smart Rule referencing the account.

# Configurations

## BeyondTrust Password Safe API Key Authentication

Authenticates using an API Key

### Configuration Parameters

| **Parameter** | **Description**                                                                                                                                       | **Type** | **Required** |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------ |
| url           | A URL to the target host.                                                                                                                             | string   | Required     |
| key           | The API key configured in BeyondInsight for your application.                                                                                         | string   | Required     |
| runas         | The username of a BeyondInsight user that has been granted permission to use the API key.                                                             | string   | Required     |
| pwd           | The RunAs user password surrounded by square brackets (optional; required only if the User Password is required on the application API registration). | string   | Required     |
| verify\_ssl   | Verify SSL certificate                                                                                                                                | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through.                                                                                                                    | string   | Optional     |

# Actions

## Check in or Release a Request

Checks in or releases a specified request in BeyondTrust Password Safe using the request ID before expiration.

### Endpoint

- **URL:** `Requests/{{id}}/Checkin`
- **Method:** `PUT`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                        |
| -------------------- | -------- | ------------ | -------------------------------------- |
| `path_parameters.id` | string   | Required     | ID of the request to check-in/release. |

### Input Example

`{"path_parameters":{"id":"12345678"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":204,"response_headers":{},"reason":"OK","json_body":{}}`

## Get Credentials

Retrieves active and approved credentials for a specified request ID in BeyondTrust Password Safe.

### Endpoint

- **URL:** `Credentials/{{requestId}}`
- **Method:** `GET`

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                          |
| --------------------------- | -------- | ------------ | -------------------------------------------------------- |
| `parameters.type`           | string   | Optional     | The type of credential to retrieve.                      |
| `path_parameters.requestId` | string   | Required     | ID of the request for which to retrieve the credentials. |

### Input Example

`{"parameters":{"type":"dsskey"},"path_parameters":{"requestId":"string"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `Credentials` | string   | Output field: Credentials        |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"Credentials":"string"}}`

## Get Managed Accounts

Retrieve a list of managed accounts available for request by the current user, with optional query parameters for specificity.

### Endpoint

- **URL:** `/ManagedAccounts`
- **Method:** `GET`

### Input

| **Argument Name**                   | **Type** | **Required** | **Description**                                                                                                       |
| ----------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------- |
| `parameters.systemName`             | string   | Optional     | (optional) Name of the managed system.                                                                                |
| `parameters.accountName`            | string   | Optional     | (optional) Name of the managed account.                                                                               |
| `parameters.systemID`               | string   | Optional     | (optional) ID of the Managed System.                                                                                  |
| `parameters.workgroupName`          | string   | Optional     | (optional) Name of the Workgroup.                                                                                     |
| `parameters.applicationDisplayName` | string   | Optional     | (optional, when given, type must be application) Display name of the application.                                     |
| `parameters.ipAddress`              | string   | Optional     | (optional, when given type must be one of system, domainlinked, or database) IP Address of the managed asset.         |
| `parameters.type`                   | string   | Optional     | (optional/recommended) Type of the managed account to return.                                                         |
| `parameters.limit`                  | number   | Optional     | (optional) (default- 1000) Number of records to return                                                                |
| `parameters.offset`                 | number   | Optional     | (optional) (default- 0) Number of records to skip before returning <br />:::Iframe{code="<limit>"}

:::<br /> records |

### Input Example

`{"parameters":{"systemName":"Test Name","accountName":"Test Account","systemID":"12233344","workgroupName":"Test Group","applicationDisplayName":"Test","ipAddress":"1.2.333.44","type":"system","limit":1000,"offset":0}}`

### Output

| **Parameter**            | **Type** | **Description**                      |
| ------------------------ | -------- | ------------------------------------ |
| `status_code`            | number   | HTTP status code of the response     |
| `reason`                 | string   | Response reason phrase               |
| `PlatformID`             | number   | Unique identifier                    |
| `SystemId`               | number   | Unique identifier                    |
| `SystemName`             | string   | Name of the resource                 |
| `DomainName`             | string   | Name of the resource                 |
| `AccountId`              | number   | Unique identifier                    |
| `AccountName`            | string   | Name of the resource                 |
| `InstanceName`           | string   | Name of the resource                 |
| `UserPrincipalName`      | string   | Name of the resource                 |
| `ApplicationID`          | number   | Unique identifier                    |
| `ApplicationDisplayName` | string   | Name of the resource                 |
| `DefaultReleaseDuration` | number   | Output field: DefaultReleaseDuration |
| `MaximumReleaseDuration` | number   | Output field: MaximumReleaseDuration |
| `LastChangeDate`         | string   | Date value                           |
| `NextChangeDate`         | string   | Date value                           |
| `IsChanging`             | boolean  | Output field: IsChanging             |
| `ChangeState`            | number   | Output field: ChangeState            |
| `IsISAAccess`            | boolean  | Output field: IsISAAccess            |
| `PreferredNodeID`        | string   | Unique identifier                    |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"PlatformID":1,"SystemId":12345,"SystemName":"ExampleSystem","DomainName":"example.com","AccountId":67890,"AccountName":"ExampleAccount","InstanceName":"ExampleInstance","UserPrincipalName":"example@example.com","ApplicationID":54321,"ApplicationDisplayName":"ExampleApp","DefaultReleaseDuration":30,"MaximumReleaseDuration":60,"LastChangeDate":"2023-01-01T00:00:00Z","NextChangeDate":"2023-02-01T00:00:00Z","IsChanging":true}}`

## Get Managed Systems

Retrieve a list of systems managed by BeyondTrust Password Safe, detailing each system's attributes and status.

### Endpoint

- **URL:** `/ManagedSystems`
- **Method:** `GET`

### Input

| **Argument Name**   | **Type** | **Required** | **Description**                                                                                               |
| ------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------- |
| `parameters.type`   | string   | Optional     | The entity type of the managed system.                                                                        |
| `parameters.name`   | string   | Optional     | The name of the managed system.                                                                               |
| `parameters.limit`  | number   | Optional     | (default- 100000) Number of records to return.                                                                |
| `parameters.offset` | number   | Optional     | (default- 0) Number of records to skip before returning records (can only be used in conjunction with limit). |

### Input Example

`{"parameters":{"type":"server","name":"example_system","limit":100000,"offset":0}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"WorkgroupID":1,"HostName":"example-host","IPAddress":"192.168.1.1","DNSName":"example.com","InstanceName":"instance1","IsDefaultInstance":true,"Template":"template1","ForestName":"forest1","UseSSL":false,"ManagedSystemID":123,"EntityTypeID":456,"AssetID":null,"DatabaseID":null,"DirectoryID":null,"CloudID":null}]}`

## Update Credentials

Updates the credentials for a specified managed account in BeyondTrust Password Safe, with an option to apply changes system-wide.

### Endpoint

- **URL:** `ManagedAccounts/{{managedAccountID}}/Credentials`
- **Method:** `PUT`

### Input

| **Argument Name**                  | **Type** | **Required** | **Description**                                                                                  |
| ---------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------ |
| `path_parameters.managedAccountID` | string   | Required     | ID of the managed account for which to set the credentials.                                      |
| `Password`                         | string   | Optional     | (optional) The new password to set. If not given, generates a new random password.               |
| `PublicKey`                        | string   | Optional     | (required if PrivateKey is given and updateSystem = true) The new public key to set on the host. |
| `PrivateKey`                       | string   | Optional     | The private key to set (provide passphrase if encrypted).                                        |
| `Passphrase`                       | string   | Optional     | (optional) The passphrase to use for an encrypted private key.                                   |
| `UpdateSystem`                     | boolean  | Optional     | (default- true) Whether to update the credentials on the referenced system.                      |

### Input Example

`{"json_body":{"Password":"","PublicKey":"","PrivateKey":"","Passphrase":"","UpdateSystem":true},"path_parameters":{"managedAccountID":"string"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":204,"response_headers":{},"reason":"OK","json_body":{}}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |