# SailPoint Credential Provider Secret Path Expressions Documentation

> Credential Provider Secret Path Expressions Documentation

# Documentation

# AWS Secrets Manager Secret Path Expressions

For information on how to configure the AWS Secrets Manager credential provider, refer to [AWS Secrets Manager](</connectors/credential_providers/aws_secrets_manager/help/index.html>).

## Username

Path syntax: `{Secret ARN}/{secretKey}`

For example:

**Before Encoding**

Using Secret ARN:

```text
secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName/username
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each attribute in the URL path must be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Secret ARN:

```text
secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/username
```

The following is an explanation of the attributes of this URL:

- `aws-vault` - Configured Credential Provider in the Credential Provider Section.
- `arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName` - Secret Path ARN.
- `username` - Secret Key which needs to be fetched from the AWS Secrets Manager.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Password

Path syntax: `{Secret ARN}/{secretKey}`

For example:

**Before Encoding**

Using Secret ARN:

```text
secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName/password
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each attribute in the URL path must be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Secret ARN:

```text
secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password
```

The following is an explanation of the components of this URL:

- `aws-vault` - Configured Credential Provider in the Credential Provider Section.
- `arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName` - Secret Path ARN.
- `password` - Secret Key which needs to be fetched from the AWS Secrets Manager.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName/password?suffix=%40sp.com
  ```
- To add a prefix and suffix - `?prefix=<prefix>&suffix=<suffix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin@sp.com` then the secret path expression will be as follows to add the required prefix and suffix:

  ```text
  secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName/password?prefix=DomainOne%5C&suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

Standard format for credential path:

```text
secrets://{vault-name}/{secret ARN}/{secretKey}?prefix=someValue&suffix=someValue2&versionId=123&versionStage=PREVIOUS
```

> [!IMPORTANT]
>
> Prefix, suffix, versionId, and versionStage are optional.

The AWS Secrets Manager has provision to store secrets in two ways:

1. In key value / JSON / map format.
2. Plain text format.

> [!NOTE]
>
> For secrets which are stored in plain text format, there is no need to provide the secret key in the credential path.

For example:

**Before Encoding**

Using Secret ARN:

```text
secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each attribute in the URL path must be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Secret ARN:

```text
secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName
```

### Other Query Parameters

- **versionId** - The unique identifier of the version of the secret to retrieve. If you include both this parameter and `versionStage`, the two parameters must refer to the same secret version. If you don't specify both `versionStage` and `versionId`, then Secrets Manager returns the `AWSCURRENT` version.

  Example:

  ```text
  secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password?versionId=123
  ```
- **versionStage** - The staging label of the version of the secret to retrieve. Secrets Manager uses staging labels to keep track of different versions during the rotation process. If you include both this parameter and `versionId`, the two parameters must refer to the same secret version. If you don't specify both `versionStage` and `versionId`, Secrets Manager returns the `AWSCURRENT` version.

  Example:

  ```text
  secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password?versionStage=AWSCURRENT
  ```
- **versionId and versionStage** - If you include both the `versionStage` and `versionId` parameters, the two parameters must refer to the same secret version. If you don't specify both `versionStage` and `versionId`, Secrets Manager returns the `AWSCURRENT` version.

  Example:

  ```text
  secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password?versionId=123&versionStage=AWSCURRENT
  ```

# Azure Key Vault Secret Path Expressions

For information on how to configure the Azure Key Vault credential provider, refer to [Azure Key Vault](</connectors/credential_providers/azure_key_vault/help/index.html>).

## Username and Password

> [!NOTE]
>
> The reference examples provided on this page are for **Secrets**; similarly, follow the same approach for **Keys** and **Certificates**.

**Before Encoding**

Using Secret ARN:

```text
secrets://azure-key-vault/https://jubileecpkeyvault.vault.azure.net/keys/HarshalFirstKey/value
```

> [!NOTE]
>
> It is recommended to omit the version ID from secret, key, or certificate identifiers to always fetch the latest value.
>
> Example: The secret identifier below includes a version ID:
>
> ```text
> https://jubileecpkeyvault.vault.azure.net/secrets/HarshalFirstKey/e5a9dd5cc1284a4caa5bef8cd733feab
> ```
>
> The recommended approach is to omit the version ID from the identifier, ensuring that the latest value is always retrieved:
>
> ```text
> https://jubileecpkeyvault.vault.azure.net/secrets/HarshalFirstKey
> ```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each attribute in the URL path must be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Secret ARN:

```text
secrets://azure-key-vault/https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey/value
```

The following is an explanation of the attributes of this URL:

- `azure-key-vault` - Configured Credential Provider on SailPoint.
- `https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey` - Secret Identifier of the secret.
- `value` - The name of the secret which needs to be fetched from the JSON response.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://azure-key-vault/https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey/value?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://azure-key-vault/https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey/value?suffix=%40sp.com
  ```
- To add a prefix and suffix - `?prefix=<prefix>&suffix=<suffix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin@sp.com` then the secret path expression will be as follows to add the required prefix and suffix:

  ```text
  secrets://azure-key-vault/https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey/value?prefix=DomainOne%5C&suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

Standard format for credential path:

```text
secrets://{credential-provider-source}/{secret-identifier}/{secret-key}?prefix=someValue&suffix=someValue2
```

> [!IMPORTANT]
>
> Prefix and suffix are optional.

# BeyondTrust Password Safe Cloud (Secrets Management) Secret Path Expressions

For information on how to configure the BeyondTrust Password Safe Cloud (Secrets Management) credential provider, refer to [BeyondTrust Password Safe Cloud (Secrets Management)](</connectors/credential_providers/beyondtrust_cloud/help/index.html>).

Secret URL syntax: `secrets://{CredentialProviderName}/{SecretURL}`

The following is an explanation of the attributes of this URL:

- `CredentialProviderName` - The name of the credential provider source configured in SailPoint.
- `SecretURL` - A query string that uniquely identifies the secret within BeyondTrust Password Safe. It specifies the managed system and the managed account within that system. The format of the `SecretURL` is as follows:

  ```text
  systemName={nameOfManagedSystem}&accountName={nameOfManagedAccount}
  ```

> [!IMPORTANT]
>
> - `CredentialProviderName` and `SecretURL` must be URL-encoded individually before constructing the final secret path expression.
> - `systemName` and `accountName` are reserved keywords in the `SecretURL` format and must not be used as part of the values for `nameOfManagedSystem` or `nameOfManagedAccount`.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Secret URL Examples

**Before Encoding**

```text
secrets://BeyondTrust Password Safe/systemName=Microsoft Entra ID&accountName=user@company.onmicrosoft.com
```

**After Encoding**

```text
secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com
```

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `Secure#456`, but the complete value required by the secret field is `app1-dev@Secure#456` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?prefix=app1-dev%40
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `app1-dev`, but the complete value required by the secret field is `app1-dev@Secure#456` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?suffix=%40Secure%23456
  ```

# BeyondTrust Password Safe On-Premise (Secrets Management) Secret Path Expressions

For information on how to configure the BeyondTrust Password Safe On-Premise (Secrets Management) credential provider, refer to [BeyondTrust Password Safe On-Premise (Secrets Manager)](</connectors/credential_providers/beyondtrust_onprem/help/index.html>).

Secret URL syntax: `secrets://{CredentialProviderName}/{SecretURL}`

The following is an explanation of the attributes of this URL:

- `CredentialProviderName` - The name of the credential provider source configured in SailPoint.
- `SecretURL` - A query string that uniquely identifies the secret within BeyondTrust Password Safe. It specifies the managed system and the managed account within that system. The format of the `SecretURL` is as follows:

  ```text
  systemName={nameOfManagedSystem}&accountName={nameOfManagedAccount}
  ```

> [!IMPORTANT]
>
> - `CredentialProviderName` and `SecretURL` must be URL-encoded individually before constructing the final secret path expression.
> - `systemName` and `accountName` are reserved keywords in the `SecretURL` format and must not be used as part of the values for `nameOfManagedSystem` or `nameOfManagedAccount`.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Secret URL Examples

**Before Encoding**

```text
secrets://BeyondTrust Password Safe/systemName=Microsoft Entra ID&accountName=user@company.onmicrosoft.com
```

**After Encoding**

```text
secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com
```

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `Secure#456`, but the complete value required by the secret field is `app1-dev@Secure#456` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?prefix=app1-dev%40
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `app1-dev`, but the complete value required by the secret field is `app1-dev@Secure#456` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?suffix=%40Secure%23456
  ```

# CyberArk Central Credential Provider (CCP) Secret Path Expressions

For more information on how to configure the CyberArk Central Credential Provider (CCP), refer to [CyberArk Central Credential Provider (CCP)](</connectors/credential_providers/cyberark_ccp/help/index.html>).

Path syntax: `{params required to fetch secret}/{secretKey}`

Secret URL: `secrets://{CyberArk Central Credential Provider Source Name}/{params required to fetch secret}/{secretKey}`

> [!IMPORTANT]
>
> The URL path should always start with the prefix, secrets://. Each URL should be URL-encoded. Each URL attribute in the path is case-sensitive

The CyberArk Central Credential Provider fetches secret using REST API. The REST API URL format to fetch secrets is as follows:

