id: beyondtrust_password_safe
name: BeyondTrust Password Safe
version: 1.0.0
description: "BeyondTrust Password Safe (Secrets Safe REST API v3) — privileged access and credential retrieval: list managed accounts and systems, request a credential release, and retrieve the credential. API-key (PS-Auth) session authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list managed accounts/systems, create release request, get credential."
category: identity

# Per-instance configuration. Auth signs in with an API key + runas user
# (header 'Authorization: PS-Auth key=<api_key>; runas=<runas_user>;'), which
# establishes a session reused for the request.
config_schema:
  properties:
    base_url:
      type: string
      description: "BeyondTrust URL (e.g. https://beyondtrust.example.com)"
    api_key:
      type: string
      description: "API registration key"
      x-soar-sensitive: true
    runas_user:
      type: string
      description: "Username to run as"
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - base_url
    - api_key
    - runas_user

commands:
  - id: list_managed_accounts
    name: beyondtrust-list-managed-accounts
    description: "List managed accounts."
    risk: read
    inputs_schema:
      properties:
        account_name: { type: string, description: "Optional account name filter" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_managed_systems
    name: beyondtrust-list-managed-systems
    description: "List managed systems."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: create_release_request
    name: beyondtrust-create-release-request
    description: "Request a credential release for a managed account."
    inputs_schema:
      properties:
        system_id: { type: string, description: "Managed system ID" }
        account_id: { type: string, description: "Managed account ID" }
        duration_minutes: { type: number, description: "Access duration in minutes (default 30)" }
        reason: { type: string, description: "Reason for the request" }
      required: [system_id, account_id]
    outputs_schema: { properties: {} }
  - id: get_credential
    name: beyondtrust-get-credential
    description: "Retrieve the credential for an approved request."
    inputs_schema:
      properties:
        request_id: { type: string, description: "Request ID (from create-release-request)" }
      required: [request_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: beyondtrust-test-connection
    description: "Verify the sign-in (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }