Skip to main content
Connect BeyondTrust Privileged Remote Access to manage remote-access configuration and vault accounts. This integration uses the PRA Configuration API and is available in beta. Depending on your BeyondTrust version, asset groups, asset roles, and asset policies may be labeled Jump Groups, Jump Item Roles, and Jump Policies. For BeyondInsight managed accounts and Password Safe approval requests, connect BeyondTrust Password Safe separately.

​
Before you connect

In your PRA /login interface, go to Management > API Configuration and create an API account. Under Permissions > Configuration API, select Allow Access. Also select Manage Vault Accounts for the vault workflows and the List Vault Accounts health check. Record the OAuth client ID, generate a client secret, and save the account. See BeyondTrust’s Configuration API guide and authentication guide.

​
Connect to Serval

1

Choose the integration

In Integrations > All integrations, select BeyondTrust Privileged Remote Access.
2

Enter your connection details

  • Instance Host: Your PRA hostname, such as access.example.com. An optional port is supported. Don’t include /login, another path, or an HTTP URL.
  • Client ID: The API account’s OAuth client ID.
  • Client Secret: The API account’s OAuth client secret.
3

Verify the connection

Run Test Connection to authenticate and read PRA user metadata.
The instance must be reachable over HTTPS with a trusted TLS certificate. Private instances require a network path from a self-hosted deployment or a self-hosted worker configured for direct routing.

​
Installable workflows

The Privileged Access and Password Management bundle includes:
  • Find PRA Users: Search by email address.
  • List PRA Asset Groups: Search groups by name.
  • Grant PRA Asset Group Access: Add a user to a group with explicit asset role and policy IDs.
  • Revoke PRA Asset Group Access: Remove direct group membership.
  • List PRA Vault Accounts: Search vault account metadata by name.
  • Rotate PRA Vault Credentials: Schedule rotation for supported Windows or AWS vault accounts.
  • Check In PRA Vault Account: Release an account checked out by the API account.
Search workflows return one page of up to 100 results. Use the page input to retrieve additional results. Workflows that change access or credentials require installer approval by default. Removing direct asset group membership doesn’t remove access inherited through a group policy or administrator permission. Review those grants separately when revoking a user’s access.

​
Custom workflows

The typed Configuration API action supports users, teams, group policies, asset groups and policies, vault accounts, and vault account groups. It includes vault checkout and check-in endpoints. Custom workflows that check out a credential must check it in after use, including on failure. Don’t return credential values to help-desk conversations or include them in notifications. The connection manages configuration through the API. Launching remote sessions, Command API calls, and Reporting API downloads aren’t included.

​
Troubleshooting

  • Authentication fails: Verify the instance host and client credentials. If you generate a new client secret in BeyondTrust, update the Serval connection.
  • Access is forbidden: Verify Configuration API access and the permissions for the requested operation. For vault operations, verify Manage Vault Accounts is selected. A successful user-list health check doesn’t prove vault or write permissions.
  • A user still has access after revocation: Check inherited group policies and administrator permissions.
  • Rotation fails: Verify that BeyondTrust supports rotation for the account type and that the target system is reachable.