BeyondTrust Password Safe Cloud (Secrets Manager) Credential Provider Secret Path Expressions

Use the path expressions listed in this topic to use the BeyondTrust Password Safe Cloud (Secrets Manager) in your source authentication configurations.

Secret URL syntax: secrets://{CredentialProviderName}/{SecretURL}

The following is an explanation of the attributes of this URL:

CredentialProviderName - The name of the credential provider source configured in SailPoint.
SecretURL - A query string that uniquely identifies the secret within BeyondTrust Password Safe. It specifies the managed system and the managed account within that system. The format of the SecretURL is as follows:
```
systemName={nameOfManagedSystem}&accountName={nameOfManagedAccount}
```

Important

CredentialProviderName and SecretURL must be URL-encoded individually before constructing the final secret path expression.
systemName and accountName are reserved keywords in the SecretURL format and must not be used as part of the values for nameOfManagedSystem or nameOfManagedAccount.

Tip

Use urlencoder.org to encode your URL attributes.

Secret URL Examples

Before Encoding

secrets://BeyondTrust Password Safe/systemName=Microsoft Entra ID&accountName=user@company.onmicrosoft.com

After Encoding

secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com

Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

To add a prefix - ?prefix=<prefix>. For example, if the secret value returned after evaluation is Secure#456, but the complete value required by the secret field is app1-dev@Secure#456 then the secret path expression will be as follows to add the required prefix:
```
secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?prefix=app1-dev%40
```
To add a suffix - ?suffix=<suffix>. For example, if the secret value returned after evaluation is app1-dev, but the complete value required by the secret field is app1-dev@Secure#456 then the secret path expression will be as follows to add the required suffix:
```
secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?suffix=%40Secure%23456
```

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.