CyberArk

CyberArk is a security solution focused on managing and securing privileged accounts and credentials.

CyberArk is a leading platform for privileged access management, providing secure and automated management of privileged accounts, credentials, and secrets. The CyberArk connector for Swimlane Turbine enables seamless integration with CyberArk's robust security features, allowing users to automate the management of privileged accounts, user access, and security events. This integration enhances security operations by streamlining workflows, reducing manual intervention, and ensuring compliance with security policies.

Prerequisites

Before you can use the CyberArk connector for Turbine, you'll need access to the CyberArk API. This requires the following:

OAuth 2.0 Client Credentials authentication using the following parameters:

URL: The endpoint for accessing CyberArk's OAuth services.

Client ID: The client identifier issued during application registration.

Client Secret: The secret key associated with the client ID.

Identity Tenant ID: The tenant identifier for your CyberArk instance.

HTTP Basic authentication using the following parameters:

URL: The endpoint for accessing CyberArk's basic authentication services.

Username: The username for authenticating with CyberArk.

Password: The password associated with the username.

Capabilities

The Cyberark connector provides the following capabilities:

Add Account

Add Account to Group

Add User

Add User to Group

Change Account Credentials

Delete Account

Delete Account from Group

Delete User

Get Account Details

Get Accounts

Get All Safe Members

Get All Safes

Get Applications

Get Password Value

Get Security Events ... and so on

Notes

For More Information on API's refer CyberArk Documentation

OAuth Authentication

This connector was developed against product version: 14.0

Additional Documentation

CyberArk Connector Documentation

CyberArk API Documentation

Configurations

CyberArk HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

CyberArk Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
identity_tenant_id	Identity Tenant ID.	string	Required
client_id	User name. The user login name as displayed in the Identity Administration portal Users list - login_name@ .	string	Required
client_secret	Password. The access password defined for the user.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Account

Add a new privileged account or SSH key to the CyberArk Vault using specified platformId and safeName.

Endpoint

URL: /PasswordVault/api/Accounts

Method: POST

Input

Argument Name	Type	Required	Description
name	string	Optional	The name of the account.
address	string	Optional	The name or address of the machine where the account will be used.
userName	string	Optional	Account user's name.
platformId	string	Optional	The platform assigned to this account.
safeName	string	Optional	The Safe where the account is created.
secretType	string	Optional	The type of password.
secret	string	Optional	The password value.
platformAccountProperties	object	Optional	The object containing key-value pairs to associate with the account, as defined by the account platform.
secretManagement	object	Optional	Parameter for Add Account
secretManagement.automaticManagementEnabled	boolean	Optional	Whether the account secret is automatically managed by the CPM.
secretManagement.manualManagementReason	string	Optional	Reason for disabling automatic secret management.
secretManagement.status	string	Optional	Account management status.
secretManagement.lastModifiedDateTime	string	Optional	Last modified date of the account.
secretManagement.lastReconciledDateTime	string	Optional	Last reconciled date of the account.
secretManagement.lastVerifiedDateTime	string	Optional	Last verified date of the account.
remoteMachinesAccess	object	Optional	Parameter for Add Account
remoteMachinesAccess.remoteMachines	string	Optional	List of remote machines, separated by semicolons.
remoteMachinesAccess.accessRestrictedToRemoteMachines	boolean	Optional	Whether or not to restrict access only to specified remote machines.

Input Example

{"json_body":{"name":"test","address":"IP","userName":"test-user","platformId":"WinServerLocal","safeName":"test-safe","secretType":"key","secret":"test","platformAccountProperties":{},"secretManagement":{"automaticManagementEnabled":true,"manualManagementReason":"test reason","status":"succeeded","lastModifiedDateTime":"2024-01-10T20:03:52.250","lastReconciledDateTime":"2024-01-10T20:03:52.250","lastVerifiedDateTime":"2024-01-10T20:03:52.250"},"remoteMachinesAccess":{"remoteMachines":"server1.cyberark.com;server2","accessRestrictedToRemoteMachines":true}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
address	string	Output field: address
userName	string	Name of the resource
platformId	string	Unique identifier
safeName	string	Name of the resource
secretType	string	Type of the resource
secret	string	Output field: secret
platformAccountProperties	object	Output field: platformAccountProperties
secretManagement	object	Output field: secretManagement
secretManagement.automaticManagementEnabled	boolean	Output field: secretManagement.automaticManagementEnabled
secretManagement.manualManagementReason	string	Response reason phrase
remoteMachinesAccess	object	Output field: remoteMachinesAccess
remoteMachinesAccess.remoteMachines	string	Output field: remoteMachinesAccess.remoteMachines
remoteMachinesAccess.accessRestrictedToRemoteMachines	boolean	Output field: remoteMachinesAccess.accessRestrictedToRemoteMachines

Output Example

{"status_code":201,"response_headers":{},"reason":"Created","json_body":{"name":"string","address":"string","userName":"string","platformId":"string","safeName":"string","secretType":"key","secret":"string","platformAccountProperties":{},"secretManagement":{"automaticManagementEnabled":true,"manualManagementReason":"string"},"remoteMachinesAccess":{"remoteMachines":"string","accessRestrictedToRemoteMachines":true}}}

Add Account to Group

Add a specified account to an existing CyberArk group using the provided GroupID and AccountID.

Endpoint

URL: /PasswordVault/API/AccountGroups/{{GroupID}}/Members/

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.GroupID	string	Required	The unique ID of account group.
AccountID	string	Optional	The ID of the account that will be added as a member to the group.

Input Example

{"json_body":{"AccountID":"456"},"path_parameters":{"GroupID":"123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":201,"response_headers":{},"reason":"Created","json_body":{}}

Add User

Add a new user to the CyberArk Vault using a JSON body input with the specified username.

Endpoint

URL: /PasswordVault/API/Users/

Method: POST

Input

Argument Name	Type	Required	Description
username	string	Optional	The name of the user.
userType	string	Optional	The user type that was returned according to the license.
unauthorizedInterfaces	array	Optional	The user type that was returned according to the license.
location	string	Optional	The location in the Vault where the user will be created.
expiryDate	number	Optional	The date when the user expires.
userActivityLogRetentionDays	number	Optional	The number of days that a user's account activity records are stored before they are deleted.
loginFromHour	number	Optional	The starting time of the timeframe in which a user can log in to an account.
loginToHour	number	Optional	The ending time of the timeframe in which a user can log in to an account.
enableUser	boolean	Optional	Whether the user will be enabled upon creation.
authenticationMethod	array	Optional	The authentication method that the user will use to log on.
initialPassword	string	Optional	The password that the user will use to log on for the first time.
changePassOnNextLogon	boolean	Optional	Whether or not the user must change their password from the second log on onward.
passwordNeverExpires	boolean	Optional	Whether the user's password will not expire unless they decide to change it.
distinguishedName	string	Optional	The user's distinguished name.
vaultAuthorization	array	Optional	The user permissions.
businessAddress	object	Optional	The user's postal address, including city, state, zip, country and street.
businessAddress.workStreet	string	Optional	Parameter for Add User
businessAddress.workCity	string	Optional	Parameter for Add User
businessAddress.workState	string	Optional	Parameter for Add User
businessAddress.workZip	string	Optional	Parameter for Add User
businessAddress.workCountry	string	Optional	Parameter for Add User
internet	object	Optional	The user's email addresses, including Home page, Home email, Business email and Other email.
internet.homePage	string	Optional	Parameter for Add User
internet.homeEmail	string	Optional	Parameter for Add User
internet.businessEmail	string	Optional	Parameter for Add User

Input Example

{"json_body":{"username":"newUser","userType":"EPVUser","unauthorizedInterfaces":["PIMSU","PSM"],"location":"\\","expiryDate":1577836800,"userActivityLogRetentionDays":30,"loginFromHour":1577836800,"loginToHour":1577836800,"enableUser":true,"authenticationMethod":["AuthTypePass"],"initialPassword":"MyPassword123","changePassOnNextLogon":true,"passwordNeverExpires":true,"distinguishedName":"newUser@cyberark","vaultAuthorization":["AddSafes","AuditUsers"],"businessAddress":{"workStreet":"Hapssagot 9","workCity":"Petah Tikva","workState":"Israel","workZip":"9999999","workCountry":"Israel"},"internet":{"homePage":"Cyberark.com","homeEmail":"[email protected]","businessEmail":"[email protected]","otherEmail":"[email protected]"},"phones":{"homeNumber":"555123456","businessNumber":"555456789","cellularNumber":"555789789","faxNumber":"999999","pagerNumber":"111111"},"description":"This user is privileged","personalDetails":{"street":"2 Second Street","city":"Tel Aviv","state":"Israel","zip":"123456","country":"Israel","title":"Mr. VIP","organization":"CyberArk","department":"R&D","profession":"software development","firstName":"John","middleName":"Don","lastName":"Smith"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
enableUser	boolean	Output field: enableUser
changePassOnNextLogon	boolean	Output field: changePassOnNextLogon
expiryDate	number	Date value
suspended	boolean	Output field: suspended
lastSuccessfulLoginDate	number	Whether the operation was successful
unAuthorizedInterfaces	array	Output field: unAuthorizedInterfaces
authenticationMethod	array	HTTP method to use
passwordNeverExpires	boolean	Output field: passwordNeverExpires
distinguishedName	string	Name of the resource
description	string	Output field: description
businessAddress	object	Output field: businessAddress
businessAddress.workStreet	string	Output field: businessAddress.workStreet
businessAddress.workCity	string	Output field: businessAddress.workCity
businessAddress.workState	string	Output field: businessAddress.workState
businessAddress.workZip	string	Output field: businessAddress.workZip
businessAddress.workCountry	string	Output field: businessAddress.workCountry
internet	object	Output field: internet
internet.homePage	string	Output field: internet.homePage
internet.homeEmail	string	Output field: internet.homeEmail
internet.businessEmail	string	Output field: internet.businessEmail
internet.otherEmail	string	Output field: internet.otherEmail
phones	object	Output field: phones
phones.homeNumber	string	Output field: phones.homeNumber

Output Example

{"status_code":201,"response_headers":{},"reason":"Created","json_body":{"enableUser":true,"changePassOnNextLogon":true,"expiryDate":1577836800,"suspended":false,"lastSuccessfulLoginDate":1561282853,"unAuthorizedInterfaces":["PSMP","PSM"],"authenticationMethod":["AuthTypePass"],"passwordNeverExpires":true,"distinguishedName":"newUser@cyberark","description":"This user is privileged","businessAddress":{"workStreet":"9999999","workCity":"White Mountain","workState":"10 First Street","workZip":"123...

Add User to Group

Add a user to a CyberArk Vault group using the group's ID and the user's member ID.

Endpoint

URL: /PasswordVault/API/UserGroups/{{id}}/Members/

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique ID of the Vault group.
memberId	string	Optional	The name of the Vault user or LDAP group to add to the Vault group.
memberType	string	Optional	The type of user being added to the Vault group. This differentiates members who are domain users from members who are Vault users.
domainName	string	Optional	The dns address of the domain.

Input Example

{"json_body":{"memberId":"mock-vault","memberType":"vault","domainName":"www"},"path_parameters":{"id":"123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
memberId	string	Unique identifier
memberType	string	Type of the resource
domainName	string	Name of the resource

Output Example

{"status_code":201,"response_headers":{},"reason":"Created","json_body":{"memberId":"string","memberType":"Vault","domainName":"string"}}

Change Account Credentials

Initiate an immediate credential change for a specified account in CyberArk using the AccountID.

Endpoint

URL: /PasswordVault/API/Accounts/{{AccountID}}/Change/

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.AccountID	string	Required	The unique ID of the account.
ChangeEntireGroup	boolean	Optional	Whether or not the CPM will change the credentials in all the accounts that belong to the same group.

Input Example

{"json_body":{"ChangeEntireGroup":true},"path_parameters":{"AccountID":"123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}

Delete Account

Permanently remove a specified account from the CyberArk Vault using the unique account ID provided in path parameters.

Endpoint

URL: /PasswordVault/API/Accounts/{{id}}/

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The account's unique ID, composed of the SafeID and internal AccountID of the account to delete.

Input Example

{"path_parameters":{"id":"123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}

Delete Account from Group

Remove a specified account from a CyberArk group using the provided GroupID and AccountID.

Endpoint

URL: /PasswordVault/API/AccountGroups/{{GroupID}}/Members/{{AccountID}}/

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.GroupID	string	Required	The unique ID of the group.
path_parameters.AccountID	string	Required	The unique ID of the account.

Input Example

{"path_parameters":{"GroupID":"123","AccountID":"456"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}

Delete User

Remove a specified user from the CyberArk Vault using the provided UserID.

Endpoint

URL: /PasswordVault/API/Users/{{UserID}}/

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.UserID	string	Required	The user's unique ID.

Input Example

{"path_parameters":{"UserID":"45"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}

Get Account Details

Retrieve specific account details from CyberArk using the unique account identifier (ID) provided in path parameters.

Endpoint

URL: PasswordVault/API/Accounts/{{id}}/

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The account's unique ID.

Input Example

{"path_parameters":{"id":"acc_1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
CategoryModificationTime	number	Time value
id	string	Unique identifier
name	string	Name of the resource
address	string	Output field: address
userName	string	Name of the resource
platformId	string	Unique identifier
safeName	string	Name of the resource
secretType	string	Type of the resource
platformAccountProperties	object	Output field: platformAccountProperties
secretManagement	object	Output field: secretManagement
secretManagement.automaticManagementEnabled	boolean	Output field: secretManagement.automaticManagementEnabled
secretManagement.manualManagementReason	string	Response reason phrase
secretManagement.status	string	Status value
secretManagement.lastModifiedTime	number	Time value
secretManagement.lastReconciledTime	number	Time value
secretManagement.lastVerifiedTime	number	Time value
remoteMachinesAccess	object	Output field: remoteMachinesAccess
remoteMachinesAccess.remoteMachines	string	Output field: remoteMachinesAccess.remoteMachines
remoteMachinesAccess.accessRestrictedToRemoteMachines	boolean	Output field: remoteMachinesAccess.accessRestrictedToRemoteMachines
createdTime	number	Time value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"CategoryModificationTime":1588049324,"id":"string","name":"string","address":"string","userName":"string","platformId":"string","safeName":"string","secretType":"key","platformAccountProperties":{},"secretManagement":{"automaticManagementEnabled":true,"manualManagementReason":"string","status":"inProcess","lastModifiedTime":0,"lastReconciledTime":0,"lastVerifiedTime":0},"remoteMachinesAccess":{"remoteMachines":"string","accessR...

Get Accounts

Retrieve a comprehensive list of all accounts stored within the CyberArk Vault, providing an overview of credentials.

Endpoint

URL: /PasswordVault/api/accounts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.search	string	Optional	A list of keywords to search for in accounts, separated by a space.
parameters.searchType	string	Optional	Get accounts that either contain or start with the value specified in the Search parameter.
parameters.sort	string	Optional	The property or properties that you want to sort returned accounts, followed by asc (default) or desc to control sort direction. Separate multiple properties with commas, up to a maximum of three properties.
parameters.offset	number	Optional	Offset of the first account that is returned in the collection of results.
parameters.limit	number	Optional	The maximum number of returned accounts. The maximum number that you can specify is 1000.
parameters.filter	string	Optional	Search for accounts using a filter.
parameters.savedfilter	string	Optional	Search for accounts using a saved filter(s).

Input Example

{"parameters":{"search":"Windows admin","searchType":"contains","sort":"Windows asc","offset":0,"limit":10,"filter":"safename eq mySafe AND ModificationTime gte 0","savedfilter":"Deleted"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
name	string	Name of the resource
address	string	Output field: address
userName	string	Name of the resource
platformId	string	Unique identifier
safeName	string	Name of the resource
secretType	string	Type of the resource
platformAccountProperties	object	Output field: platformAccountProperties
secretManagement	object	Output field: secretManagement
secretManagement.automaticManagementEnabled	boolean	Output field: secretManagement.automaticManagementEnabled
secretManagement.manualManagementReason	string	Response reason phrase
secretManagement.status	string	Status value
secretManagement.lastModifiedTime	number	Time value
secretManagement.lastReconciledTime	number	Time value
secretManagement.lastVerifiedTime	number	Time value
remoteMachinesAccess	object	Output field: remoteMachinesAccess
remoteMachinesAccess.remoteMachines	string	Output field: remoteMachinesAccess.remoteMachines
remoteMachinesAccess.accessRestrictedToRemoteMachines	boolean	Output field: remoteMachinesAccess.accessRestrictedToRemoteMachines
createdTime	number	Time value
categoryModificationTime	number	Time value

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":{"id":"string","name":"string","address":"string","userName":"string","platformId":"string","safeName":"string","secretType":"key","platformAccountProperties":{},"secretManagement":{"automaticManagementEnabled":true,"manualManagementReason":"string","status":"inProcess","lastModifiedTime":0,"lastReconciledTime":0,"lastVerifiedTime":0},"remoteMachinesAccess":{"remoteMachines":"string","accessRestrictedToRemoteMachines":true},...

Get All Safe Members

Retrieve all members associated with a specified CyberArk Safe, identified by the SafeUrlId.

Endpoint

URL: PasswordVault/API/Safes/{{SafeUrlId}}/Members/

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.SafeUrlId	string	Required	The unique ID of the Safe used when calling Safe APIs.
parameters.filter	string	Optional	Filters are according to the REST standard.
parameters.search	string	Optional	Searches according to the Safe name.
parameters.offset	number	Optional	Offset of the first member that is returned in the collection of results.
parameters.limit	number	Optional	The maximum number of members that are returned.
parameters.sort	string	Optional	Sorts according to the memberName property in ascending order (default) or descending order to control the sort direction.

Input Example

{"parameters":{"filter":"memberType eq user","search":"searchword","offset":0,"limit":25,"sort":"asc"},"path_parameters":{"SafeUrlId":"SAFE12345"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.safeUrlId	string	URL endpoint for the request
value.safeName	string	Name of the resource
value.safeNumber	number	Value for the parameter
value.memberId	string	Unique identifier
value.memberName	string	Name of the resource
value.memberType	string	Type of the resource
value.membershipExpirationDate	object	Value for the parameter
value.isExpiredMembershipEnable	boolean	Value for the parameter
value.isPredefinedUser	boolean	Value for the parameter
value.permissions	object	Value for the parameter
value.permissions.useAccounts	boolean	Value for the parameter
value.permissions.retrieveAccounts	boolean	Value for the parameter
value.permissions.listAccounts	boolean	Value for the parameter
value.permissions.addAccounts	boolean	Value for the parameter
value.permissions.updateAccountContent	boolean	Value for the parameter
value.permissions.updateAccountProperties	boolean	Value for the parameter
value.permissions.initiateCPMAccountManagementOperations	boolean	Value for the parameter
value.permissions.specifyNextAccountContent	boolean	Value for the parameter
value.permissions.renameAccounts	boolean	Name of the resource
value.permissions.deleteAccounts	boolean	Value for the parameter
value.permissions.unlockAccounts	boolean	Value for the parameter
value.permissions.manageSafe	boolean	Value for the parameter

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":[{}],"count":8}}

Get All Safes

Retrieve all accessible Safes within the CyberArk Vault based on user permissions.

Endpoint

URL: /PasswordVault/API/Safes/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.search	string	Optional	Searches according to the Safe name. Search is performed according to the REST standard (search="search word").
parameters.offset	number	Optional	Offset of the first Safe that is returned in the collection of results
parameters.limit	number	Optional	The maximum number of Safes that are returned.
parameters.sort	string	Optional	Sorts according to the safeName property in ascending order (default) or descending order to control the sort direction.
parameters.includeAccounts	boolean	Optional	Whether or not to return accounts for each Safe as part of the response.
parameters.extendedDetails	boolean	Optional	Whether or not to return all Safe details or only safeName as part of the response.

Input Example

{"parameters":{"search":"test-safe","offset":0,"limit":1,"sort":"safeName desc","includeAccounts":false,"extendedDetails":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.safeUrlId	string	URL endpoint for the request
value.safeName	string	Name of the resource
value.safeNumber	number	Value for the parameter
value.description	string	Value for the parameter
value.location	string	Value for the parameter
value.creator	object	Value for the parameter
value.creator.id	string	Unique identifier
value.creator.name	string	Name of the resource
value.olacEnabled	boolean	Value for the parameter
value.managingCPM	string	Value for the parameter
value.numberOfVersionsRetention	object	Value for the parameter
value.numberOfDaysRetention	number	Value for the parameter
value.autoPurgeEnabled	boolean	Value for the parameter
value.creationTime	number	Value for the parameter
value.lastModificationTime	number	Value for the parameter
value.isExpiredMember	boolean	Value for the parameter
count	number	Count value
nextLink	string	Output field: nextLink

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":{"value":[{}],"count":1769,"nextLink":"api/safes?offset=25&limit=25&useCache=False"}}

Get Applications

Obtain a complete list of applications stored in the CyberArk Vault, ensuring secure access to application credentials.

Endpoint

URL: /PasswordVault/WebServices/PIMServices.svc/Applications/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.AppID	string	Optional	The application name.
parameters.Location	string	Optional	The location of the application in the Vault hierarchy.
parameters.IncludeSublocations	boolean	Optional	Whether or not the search will be performed in sublocations of the specified location.

Input Example

{"parameters":{"AppID":"app1","Location":"\\","IncludeSublocations":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
application	array	Output field: application
application.AccessPermittedFrom	string	Output field: application.AccessPermittedFrom
application.AccessPermittedTo	string	Output field: application.AccessPermittedTo
application.AllowExtendedAuthenticationRestrictions	boolean	Output field: application.AllowExtendedAuthenticationRestrictions
application.AppID	string	Unique identifier
application.BusinessOwnerEmail	string	Output field: application.BusinessOwnerEmail
application.BusinessOwnerFName	string	Name of the resource
application.BusinessOwnerLName	string	Name of the resource
application.BusinessOwnerPhone	string	Output field: application.BusinessOwnerPhone
application.Description	string	Output field: application.Description
application.Disabled	boolean	Output field: application.Disabled
application.ExpirationDate	string	Date value
application.Location	string	Output field: application.Location

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":{"application":[{}]}}

Get Password Value

Retrieve a password or SSH key for a specified account in CyberArk using the Account ID, with optional reason and ticket ID.

Endpoint

URL: PasswordVault/API/Accounts/{{accountId}}/Password/Retrieve/

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.accountId	string	Required	The unique ID of the account.
reason	string	Optional	The reason that is required to retrieve the password/SSH key.
TicketingSystemName	string	Optional	The name of the Ticketing System.
TicketId	string	Optional	The ticket ID of the ticketing system.
Version	number	Optional	The version number of the required password. If there are no previous versions, the current password/key version is returned. Valid values are any positive numbers.
ActionType	string	Optional	The action this password will be used for.
isUse	boolean	Optional	Internal parameter (for PSM for SSH only).
Machine	string	Optional	The address of the remote machine to connect to.

Input Example

{"json_body":{"reason":"Reason","TicketingSystemName":"Ticketing_System_1","TicketId":"Ticketid_1","Version":1.1,"ActionType":"show","isUse":true,"Machine":"127.32.13.1"},"path_parameters":{"accountId":"acc_1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":"<myPassword>"}

Get Security Events

Retrieve all Privileged Threat Analytics (PTA) security events from CyberArk to monitor and analyze threats.

Endpoint

URL: /PasswordVault/API/pta/API/Events/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.fromUpdateDate	number	Optional	The starting date to get the security events from (calculated by the number of seconds since 1970)
parameters.status	string	Optional	The status of the security event (open or closed).
parameters.accountID	string	Optional	The unique account identifier of the account that is referred to in the Security Event.

Input Example

{"parameters":{"fromUpdateDate":1577836800,"status":"open","accountID":"3_279"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":[{"id":"444445e56bbb0b0a063f4444","type":"PSMSuspiciousActivity","score":70,"createTime":1586134861000,"lastUpdateTime":1586134861000,"audits":[],"additionalData":{},"mStatus":"OPEN"},{"id":"555545e56aaa0b0a063ff555","type":"PSMSuspiciousActivity","score":70,"createTime":1586134862000,"lastUpdateTime":1586134862000,"audits":[],"additionalData":{},"mStatus":"CLOSED","closeReason":"HANDLED","reasonText":"Handled by SOC team"}]...

