Overview
CyberArk Privileged Access Security is enterprise-grade privileged-credential management – vault accounts, sessions, rotation, monitoring. The Automize CyberArk connector covers safes, accounts, credential retrieval, and sessions.
- Regions: Self-hosted (PAM-CORE) or SaaS (Privilege Cloud). Connector pins to one PVWA URL per connection.
- Plans: Enterprise licensing per privileged user.
Setting up the connection
Auth type: Bearer Token.
- CyberArk admin issues a service account + creates an API user.
- Connector logs in via the Logon endpoint → bearer token returned.
- In Automize → Settings → Connectors → CyberArk. Paste PVWA URL + username + password (API user).
Find your credentials at https://docs.cyberark.com/.
Rate limits
Per-account, controlled by CyberArk admin. Connector retries 429 with backoff.
Data model
PAM primitives:
Safe (folder for credentials) ─── Accounts (credential entries) ─── Versions
└─ Members (RBAC)
Sessions (live PAM sessions for audit)
Platforms (credential templates per technology)Available operations
23 operations available. Click any row to jump to its detail.
| Operation | Category | What it does |
|---|---|---|
| Add Safe Member | General | Add a member to a safe |
| Change Password | General | Update the password for an account |
| Create Account | General | Create a new privileged account |
| Create Safe | General | Create a new safe |
| Delete Account | General | Delete an account |
| Delete Safe | General | Delete a safe |
| Get Account | General | Get account details |
| Get Platform | General | Get platform details |
| Get Safe | General | Get safe details |
| Get Security Events | General | Get security risk events |
| List Accounts | General | List all accounts |
| List Connections | General | List PSM sessions |
| List Platforms | General | List all platforms |
| List PTA Events | General | List Privileged Threat Analytics events |
| List Safe Members | General | List members of a safe |
| List Safes | General | List all safes |
| Logoff | General | End the current session |
| Logon | General | Authenticate and get a session token |
| Reconcile Credentials | General | Reconcile account credentials |
| Retrieve Password | General | Retrieve the password for an account |
| Update Account | General | Update an account |
| Update Safe | General | Update a safe |
| Verify Credentials | General | Verify account credentials on the target system |
Operations
Add Safe Member
Add a member to a safe
| Parameter | Required | Type | Description |
|---|---|---|---|
Safe Name safe_name | Yes | text |
Change Password
Update the password for an account
| Parameter | Required | Type | Description |
|---|---|---|---|
Account Id account_id | Yes | text |
Tips
- Triggers CPM (Central Password Manager) to rotate the credential.
Create Account
Create a new privileged account
No input parameters.
Create Safe
Create a new safe
No input parameters.
Delete Account
Delete an account
| Parameter | Required | Type | Description |
|---|---|---|---|
Account Id account_id | Yes | text |
Delete Safe
Delete a safe
| Parameter | Required | Type | Description |
|---|---|---|---|
Safe Name safe_name | Yes | text |
Get Account
Get account details
| Parameter | Required | Type | Description |
|---|---|---|---|
Account Id account_id | Yes | text |
Tips
- Returns metadata only. Use Get Password for the actual secret.
Get Platform
Get platform details
| Parameter | Required | Type | Description |
|---|---|---|---|
Platform Id platform_id | Yes | text |
Get Safe
Get safe details
| Parameter | Required | Type | Description |
|---|---|---|---|
Safe Name safe_name | Yes | text |
Get Security Events
Get security risk events
No input parameters.
List Accounts
List all accounts
No input parameters.
Tips
- Filter by safe_name, search (name/address).
List Connections
List PSM sessions
No input parameters.
List Platforms
List all platforms
No input parameters.
List PTA Events
List Privileged Threat Analytics events
No input parameters.
List Safe Members
List members of a safe
| Parameter | Required | Type | Description |
|---|---|---|---|
Safe Name safe_name | Yes | text |
List Safes
List all safes
No input parameters.
Tips
- Safes the user can see. Heavy on big tenants – page via limit + offset.
Logoff
End the current session
No input parameters.
Logon
Authenticate and get a session token
| Parameter | Required | Type | Description |
|---|---|---|---|
Username username | No | text | |
Password password | No | text |
Reconcile Credentials
Reconcile account credentials
| Parameter | Required | Type | Description |
|---|---|---|---|
Account Id account_id | Yes | text |
Retrieve Password
Retrieve the password for an account
| Parameter | Required | Type | Description |
|---|---|---|---|
Account Id account_id | Yes | text |
Update Account
Update an account
| Parameter | Required | Type | Description |
|---|---|---|---|
Account Id account_id | Yes | text |
Tips
- Update name, address, username (NOT password – use Change Password).
Update Safe
Update a safe
| Parameter | Required | Type | Description |
|---|---|---|---|
Safe Name safe_name | Yes | text |
Verify Credentials
Verify account credentials on the target system
| Parameter | Required | Type | Description |
|---|---|---|---|
Account Id account_id | Yes | text |
FAQ
- Why does Get Password trigger an alert?
- Direct password retrieval is audited + can trigger SIEM alerts. Prefer Get Session / Just-In-Time access patterns where possible.
- CCP vs PAM-Self-Hosted vs Privilege Cloud?
- CCP (Central Credential Provider) is for app-to-app secret retrieval (REST). PAM-SH is on-prem. Privilege Cloud is SaaS. Same API surface.