# CyberArk Conjur Cloud Secret Path Expressions

For more information, refer to [Retrieve a secret](<https://docs.conjur.org/Latest/en/Content/Developer/Conjur_API_Retrieve_Secret.htm?tocpath=Developer%7CREST APIs%7C_____7>) in the CyberArk documentation.

For information on how to configure the CyberArk Conjur Cloud credential provider, refer to [CyberArk Conjur Cloud Credential Provider](</connectors/credential_providers/cyberark_conjur_cloud/help/index.html>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Username

Path syntax: `secrets://{CredentialProviderSourceName}/{ResourceIdOfSecret}`

> [!NOTE]
>
> The `ResourceIdofSecret` attribute can be obtained from **Conjur Cloud \> Resources** then select the created Secret.

> [!NOTE]
>
> **Screenshot**
>
> [![Conjur Cloud Resources](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/img/conjurcloud_operatingsys.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/img/conjurcloud_operatingsys.png>)

For example:

**Before Encoding**

```text
secrets://CyberarkConjurCloudSource/data/vault/LDAP Safe/Operating System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount/username
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, secrets://. Each URL attribute should be URL-encoded. For example, `CredentialProviderSourceName`, `ResourceIdOfSecret`, the prefix, and the suffix must be encoded separately. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

```text
secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername
```

The following is an explanation of the attributes of this URL:

- `CyberarkConjurCloudSource` - The Configured Credential Provider in the Credential Provider Section.
- `data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername` - The encoded resource ID of the secret.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Password

Path syntax: `secrets://{CredentialProviderSourceName}/{ResourceIdOfSecret}`

For example:

**Before Encoding**

```text
secrets://CyberarkConjurCloudSource/data/vault/LDAP Safe/Operating System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount/password
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, secrets://. Each URL attribute should be URL-encoded. For example, `CredentialProviderSourceName`, `ResourceIdOfSecret`, the prefix, and the suffix must be encoded separately. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

```text
secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fpassword
```

The following is an explanation of the components of this URL:

- `CyberarkConjurCloudSource` - Configured Credential Provider in the Credential Provider Section.
- `data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fpassword` - The encoded resource ID of the secret.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername?suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.