Get User Details

Retrieve detailed information for a specified user in CyberArk Vault by providing the UserID as a path parameter.

Endpoint

URL: /PasswordVault/API/Users/{{UserID}}/

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.UserID	string	Required	The ID of the user for which information is returned.

Input Example

{"path_parameters":{"UserID":"45"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
enableUser	boolean	Output field: enableUser
changePassOnNextLogon	boolean	Output field: changePassOnNextLogon
expiryDate	number	Date value
suspended	boolean	Output field: suspended
lastSuccessfulLoginDate	number	Whether the operation was successful
unAuthorizedInterfaces	array	Output field: unAuthorizedInterfaces
authenticationMethod	array	HTTP method to use
passwordNeverExpires	boolean	Output field: passwordNeverExpires
distinguishedName	string	Name of the resource
description	string	Output field: description
businessAddress	object	Output field: businessAddress
businessAddress.workStreet	string	Output field: businessAddress.workStreet
businessAddress.workCity	string	Output field: businessAddress.workCity
businessAddress.workState	string	Output field: businessAddress.workState
businessAddress.workZip	string	Output field: businessAddress.workZip
businessAddress.workCountry	string	Output field: businessAddress.workCountry
internet	object	Output field: internet
internet.homePage	string	Output field: internet.homePage
internet.homeEmail	string	Output field: internet.homeEmail
internet.businessEmail	string	Output field: internet.businessEmail
internet.otherEmail	string	Output field: internet.otherEmail
phones	object	Output field: phones
phones.homeNumber	string	Output field: phones.homeNumber

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":{"enableUser":true,"changePassOnNextLogon":false,"expiryDate":1577836800,"suspended":false,"lastSuccessfulLoginDate":1561282853,"unAuthorizedInterfaces":["GUI"],"authenticationMethod":["AuthTypePass"],"passwordNeverExpires":true,"distinguishedName":"JohnDoeRoe","description":"John Doe Roe","businessAddress":{"workStreet":"Kuritania street","workCity":"Curitania","workState":"Suritania","workZip":"90211","workCountry":"Rurita...

Get User Groups

Retrieve a comprehensive list of user groups available within CyberArk for access management and control.

Endpoint

URL: /PasswordVault/API/UserGroups/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Filters according to the REST standard.
parameters.sort	string	Optional	Property or properties by which to sort returned users, followed by asc (default) or desc to control sort direction.
parameters.search	string	Optional	Searches according to the REST standard (searching with "contains"). Search matches when all search terms appear in the group name.
parameters.includeMembers	boolean	Optional	Whether or not to return members for each user group as part of the response.

Input Example

{"parameters":{"filter":"groupType eq Vault","sort":"name asc","search":"mock","includeMembers":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.id	number	Unique identifier
value.groupType	string	Type of the resource
value.members	array	Value for the parameter
value.members.UserName	string	Name of the resource
value.members.id	number	Unique identifier
value.groupName	string	Name of the resource
value.description	string	Value for the parameter
value.location	string	Value for the parameter
count	number	Count value

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":{"value":[{}],"count":1}}

Get Users

Retrieve a list of all users in the CyberArk Vault, excluding Master and Batch built-in users.

Endpoint

URL: /PasswordVault/API/Users/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Filters according to the REST standard. Search for users using the following filters userType, componentUser and userName.
parameters.sort	string	Optional	Property or properties by which to sort returned users, followed by asc (default) or desc to control sort direction.
parameters.search	string	Optional	Search using the following values username, firstname and lastname.
parameters.ExtendedDetails	boolean	Optional	Returns additional user details as user groups and userDN for LDAP users.
parameters.pageOffset	number	Optional	Offsets the first user that is returned in the results.
parameters.pageSize	number	Optional	When used together with the Offset parameter, this value determines the maximum number of users to return.

Input Example

{"parameters":{"filter":"userName eq test","sort":"username asc","search":"username","ExtendedDetails":true,"pageOffset":0,"pageSize":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Users	array	Output field: Users
Users.id	number	Unique identifier
Users.username	string	Name of the resource
Users.source	string	Output field: Users.source
Users.userType	string	Type of the resource
Users.componentUser	boolean	Output field: Users.componentUser
Users.groupsMembership	array	Output field: Users.groupsMembership
Users.groupsMembership.groupID	number	Unique identifier
Users.groupsMembership.groupName	string	Name of the resource
Users.groupsMembership.groupType	string	Type of the resource
Users.vaultAuthorization	array	Output field: Users.vaultAuthorization
Users.location	string	Output field: Users.location
Users.personalDetails	object	Output field: Users.personalDetails
Users.personalDetails.firstName	string	Name of the resource
Users.personalDetails.middleName	string	Unique identifier
Users.personalDetails.lastName	string	Name of the resource
Total	number	Output field: Total

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":{"Users":[{}],"Total":1}}

Remove User from Group

Remove a specified user from a CyberArk Vault user group using the provided groupID and member details.

Endpoint

URL: /PasswordVault/API/UserGroups/{{groupID}}/Members/{{member}}/

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.groupID	string	Required	The unique ID of the group.
path_parameters.member	string	Required	The name of the group member to be removed.

Input Example

{"path_parameters":{"groupID":"123","member":"test"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}

Reset User Password

Reset a CyberArk Vault user's password using the specified UserID and new password to ensure secure access management.

Endpoint

URL: /PasswordVault/API/Users/{{UserID}}/ResetPassword/

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.UserID	number	Required	The user's unique ID.
newPassword	string	Optional	The users new password.

Input Example

{"json_body":{"newPassword":"mockpassword"},"path_parameters":{"UserID":234}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}

Update Account

Update an existing CyberArk account's details using the specified AccountID. Requires path parameters and a JSON body.

Endpoint

URL: /PasswordVault/API/Accounts/{{AccountID}}/

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.AccountID	string	Required	The unique ID of the account to update.

Input Example

{"json_body":[{"op":"replace","path":"/address","value":"10.10.27.254"},{"op":"replace","path":"/secretManagement/automaticManagementEnabled","value":"false"}],"path_parameters":{"AccountID":"123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
name	string	Name of the resource
address	string	Output field: address
userName	string	Name of the resource
platformId	string	Unique identifier
safeName	string	Name of the resource
secretType	string	Type of the resource
platformAccountProperties	object	Output field: platformAccountProperties
secretManagement	object	Output field: secretManagement
secretManagement.automaticManagementEnabled	boolean	Output field: secretManagement.automaticManagementEnabled
secretManagement.manualManagementReason	string	Response reason phrase
secretManagement.status	string	Status value
secretManagement.lastModifiedTime	number	Time value
secretManagement.lastReconciledTime	number	Time value
secretManagement.lastVerifiedTime	number	Time value
remoteMachinesAccess	object	Output field: remoteMachinesAccess
remoteMachinesAccess.remoteMachines	string	Output field: remoteMachinesAccess.remoteMachines
remoteMachinesAccess.accessRestrictedToRemoteMachines	boolean	Output field: remoteMachinesAccess.accessRestrictedToRemoteMachines
createdTime	number	Time value

Output Example

Update Security Event Status

Update the status of a specified security event in CyberArk to open or closed using the provided securityEventId.

Endpoint

URL: /PasswordVault/API/pta/API/Events/{{securityEventId}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.securityEventId	string	Required	Security event id.
mStatus	string	Optional	The new status of the event.
closeReason	string	Optional	The close reason for the security event after you have investigated and handled the event successfully or determined to close it for other reasons.
reasonText	string	Optional	Free text for the user to elaborate on the close reason. Limited to 100 characters.

Input Example

{"json_body":{"mStatus":"CLOSED","closeReason":"HANDLED","reasonText":"Handled by SOC team"},"path_parameters":{"securityEventId":"123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
type	string	Type of the resource
score	number	Score value
createTime	number	Time value
lastUpdateTime	number	Time value
audits	array	Output field: audits
audits.id	string	Unique identifier
audits.type	string	Type of the resource
audits.sensorType	string	Type of the resource
audits.action	string	Output field: audits.action
audits.psmCommand	string	Output field: audits.psmCommand
audits.createTime	number	Time value
audits.vaultUser	string	Output field: audits.vaultUser
audits.account	object	Count value
audits.account.accountAsStr	string	Output field: audits.account.accountAsStr
audits.account.type	string	Type of the resource
audits.account.account	object	Count value
audits.account.account.mTarget	object	Output field: audits.account.account.mTarget
audits.account.account.mTarget.mOriginalAddress	string	Output field: audits.account.account.mTarget.mOriginalAddress
audits.account.account.mTarget.mResolvedAddress	object	Output field: audits.account.account.mTarget.mResolvedAddress
audits.account.account.mUser	string	Output field: audits.account.account.mUser
audits.source	object	Output field: audits.source
audits.source.mOriginalAddress	string	Output field: audits.source.mOriginalAddress

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":{"id":"444445e56bbb0b0a063f4444","type":"PSMSuspiciousActivity","score":70,"createTime":1586134861000,"lastUpdateTime":1586134861000,"audits":[{}],"additionalData":{"matchPatterns":"kill(.*)"},"mStatus":"CLOSED","closeReason":"HANDLED","reasonText":"Handled by SOC team"}}

Update User

Modify a CyberArk Vault user's details using their userID and new username. Requires both userID and username.