```text
https://<IIS_Server_Host_URL>/<WebService_NAME>/api/Accounts?<param1>=<value>&<param2>=<value>&
```

> [!NOTE]
>
> In the provided example, the parameters required to fetch the secret are `<param1>=<value>&<param2>=<value>&`

Secret URL example:

**Before Encoding**

```text
secrets://<CyberArk Central Credential Provider Source>/<Object=Cloud Service-AWS-Salesforce-admin&AppID=Test1>/<Content>
```

Where:

- `<CyberArk Central Credential Provider Source>` - Configured Credential Provider
- `<Object=Cloud Service-AWS-Salesforce-harshaladmin&AppID=Test1>` - Parameters required to fetch secrets
- `<Content>` - Key to retrieve from the secret response

**After Encoding**

```text
secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content
```

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content?prefix=suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

# CyberArk Conjur Cloud Secret Path Expressions

For more information, refer to [Retrieve a secret](<https://docs.conjur.org/Latest/en/Content/Developer/Conjur_API_Retrieve_Secret.htm?tocpath=Developer%7CREST APIs%7C_____7>) in the CyberArk documentation.

For information on how to configure the CyberArk Conjur Cloud credential provider, refer to [CyberArk Conjur Cloud Credential Provider](</connectors/credential_providers/cyberark_conjur_cloud/help/index.html>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Username

Path syntax: `secrets://{CredentialProviderSourceName}/{ResourceIdOfSecret}`

> [!NOTE]
>
> The `ResourceIdofSecret` attribute can be obtained from **Conjur Cloud \> Resources** then select the created Secret.

> [!NOTE]
>
> **Screenshot**
>
> [![Conjur Cloud Resources](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/img/conjurcloud_operatingsys.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/img/conjurcloud_operatingsys.png>)

For example:

**Before Encoding**

```text
secrets://CyberarkConjurCloudSource/data/vault/LDAP Safe/Operating System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount/username
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, secrets://. Each URL attribute should be URL-encoded. For example, `CredentialProviderSourceName`, `ResourceIdOfSecret`, the prefix, and the suffix must be encoded separately. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

```text
secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername
```

The following is an explanation of the attributes of this URL:

- `CyberarkConjurCloudSource` - The Configured Credential Provider in the Credential Provider Section.
- `data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername` - The encoded resource ID of the secret.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Password

Path syntax: `secrets://{CredentialProviderSourceName}/{ResourceIdOfSecret}`

For example:

**Before Encoding**

```text
secrets://CyberarkConjurCloudSource/data/vault/LDAP Safe/Operating System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount/password
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, secrets://. Each URL attribute should be URL-encoded. For example, `CredentialProviderSourceName`, `ResourceIdOfSecret`, the prefix, and the suffix must be encoded separately. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

```text
secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fpassword
```

The following is an explanation of the components of this URL:

- `CyberarkConjurCloudSource` - Configured Credential Provider in the Credential Provider Section.
- `data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fpassword` - The encoded resource ID of the secret.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername?suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

# Delinea Secret Server (Cloud) - Secrets Manager Secret Path Expressions

For information on how to configure the Delinea Secret Server (Cloud) - Secrets Manager credential provider, refer to [Delinea Secret Server (Cloud) - Secrets Manager](</connectors/credential_providers/delinea_cloud/help/index.html>).

## Username

Path syntax: `{Folder_path}/{secretKey}`

**Before Encoding**

Using Folder Name:

```text
secrets://delinea-vault/folder1/cred/applicationName/directoryName/Username
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each part of the URL should be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Folder Name:

```text
secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Username
```

The following is an explanation of the attributes of this URL:

- `delinea-vault` - Configured Credential Provider in the Credential Provider Section.
- `folder1%2Fcred%2FapplicationName%2FdirectoryName` - Folder path.
- `Username` - Secret Key which needs to be fetched from the Delinea Secret Server (Cloud) - Secrets Manager.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Password

