# BeyondTrust Password Safe On-Premise (Secrets Manager) Credential Provider Secret Path Expressions

Use the path expressions listed in this topic to use the BeyondTrust Password Safe On-Premise (Secrets Manager) in your source authentication configurations.

Secret URL syntax: `secrets://{CredentialProviderName}/{SecretURL}`

The following is an explanation of the attributes of this URL:

- `CredentialProviderName` - The name of the credential provider source configured in SailPoint.
- `SecretURL` - A query string that uniquely identifies the secret within BeyondTrust Password Safe. It specifies the managed system and the managed account within that system. The format of the `SecretURL` is as follows:

  ```text
  systemName={nameOfManagedSystem}&accountName={nameOfManagedAccount}
  ```

> [!IMPORTANT]
>
> - `CredentialProviderName` and `SecretURL` must be URL-encoded individually before constructing the final secret path expression.
> - `systemName` and `accountName` are reserved keywords in the `SecretURL` format and must not be used as part of the values for `nameOfManagedSystem` or `nameOfManagedAccount`.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Secret URL Examples

**Before Encoding**

```text
secrets://BeyondTrust Password Safe/systemName=Microsoft Entra ID&accountName=user@company.onmicrosoft.com
```

**After Encoding**

```text
secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com
```

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `Secure#456`, but the complete value required by the secret field is `app1-dev@Secure#456` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?prefix=app1-dev%40
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `app1-dev`, but the complete value required by the secret field is `app1-dev@Secure#456` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?suffix=%40Secure%23456
  ```