> ## Documentation Index > Fetch the complete documentation index at: https://docs.serval.com/llms.txt > Use this file to discover all available pages before exploring further. # BeyondTrust Password Safe > Connect BeyondTrust Password Safe to manage privileged access requests, group membership, and password rotation. Connect **BeyondTrust Password Safe** to automate privileged account access and password management. This integration uses the BeyondInsight and Password Safe public API and is available in beta. For remote-access users, asset groups, and the PRA vault, connect [BeyondTrust Privileged Remote Access](/sections/integrations/beyondtrust-pra) separately. ## Before you connect You need an instance reachable over HTTPS and an OAuth application user in BeyondInsight: 1. Create an API registration of type **API Access Policy**. 2. Add the required IP authentication rule for the source addresses that connect to BeyondTrust. Contact **[support@serval.com](mailto:support@serval.com)** for Serval's egress addresses before connecting. For a self-hosted deployment or a self-hosted worker using direct routing, allowlist its outbound source addresses instead. 3. Create an application user, assign the API access policy, and record its client ID and client secret. 4. Add the application user to a group with the permissions your workflows need. 5. Enable API access on the managed accounts you want to use. The connection uses the application user's identity. It doesn't impersonate the person requesting help in Serval. BeyondTrust continues to enforce its access policies, approval requirements, and account permissions. See BeyondTrust's [API registration guide](https://docs.beyondtrust.com/bips/docs/ps-configure-api-registration), [SignAppIn reference](https://docs.beyondtrust.com/bips/reference/post-api-public-v3-auth-signappin), and [API authentication overview](https://docs.beyondtrust.com/bips/reference/beyondinsight-and-password-safe-api-usage) for setup and authentication details. API-key authentication, interactive multifactor challenges, and client-certificate authentication aren't supported by this connection. ## Connect to Serval In **Integrations > All integrations**, select **BeyondTrust Password Safe**. * **Instance Host**: Your instance hostname, such as `passwordsafe.example.com`. An optional port is supported. Don't include a path or an HTTP URL. * **Client ID**: The application user's OAuth client ID. * **Client Secret**: The application user's OAuth client secret. Serval stores the credentials and manages authentication sessions for you. Run **Test Connection**. It authenticates and reads managed account metadata. A successful connection can return an empty account list when no managed accounts are available to the application user. Private instances require a network path from a self-hosted deployment or a self-hosted worker configured for direct routing. The instance must present a trusted TLS certificate. ## Installable workflows The **Privileged Access and Password Management** bundle includes: * **List Password Safe Managed Accounts**: Search account metadata by system or account name. Always returns a list. Providing both names selects one account and ignores pagination. Otherwise, results are limited to 100 accounts per page; use the offset to request another page. * **Request Password Safe Access**: Request time-limited password viewing access with a reason and optional ticket number. Returns a request ID, reusing an eligible existing request for the same application user, system, account, and access type without renewing its duration. Rotation on check-in is requested when creating a request, subject to the account and access policy settings. * **List Password Safe Access Requests**: Find pending requests in the connected user's approver queue. * **Approve Password Safe Request** and **Deny Password Safe Request**: Approve or deny requests raised by other BeyondInsight users, with a recorded reason. * **Check In Password Safe Request**: Check in a request with a recorded reason. * **Rotate Password Safe Account Password**: Generate a new password and update both the managed system and Password Safe. * **Grant Password Safe Group Membership** and **Revoke Password Safe Group Membership**: Add or remove direct BeyondInsight group membership. Removing one membership doesn't remove access granted through other groups. Workflows that change access or passwords require installer approval by default. Request and check-in operations require the appropriate Requestor role; approval and denial require the appropriate Approver role. Password rotation requires **Password Safe Account Management** with full control. Group membership changes require **User Accounts Management** with full control. On Pathfinder, the group-membership workflows can only add or remove application-type users; other user types return HTTP 400. BeyondTrust doesn't allow a user to approve or deny their own request. To act on a request created by **Request Password Safe Access**, run the approve or deny workflow through a second Password Safe connection with a different application user and the required Approver role. Using the requesting connection returns HTTP 403 with BeyondTrust code `4033`. ## Password retrieval and custom workflows The typed API action also supports credential retrieval for an approved request, managed systems, access policies, Smart Rule roles, and privileged sessions. Credential retrieval uses `/BeyondTrust/api/public/v3/credentials/{requestId}`. Check in the request after the consuming operation finishes, including when that operation fails. Retrieving a password doesn't check the request in automatically. The installable workflows return request IDs or account metadata without fetching password values. Custom workflows that retrieve credentials handle sensitive values; don't return those values to help-desk conversations or include them in notifications. ## Troubleshooting * **Authentication fails**: Check the instance host, application-user credentials, API access policy, and source-address restrictions. * **Access is forbidden**: Check the application user's group permissions, the managed account's API access setting, and the applicable access policy. * **A request is pending**: Complete the required approval in BeyondTrust before retrieving credentials, using a different user from the requester. Creating a request doesn't approve it. * **The instance is unreachable**: Check DNS, firewall rules, TLS trust, and the connection's routing configuration.