# Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The BeyondTrust Password Safe (On-Premise) connector uses the following default correlation and object configurations. > [!NOTE] > > The BeyondTrust Password Safe (On-Premise) connector only supports the schema attributes covered in the following topics: ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | ID | Account | | ID | Group | ### Default Account Attributes The BeyondTrust Password Safe (On-Premise) connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | id | Unique identifier for the User. | | userName | Unique username for the User. | | name.formatted | The full name. | | name.familyName | The family name of the User. | | name.givenName | The given name of the User. | | displayName | The name of the User, suitable for display to end-users. | | title | The User's title, such as 'Vice President'. | | userType | Used to identify the relationship between the organization and the User. | | active | A Boolean value indicating the User's administrative status. | | manager.value | Manager value. | | organization | Organization value. | | email | Email address for the user. | | emails.work.primary.display | A human-readable name, primarily used for display purposes. | | emails.work.secondary.display | A human-readable name, primarily used for display purposes. | | emails.work.primary.value | Email address value. | | emails.work.secondary.value | Email address value. | | emails.home.primary.display | A human-readable name, primarily used for display purposes. | | emails.home.secondary.display | A human-readable name, primarily used for display purposes. | | emails.home.primary.value | Email address value. | | emails.home.secondary.value | Email address value. | | emails.home.primary | (This is the Drop-down text) | | emails.other.primary.display | A human-readable name, primarily used for display purposes. | | emails.other.secondary.display | A human-readable name, primarily used for display purposes. | | emails.other.primary.value | Email address value. | | emails.other.secondary.value | Email address value. | | phoneNumbers.work.primary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.work.secondary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.work.primary.value | Phone number of the user. | | phoneNumbers.work.secondary.value | Phone number of the user. | | phoneNumbers.home.primary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.home.secondary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.home.primary.value | Phone number of the user. | | phoneNumbers.home.secondary.value | Phone number of the user. | | phoneNumbers.mobile.primary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.mobile.secondary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.mobile.primary.value | Phone number of the user. | | phoneNumbers.mobile.secondary.value | Phone number of the user | | costCenter | costCenter for the User. | | department | department for the User. | | groups | A list of groups to which the user belongs, either through direct membership, through nested groups, or dynamically calculated. | | externalId | An identifier for the resource as defined by the provisioning client. | | LinkedObject.Source | The name of the external application on which the object lives. If this is a PAM local object, this is null. | | LinkedObject.NativeIdentifier | The native identifier of the object on the external application, for example the LDAP DN. If this is a PAM local object, this is null. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The BeyondTrust Password Safe (On-Premise) connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | id | Unique identifier for the group. | | displayName | Displayable Name of the group. | | members.value | Members of the group. | | description | Description of the group. |