Endpoint

URL: /PasswordVault/API/Users/{{userID}}/

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.userID	string	Required	Parameters for the Update User action
username	string	Optional	The name of the user.
userType	string	Optional	The user type that was returned according to the license.
unauthorizedInterfaces	array	Optional	The user type that was returned according to the license.
location	string	Optional	The location in the Vault where the user will be created.
expiryDate	number	Optional	The date when the user expires.
userActivityLogRetentionDays	number	Optional	The number of days that a user's account activity records are stored before they are deleted.
loginFromHour	number	Optional	The starting time of the timeframe in which a user can log in to an account.
loginToHour	number	Optional	The ending time of the timeframe in which a user can log in to an account.
enableUser	boolean	Optional	Whether the user is enabled.
authenticationMethod	array	Optional	The authentication method that the user uses to log on.
password	string	Optional	The password that the user will use to log on for the first time.
changePassOnNextLogon	boolean	Optional	Whether or not the user must change their password from the second log on onward.
passwordNeverExpires	boolean	Optional	Whether the user's password will not expire unless they decide to change it.
distinguishedName	string	Optional	The user's distinguished name.
vaultAuthorization	array	Optional	The user permissions.
businessAddress	object	Optional	The user's postal address, including city, state, zip, country and street.
businessAddress.workStreet	string	Optional	Parameter for Update User
businessAddress.workCity	string	Optional	Parameter for Update User
businessAddress.workState	string	Optional	Parameter for Update User
businessAddress.workZip	string	Optional	Parameter for Update User
businessAddress.workCountry	string	Optional	Parameter for Update User
internet	object	Optional	The user's email addresses, including Home page, Home email, Business email and Other email.
internet.homePage	string	Optional	Parameter for Update User
internet.homeEmail	string	Optional	Parameter for Update User

Input Example

{"json_body":{"username":"newUser","userType":"EPVUser","unauthorizedInterfaces":["PIMSU","PSM"],"location":"\\","expiryDate":1577836800,"userActivityLogRetentionDays":30,"loginFromHour":1577836800,"loginToHour":1577836800,"enableUser":true,"authenticationMethod":["AuthTypePass"],"password":"MyPassword123","changePassOnNextLogon":true,"passwordNeverExpires":true,"distinguishedName":"newUser@cyberark","vaultAuthorization":["AddSafes","AuditUsers"],"businessAddress":{"workStreet":"Hapssagot 9","workCity":"Petah Tikva","workState":"Israel","workZip":"9999999","workCountry":"Israel"},"internet":{"homePage":"Cyberark.com","homeEmail":"[email protected]","businessEmail":"[email protected]","otherEmail":"[email protected]"},"phones":{"homeNumber":"555123456","businessNumber":"555456789","cellularNumber":"555789789","faxNumber":"999999","pagerNumber":"111111"},"description":"This user is privileged","personalDetails":{"street":"2 Second Street","city":"Tel Aviv","state":"Israel","zip":"123456","country":"Israel","title":"Mr. VIP","organization":"CyberArk","department":"R&D","profession":"software development","firstName":"John","middleName":"Don","lastName":"Smith"}},"path_parameters":{"userID":"123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
enableUser	boolean	Output field: enableUser
changePassOnNextLogon	boolean	Output field: changePassOnNextLogon
expiryDate	number	Date value
suspended	boolean	Output field: suspended
unAuthorizedInterfaces	array	Output field: unAuthorizedInterfaces
authenticationMethod	array	HTTP method to use
passwordNeverExpires	boolean	Output field: passwordNeverExpires
distinguishedName	string	Name of the resource
description	string	Output field: description
businessAddress	object	Output field: businessAddress
businessAddress.workStreet	string	Output field: businessAddress.workStreet
businessAddress.workCity	string	Output field: businessAddress.workCity
businessAddress.workState	string	Output field: businessAddress.workState
businessAddress.workZip	string	Output field: businessAddress.workZip
businessAddress.workCountry	string	Output field: businessAddress.workCountry
internet	object	Output field: internet
internet.homePage	string	Output field: internet.homePage
internet.homeEmail	string	Output field: internet.homeEmail
internet.businessEmail	string	Output field: internet.businessEmail
internet.otherEmail	string	Output field: internet.otherEmail
phones	object	Output field: phones
phones.homeNumber	string	Output field: phones.homeNumber
phones.businessNumber	string	Output field: phones.businessNumber

Output Example

{"status_code":200,"response_headers":{},"reason":"Success","json_body":{"enableUser":true,"changePassOnNextLogon":false,"expiryDate":1577836800,"suspended":false,"unAuthorizedInterfaces":["GUI"],"authenticationMethod":["AuthTypePass"],"passwordNeverExpires":true,"distinguishedName":"JohnDoeRoe","description":"John Doe Roe","businessAddress":{"workStreet":"Kuritania street","workCity":"Curitania","workState":"Suritania","workZip":"90211","workCountry":"Ruritania"},"internet":{"homePage":"example...

Verify Account Credentials

Mark an account for verification in CyberArk using the provided AccountID as a path parameter.

Endpoint

URL: /PasswordVault/API/Accounts/{{AccountID}}/Verify/

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.AccountID	string	Required	The unique ID of the account.

Input Example

{"path_parameters":{"AccountID":"123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT