> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BeyondTrust Privileged Remote Access

> Connect BeyondTrust PRA to manage remote-access users, asset groups, and vault credentials.

Connect **BeyondTrust Privileged Remote Access** to manage remote-access
configuration and vault accounts. This integration uses the PRA Configuration API
and is available in beta. Depending on your BeyondTrust version, asset groups,
asset roles, and asset policies may be labeled Jump Groups, Jump Item Roles, and
Jump Policies.

For BeyondInsight managed accounts and Password Safe approval requests, connect
[BeyondTrust Password Safe](/sections/integrations/beyondtrust-password-safe)
separately.

## Before you connect

In your PRA `/login` interface, go to **Management > API Configuration** and create
an API account. Under **Permissions > Configuration API**, select **Allow Access**.
Also select **Manage Vault Accounts** for the vault workflows and the **List Vault
Accounts** health check. Record the OAuth client ID, generate a client secret, and
save the account.

See BeyondTrust's [Configuration API guide](https://docs.beyondtrust.com/pra/reference/configuration-api)
and [authentication guide](https://docs.beyondtrust.com/pra/reference/api-guide).

## Connect to Serval

<Steps>
  <Step title="Choose the integration">
    In **Integrations > All integrations**, select **BeyondTrust Privileged Remote Access**.
  </Step>

  <Step title="Enter your connection details">
    * **Instance Host**: Your PRA hostname, such as `access.example.com`. An optional
      port is supported. Don't include `/login`, another path, or an HTTP URL.
    * **Client ID**: The API account's OAuth client ID.
    * **Client Secret**: The API account's OAuth client secret.
  </Step>

  <Step title="Verify the connection">
    Run **Test Connection** to authenticate and read PRA user metadata.
  </Step>
</Steps>

The instance must be reachable over HTTPS with a trusted TLS certificate. Private
instances require a network path from a self-hosted deployment or a self-hosted
worker configured for direct routing.

## Installable workflows

The **Privileged Access and Password Management** bundle includes:

* **Find PRA Users**: Search by email address.
* **List PRA Asset Groups**: Search groups by name.
* **Grant PRA Asset Group Access**: Add a user to a group with explicit asset role
  and policy IDs.
* **Revoke PRA Asset Group Access**: Remove direct group membership.
* **List PRA Vault Accounts**: Search vault account metadata by name.
* **Rotate PRA Vault Credentials**: Schedule rotation for supported Windows or AWS
  vault accounts.
* **Check In PRA Vault Account**: Release an account checked out by the API account.

Search workflows return one page of up to 100 results. Use the page input to
retrieve additional results. Workflows that change access or credentials require
installer approval by default.

Removing direct asset group membership doesn't remove access inherited through a
group policy or administrator permission. Review those grants separately when
revoking a user's access.

## Custom workflows

The typed Configuration API action supports users, teams, group policies, asset
groups and policies, vault accounts, and vault account groups. It includes vault
checkout and check-in endpoints. Custom workflows that check out a credential
must check it in after use, including on failure. Don't return credential values
to help-desk conversations or include them in notifications.

The connection manages configuration through the API. Launching remote sessions,
Command API calls, and Reporting API downloads aren't included.

## Troubleshooting

* **Authentication fails**: Verify the instance host and client credentials. If you
  generate a new client secret in BeyondTrust, update the Serval connection.
* **Access is forbidden**: Verify Configuration API access and the permissions for
  the requested operation. For vault operations, verify **Manage Vault Accounts**
  is selected. A successful user-list health check doesn't prove vault or write
  permissions.
* **A user still has access after revocation**: Check inherited group policies and
  administrator permissions.
* **Rotation fails**: Verify that BeyondTrust supports rotation for the account
  type and that the target system is reachable.