# BeyondTrust Password Safe Cloud (Secrets Manager) Credential Provider Secret Path Expressions

Use the path expressions listed in this topic to use the BeyondTrust Password Safe Cloud (Secrets Manager) in your source authentication configurations.

Secret URL syntax: `secrets://{CredentialProviderName}/{SecretURL}`

The following is an explanation of the attributes of this URL:

- `CredentialProviderName` - The name of the credential provider source configured in SailPoint.
- `SecretURL` - A query string that uniquely identifies the secret within BeyondTrust Password Safe. It specifies the managed system and the managed account within that system. The format of the `SecretURL` is as follows:

  ```text
  systemName={nameOfManagedSystem}&accountName={nameOfManagedAccount}
  ```

> [!IMPORTANT]
>
> - `CredentialProviderName` and `SecretURL` must be URL-encoded individually before constructing the final secret path expression.
> - `systemName` and `accountName` are reserved keywords in the `SecretURL` format and must not be used as part of the values for `nameOfManagedSystem` or `nameOfManagedAccount`.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Secret URL Examples

**Before Encoding**

```text
secrets://BeyondTrust Password Safe/systemName=Microsoft Entra ID&accountName=user@company.onmicrosoft.com
```

**After Encoding**

```text
secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com
```

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `Secure#456`, but the complete value required by the secret field is `app1-dev@Secure#456` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?prefix=app1-dev%40
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `app1-dev`, but the complete value required by the secret field is `app1-dev@Secure#456` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?suffix=%40Secure%23456
  ```