# CyberArk Central Credential Provider (CCP) Secret Path Expressions

For more information on how to configure the CyberArk Central Credential Provider (CCP), refer to [CyberArk Central Credential Provider (CCP)](</connectors/credential_providers/cyberark_ccp/help/index.html>).

Path syntax: `{params required to fetch secret}/{secretKey}`

Secret URL: `secrets://{CyberArk Central Credential Provider Source Name}/{params required to fetch secret}/{secretKey}`

> [!IMPORTANT]
>
> The URL path should always start with the prefix, secrets://. Each URL should be URL-encoded. Each URL attribute in the path is case-sensitive

The CyberArk Central Credential Provider fetches secret using REST API. The REST API URL format to fetch secrets is as follows:

```text
https://<IIS_Server_Host_URL>/<WebService_NAME>/api/Accounts?<param1>=<value>&<param2>=<value>&
```

> [!NOTE]
>
> In the provided example, the parameters required to fetch the secret are `<param1>=<value>&<param2>=<value>&`

Secret URL example:

**Before Encoding**

```text
secrets://<CyberArk Central Credential Provider Source>/<Object=Cloud Service-AWS-Salesforce-admin&AppID=Test1>/<Content>
```

Where:

- `<CyberArk Central Credential Provider Source>` - Configured Credential Provider
- `<Object=Cloud Service-AWS-Salesforce-harshaladmin&AppID=Test1>` - Parameters required to fetch secrets
- `<Content>` - Key to retrieve from the secret response

**After Encoding**

```text
secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content
```

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content?prefix=suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.