Skip to main content
Connect BeyondTrust Password Safe to automate privileged account access and password management. This integration uses the BeyondInsight and Password Safe public API and is available in beta. For remote-access users, asset groups, and the PRA vault, connect BeyondTrust Privileged Remote Access separately.

​
Before you connect

You need an instance reachable over HTTPS and an OAuth application user in BeyondInsight:
  1. Create an API registration of type API Access Policy.
  2. Add the required IP authentication rule for the source addresses that connect to BeyondTrust. Contact support@serval.com for Serval’s egress addresses before connecting. For a self-hosted deployment or a self-hosted worker using direct routing, allowlist its outbound source addresses instead.
  3. Create an application user, assign the API access policy, and record its client ID and client secret.
  4. Add the application user to a group with the permissions your workflows need.
  5. Enable API access on the managed accounts you want to use.
The connection uses the application user’s identity. It doesn’t impersonate the person requesting help in Serval. BeyondTrust continues to enforce its access policies, approval requirements, and account permissions. See BeyondTrust’s API registration guide, SignAppIn reference, and API authentication overview for setup and authentication details. API-key authentication, interactive multifactor challenges, and client-certificate authentication aren’t supported by this connection.

​
Connect to Serval

1

Choose the integration

In Integrations > All integrations, select BeyondTrust Password Safe.
2

Enter your connection details

  • Instance Host: Your instance hostname, such as passwordsafe.example.com. An optional port is supported. Don’t include a path or an HTTP URL.
  • Client ID: The application user’s OAuth client ID.
  • Client Secret: The application user’s OAuth client secret.
Serval stores the credentials and manages authentication sessions for you.
3

Verify the connection

Run Test Connection. It authenticates and reads managed account metadata. A successful connection can return an empty account list when no managed accounts are available to the application user.
Private instances require a network path from a self-hosted deployment or a self-hosted worker configured for direct routing. The instance must present a trusted TLS certificate.

​
Installable workflows

The Privileged Access and Password Management bundle includes:
  • List Password Safe Managed Accounts: Search account metadata by system or account name. Always returns a list. Providing both names selects one account and ignores pagination. Otherwise, results are limited to 100 accounts per page; use the offset to request another page.
  • Request Password Safe Access: Request time-limited password viewing access with a reason and optional ticket number. Returns a request ID, reusing an eligible existing request for the same application user, system, account, and access type without renewing its duration. Rotation on check-in is requested when creating a request, subject to the account and access policy settings.
  • List Password Safe Access Requests: Find pending requests in the connected user’s approver queue.
  • Approve Password Safe Request and Deny Password Safe Request: Approve or deny requests raised by other BeyondInsight users, with a recorded reason.
  • Check In Password Safe Request: Check in a request with a recorded reason.
  • Rotate Password Safe Account Password: Generate a new password and update both the managed system and Password Safe.
  • Grant Password Safe Group Membership and Revoke Password Safe Group Membership: Add or remove direct BeyondInsight group membership. Removing one membership doesn’t remove access granted through other groups.
Workflows that change access or passwords require installer approval by default. Request and check-in operations require the appropriate Requestor role; approval and denial require the appropriate Approver role. Password rotation requires Password Safe Account Management with full control. Group membership changes require User Accounts Management with full control. On Pathfinder, the group-membership workflows can only add or remove application-type users; other user types return HTTP 400. BeyondTrust doesn’t allow a user to approve or deny their own request. To act on a request created by Request Password Safe Access, run the approve or deny workflow through a second Password Safe connection with a different application user and the required Approver role. Using the requesting connection returns HTTP 403 with BeyondTrust code 4033.

​
Password retrieval and custom workflows

The typed API action also supports credential retrieval for an approved request, managed systems, access policies, Smart Rule roles, and privileged sessions. Credential retrieval uses /BeyondTrust/api/public/v3/credentials/{requestId}. Check in the request after the consuming operation finishes, including when that operation fails. Retrieving a password doesn’t check the request in automatically. The installable workflows return request IDs or account metadata without fetching password values. Custom workflows that retrieve credentials handle sensitive values; don’t return those values to help-desk conversations or include them in notifications.

​
Troubleshooting

  • Authentication fails: Check the instance host, application-user credentials, API access policy, and source-address restrictions.
  • Access is forbidden: Check the application user’s group permissions, the managed account’s API access setting, and the applicable access policy.
  • A request is pending: Complete the required approval in BeyondTrust before retrieving credentials, using a different user from the requester. Creating a request doesn’t approve it.
  • The instance is unreachable: Check DNS, firewall rules, TLS trust, and the connection’s routing configuration.