Guillaume BOURGEOIS
5089e4466d
Password Safe REST API v3, 5 commands: list managed accounts/systems, create release request, get credential. PS-Auth session auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
78 lines
2.8 KiB
YAML
78 lines
2.8 KiB
YAML
id: beyondtrust_password_safe
|
|
name: BeyondTrust Password Safe
|
|
version: 1.0.0
|
|
description: "BeyondTrust Password Safe (Secrets Safe REST API v3) — privileged access and credential retrieval: list managed accounts and systems, request a credential release, and retrieve the credential. API-key (PS-Auth) session authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: list managed accounts/systems, create release request, get credential."
|
|
category: identity
|
|
|
|
# Per-instance configuration. Auth signs in with an API key + runas user
|
|
# (header 'Authorization: PS-Auth key=<api_key>; runas=<runas_user>;'), which
|
|
# establishes a session reused for the request.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "BeyondTrust URL (e.g. https://beyondtrust.example.com)"
|
|
api_key:
|
|
type: string
|
|
description: "API registration key"
|
|
x-soar-sensitive: true
|
|
runas_user:
|
|
type: string
|
|
description: "Username to run as"
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- base_url
|
|
- api_key
|
|
- runas_user
|
|
|
|
commands:
|
|
- id: list_managed_accounts
|
|
name: beyondtrust-list-managed-accounts
|
|
description: "List managed accounts."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
account_name: { type: string, description: "Optional account name filter" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: list_managed_systems
|
|
name: beyondtrust-list-managed-systems
|
|
description: "List managed systems."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: create_release_request
|
|
name: beyondtrust-create-release-request
|
|
description: "Request a credential release for a managed account."
|
|
inputs_schema:
|
|
properties:
|
|
system_id: { type: string, description: "Managed system ID" }
|
|
account_id: { type: string, description: "Managed account ID" }
|
|
duration_minutes: { type: number, description: "Access duration in minutes (default 30)" }
|
|
reason: { type: string, description: "Reason for the request" }
|
|
required: [system_id, account_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_credential
|
|
name: beyondtrust-get-credential
|
|
description: "Retrieve the credential for an approved request."
|
|
inputs_schema:
|
|
properties:
|
|
request_id: { type: string, description: "Request ID (from create-release-request)" }
|
|
required: [request_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: beyondtrust-test-connection
|
|
description: "Verify the sign-in (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|