Path syntax: `{Folder_path}/{secretKey}`

**Before Encoding**

Using Folder Name:

```text
secrets://CredentialProviderName/Folder 1\Folder 2\SecretName/Password
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each part of the URL should be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Folder Name:

```text
secrets://CredentialProviderName/Folder%201%5CFolder%202%5CSecretName/Password
```

The following is an explanation of the attributes of this URL:

- `delinea-vault` - Configured Credential Provider in the Credential Provider Section.
- `Folder%201%5CFolder%202%5CSecretName` - Folder path.
- `Password` - Secret Key which needs to be fetched from the Delinea Secret Server (Cloud) - Secrets Manager.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Username?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Username?suffix=%40sp.com
  ```
- To add a prefix and suffix - `?prefix=<prefix>&suffix=<suffix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin@sp.com` then the secret path expression will be as follows to add the required prefix and suffix:

  ```text
  secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Username?prefix=DomainOne%5C&suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

Standard format for credential path:

```text
secrets://{vault-name}/{folder path}/{secretKey}?prefix=someValue&suffix=someValue2
```

> [!NOTE]
>
> The `prefix` and `suffix` are optional.

# Delinea Secret Server (On-Premise) - Secrets Manager Secret Path Expressions

For information on how to configure the Delinea Secret Server (On-Premise) - Secrets Manager credential provider, refer to [Delinea Secret Server (On-Premise) - Secrets Manager](</connectors/credential_providers/delinea_onprem/help/index.html>).

## Username

Path syntax: `{Folder_path}/{secretKey}`

**Before Encoding**

Using Folder Name:

```text
secrets://delinea-vault/folder1/cred/applicationName/directoryName/Username
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each part of the URL should be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Folder Name:

```text
secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Username
```

The following is an explanation of the attributes of this URL:

- `delinea-vault` - Configured Credential Provider in the Credential Provider Section.
- `folder1%2Fcred%2FapplicationName%2FdirectoryName` - Folder path.
- `Username` - Secret Key which needs to be fetched from the Delinea Secret Server (On-Premise) - Secrets Manager.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Password

Path syntax: `{Folder_path}/{secretKey}`

**Before Encoding**

Using Folder Name:

```text
secrets://delinea-vault/folder1/cred/applicationName/directoryName/Password
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each part of the URL should be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Folder Name:

```text
secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Password
```

The following is an explanation of the attributes of this URL:

- `delinea-vault` - Configured Credential Provider in the Credential Provider Section.
- `folder1%2Fcred%2FapplicationName%2FdirectoryName` - Folder path.
- `Password` - Secret Key which needs to be fetched from the Delinea Secret Server (On-Premise) - Secrets Manager.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Username?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Username?suffix=%40sp.com
  ```
- To add a prefix and suffix - `?prefix=<prefix>&suffix=<suffix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin@sp.com` then the secret path expression will be as follows to add the required prefix and suffix:

  ```text
  secrets://delinea-vault/folder1%2Fcred%2FapplicationName%2FdirectoryName/Username?prefix=DomainOne%5C&suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

Standard format for credential path:

```text
secrets://{vault-name}/{folder path}/{secretKey}?prefix=someValue&suffix=someValue2
```

> [!NOTE]
>
> The `prefix` and `suffix` are optional.

# HashiCorp Vault (Cloud) Secret Path Expressions

For information on how to configure the HashiCorp Vault (Cloud) credential provider, refer to [HashiCorp Vault (Cloud) Credential Provider](</connectors/credential_providers/hashicorp_cloud/help/index.html>).

Path syntax: `{path_to_secret}/{secretKey}`

Secret URL: `secrets://{HashiCorp_Source_Name}/{path_to_secret}/{secretKey}`

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each URL should also be URL-encoded. Each URL attribute in the path is case-sensitive.

HashiCorp Vault (Cloud) supports static and dynamic secrets. Configure the required secret engines in the HashiCorp Vault (Cloud) server and provide their secret paths in the source.

1. Go to your HashiCorp secret engine's API document and locate the Get or Generate Credentials API section.
2. Configure the API path to get credentials.

   > **Note**
   >
   > Everything after the API version in the URL should be used in place of `<path to secret>`. For example, if the URL to fetch secrets is as follows:
   >
   > ```text
   > http://<vault host>/v1/azure/creds/my-role
   > ```
   >
   > Then the `<path to secret>` is as follows:
   >
   > ```text
   > azure/creds/my-role
   > ```
3. Define the key whose value needs to be read from the getCredentials API response for the `<secretKey>`. For example, consider the API response for getCredentials as follows:

   ```json
   {
       "data": {
           "client_id": "408bf248-dd4e-4be5-919a-7f6207a307ab",
           "client_secret": "9PfdaDP9qcf98ggw8WSttfVreFcN4q9c4m4x",
           ...
       }
   }
   ```

   If the secret expression wants the Client ID field from the connector source, then `<secretKey>` should be set to `client_id`.

Secret URL example:

**Before Encoding**

```text
secrets://<HashiCorp Source>/<mysecret/Admin User>/<Admin username>
```

Where:

- `<HashiCorp Source>` - Configured Credential Provider in the Credential Provider Section.
- `<mysecret/Admin User>` - Path to the secret.
- `<Admin username>` - Key to retrieve from the secret path.

**After Encoding**

```text
secrets://HashiCorp%20Source/mysecret%2FAdmin%20User/Admin%20username
```

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

> [!NOTE]
>
> By default, the HashiCorp Vault (Cloud) credential provider checks the `{secretKey}` in response to the following paths by default:
>
> - `$.`
> - `$.data`
> - `$.data.data`
>
> If any getCredentials API response returns `{secretKey}` from another path, then add the following entry key into the HashiCorp source XML for all those paths:
>
> ```text
> <entry key="secretPaths" value="path1,path2"/>
> ```
>
> For example:
>
> ```text
> <entry key="secretPaths" value="data.data.data,data.path1"/>
> ```
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Example Configuration: Generating a Secret Expression for the K/V Version 2 Engine

You can fetch secrets from the K/V version 2 engine. For more information, refer to [Read secret version](<https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#read-secret-version>) in the *KV secrets engine - version 2 (API)* section of the HashiCorp developer documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

Path syntax: `{secret-mount-path/data/path to secret}/{secretKey}{?version=<versionNumber>}`

For example:

**Before Encoding**

```text
secrets://HashiCorp Source/StaticSecrets-v2/data/Active Directory/PASSWORD/Pass word
```

**After Encoding**

```text
secrets://HashiCorp%20Source/StaticSecrets-v2%2Fdata%2FActive%20Directory%2FPASSWORD/Pass%20word
```

Where:

- `HashiCorp Source` - Configured Credential Provider in the Credential Provider Section.
- `StaticSecrets-v2` - `secret-mount-path`.
- `Active Directory/PASSWORD` - Path to the secret.
- `Pass word` - Key to retrieve from the secret path.

Read Secret with version number example, after encoding:

```text
secrets://HashiCorp%20Source/StaticSecrets-v2%2Fdata%2FActive%20Directory%2FPASSWORD/Pass%20word?version=3
```

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://HashiCorp%20Source/StaticSecrets-v2%2Fdata%2FActive%20Directory%2FPASSWORD/Pass%20word?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://HashiCorp%20Source/StaticSecrets-v2%2Fdata%2FActive%20Directory%2FPASSWORD/Pass%20word?suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

# HashiCorp Vault (On-Premise) Secret Path Expressions

For information on how to configure the HashiCorp Vault (On-Premise) credential provider, refer to [HashiCorp Vault (On-Premise) Credential Provider](</connectors/credential_providers/hashicorp_onprem/help/index.html>).

Path syntax: `{path_to_secret}/{secretKey}`

Secret URL: `secrets://{HashiCorp_Source_Name}/{path_to_secret}/{secretKey}`

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each URL should also be URL-encoded. Each URL attribute in the path is case-sensitive.

HashiCorp Vault (On-Premise) supports static and dynamic secrets. Configure the required secret engines in the HashiCorp Vault (On-Premise) server and provide their secret paths in the source.

1. Go to your HashiCorp secret engine's API document and locate the Get or Generate Credentials API section.
2. Configure the API path to get credentials.

   > **Note**
   >
   > Everything after the API version in the URL should be used in place of `<path to secret>`. For example, if the URL to fetch secrets is as follows:
   >
   > ```text
   > http://<vault host>/v1/azure/creds/my-role
   > ```
   >
   > Then the `<path to secret>` is as follows:
   >
   > ```text
   > azure/creds/my-role
   > ```
3. Define the key whose value needs to be read from the getCredentials API response for the `<secretKey>`. For example, consider the API response for getCredentials as follows:

   ```json
   {
       "data": {
           "client_id": "408bf248-dd4e-4be5-919a-7f6207a307ab",
           "client_secret": "9PfdaDP9qcf98ggw8WSttfVreFcN4q9c4m4x",
           ...
       }
   }
   ```

   If the secret expression wants the Client ID field from the connector source, then `<secretKey>` should be set to `client_id`.

Secret URL example:

**Before Encoding**

```text
secrets://<HashiCorp Source>/<mysecret/Admin User>/<Admin username>
```

Where:

- `<HashiCorp Source>` - Configured Credential Provider in the Credential Provider Section.
- `<mysecret/Admin User>` - Path to the secret.
- `<Admin username>` - Key to retrieve from the secret path.

**After Encoding**

```text
secrets://HashiCorp%20Source/mysecret%2FAdmin%20User/Admin%20username
```

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

> [!NOTE]
>
> By default, the HashiCorp Vault (On-Premise) credential provider checks the `{secretKey}` in response to the following paths by default:
>
> - `$.`
> - `$.data`
> - `$.data.data`
>
> If any getCredentials API response returns `{secretKey}` from another path, then add the following entry key into the HashiCorp source XML for all those paths:
>
> ```text
> <entry key="secretPaths" value="path1,path2"/>
> ```
>
> For example:
>
> ```text
> <entry key="secretPaths" value="data.data.data,data.path1"/>
> ```
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Example Configuration: Generating a Secret Expression for the K/V Version 2 Engine

You can fetch secrets from the K/V version 2 engine. For more information, refer to [Read secret version](<https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#read-secret-version>) in the *KV secrets engine - version 2 (API)* section of the HashiCorp developer documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

Path syntax: `{secret-mount-path/data/path to secret}/{secretKey}{?version=<versionNumber>}`

For example:

**Before Encoding**

```text
secrets://HashiCorp Source/StaticSecrets-v2/data/Active Directory/PASSWORD/Pass word
```

**After Encoding**

```text
secrets://HashiCorp%20Source/StaticSecrets-v2%2Fdata%2FActive%20Directory%2FPASSWORD/Pass%20word
```

Where:

- `HashiCorp Source` - Configured Credential Provider in the Credential Provider Section.
- `StaticSecrets-v2` - `secret-mount-path`.
- `Active Directory/PASSWORD` - Path to the secret.
- `Pass word` - Key to retrieve from the secret path.

Read Secret with version number example, after encoding:

```text
secrets://HashiCorp%20Source/StaticSecrets-v2%2Fdata%2FActive%20Directory%2FPASSWORD/Pass%20word?version=3
```

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://HashiCorp%20Source/StaticSecrets-v2%2Fdata%2FActive%20Directory%2FPASSWORD/Pass%20word?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://HashiCorp%20Source/StaticSecrets-v2%2Fdata%2FActive%20Directory%2FPASSWORD/Pass%20word?suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

# Credential Provider Secret Path Expressions

Use the path expressions on this page to implement your configured credential providers into your source configurations.

## Generic Format

Specific secret path expressions vary for each individual credential provider. The generic format of a secret path can be expressed as follows:

```text
secrets://{vault_name}/{URI_Path_to_secret}/{secretKey}?version={versionnumber}
```

> [!IMPORTANT]
>
> The provided example has four parts to it, each highlighted with curly braces ({ }). Each part needs to be URI-encoded separately. SailPoint does not support complete URI encoding.

## Secret Path Expressions by Credential Provider

The list is divided by the credential provider, and the secret path expressions they support are listed below them.

- [AWS Secrets Manager](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/aws_secrets_manager.html>)
- [Azure Key Vault](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/azure_key_vault.html>)
- [BeyondTrust Password Safe Cloud (Secrets Management)](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/beyondtrust_cloud.html>)
- [BeyondTrust Password Safe On-Premise (Secrets Management)](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/beyondtrust_onprem.html>)
- [CyberArk Central Credential Provider (CCP)](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/cyberark_ccp.html>)
- [CyberArk Conjur Cloud](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/cyberark_conjur_cloud.html>)
- [Delinea Secret Server (Cloud) - Secrets Manager](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/delinea_cloud.html>)
- [Delinea Secret Server (On-Premise) - Secrets Manager](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/delinea_onprem.html>)
- [HashiCorp Vault (Cloud)](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/hashicorp_cloud.html>)
- [HashiCorp Vault (On-Premise)](<https://documentation.sailpoint.com/connectors/credential_providers/secret_path_expressions/help/hashicorp_onprem.html>)