# SailPoint BeyondTrust Password Safe Cloud PAM Discovery Connector Documentation > BeyondTrust Password Safe Cloud PAM Discovery Connector Documentation # Documentation # Additional Settings Schedule discovering applications connected to the BeyondTrust Password Safe Cloud PAM instance on these configuration pages. You can modify and manage scheduling aggregation directly within the interface. ## Discovery Settings 1. In the **Additional Settings** section, select **Discovery Settings**. 2. To aggregate enterprise applications that are connected to your discovery source, select **Start Discovering**. The aggregation begins immediately and occurs once. 3. Select **Enable Schedule** to schedule recurring aggregations. > **Screenshot** > > [![Discovery Settings]()]() 4. Select the **Frequency** from the dropdown, and enter the time of day. - **Daily** - Aggregation occurs once per day at the time selected. 1. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. - **Weekly** - Aggregation occurs once per week on the day and time selected. 1. Select a **Day** of the week, Sunday - Saturday, from the dropdown. 2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. - **Monthly** - Aggregation occurs once per month on the date and time selected. 1. Select a **Date** of the month, 1 - 28, from the dropdown. 2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. > **Note** > > The time zone (GMT offset) for the entitlement aggregation schedule is determined by the time zone set for the connected virtual appliance cluster. 5. Select **Save**. ## Latest Application Discovery Information about the most recent application discovery is displayed under **Latest Application Discovery**. ## Discovery Activity To view the list of all enterprise application aggregations on this source, select **Discovery Activity**. When applications are being aggregated, an entry is added to the Discovery Activity section. This includes information like the admin who started the aggregation (for manual aggregations), the date and time the aggregation occurred, the number of objects scanned, and its current status. Aggregations are ordered by most recent aggregation task. You can also sort by status to quickly find success, warning, error, and terminated tasks. > [!NOTE] > > **Screenshot** > > [![Discovery Activity]()]() # Connecting SailPoint and BeyondTrust Password Safe Cloud PAM To connect SailPoint and BeyondTrust Password Safe Cloud PAM, perform the following tasks: ## Adding Discovery Connector in SailPoint Discovery connectors have categories that encompass a group of discovery sources to find enterprise applications. You can automatically discover enterprise applications using discovery sources, which search for applications your organization has on-boarded or can on-board. For more information, refer to [Discovering Enterprise Applications](). 1. Go to **Admin \> Connections \> Discovery Connectors**. 2. Select **Create Connector**. 3. Select **Connector Category**. 4. Select **Continue**. 5. Search for a source type and select **Configure**. 6. Review the directions and select **Start Connector Setup**. 7. Review the pre-populated source name, source owner, and description. To update, select **Edit**. > **Note** > > Source name must be unique. 8. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 9. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** page. 10. Select **Finish**. A test connection is performed in the background. 11. If the test connection is successful, your source is created, and you are prompted to run a discovery. - If you want to discover applications now, select **Discover**. - **Additional Settings \> Discovery Settings** - The latest application discovery history is shown. - **Additional Settings \> Discovery Activity** - Discovered applications are listed. - If you want to discover applications later, select **Cancel**. As no discovery has taken place, in the source details: - **Additional Settings \> Discovery Settings** - The latest application discovery history is blank. - **Additional Settings \> Discovery Activity** - No discovered applications are listed. You are navigated to the **Sources** page, where the source created is listed. ## Base Configuration Provide the base configuration parameters. Information you entered in the Connector Setup dialog is automatically entered into the fields in the Base Configuration page. You can edit this information, if necessary. > [!NOTE] > > Ensure that the name and description of each connector is unique. 1. Enter a descriptive **Connector Name** for the connection. 2. Enter the **Description** that provides details necessary to distinguish it from similar connection sources. 3. In **Connector Owner**, enter the name of the owner responsible for administrating, operating and managing the source system. 4. Select **Save**. ## Connection Settings The connector must authenticate to BeyondTrust Password Safe Cloud to connect and retrieve platforms and managed systems. ### OAuth 2.0 Authentication The connector uses OAuth 2.0 as the default authentication method to connect to the BeyondTrust public API. Use the credentials generated during the Service User creation process to configure the connection. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. In the **Host URL** field, enter the URL where your organization's BeyondTrust Password Safe Cloud instance is hosted. 2. Enter the **Client ID**. 3. Enter the **Client Secret**. 4. Enter the number of records to retrieve per page, between 1 and 500. 5. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to the **Review and Test** page. 2. Review the configuration details for accuracy. 3. If any information is incorrect, return to the relevant section and update the fields. 4. Select **Test Connection**. A success message appears if the connection is established. If the test fails, review your **Connection Settings and Base Configuration** settings. # Discovering Applications with BeyondTrust Password Safe Cloud PAM The SailPoint BeyondTrust Password Safe Cloud PAM Discovery connector retrieves application details configured in BeyondTrust Password Safe Cloud via the public API. The connector uses OAuth 2.0 client credentials `grant_type=client_credentials` to authenticate with BeyondTrust, provides continuous application discovery, and identifies inventory across the enterprise. This visibility helps you prioritize and focus governance efforts on high-impact applications. ## Supported Platforms - BeyondTrust Password Safe Cloud public API. ## Supported Features The BeyondTrust Password Safe Cloud PAM discovery connector supports the following features: - Test Connection. - Application discovery. For more information, refer to [Discovering Enterprise Applications](). ## Prerequisites For the successful configuration of your source, your organization must configure the following requirements: ### Create an API Registration Type of API Access Policy 1. Go to **Configuration \> General \> API Registrations**. 2. Select **Create API Registration**. 3. Select **API Access Policy** from the dropdown list. 4. Select **Add Authentication Rules**. Add at least one IP rule. The IP rules are used to authenticate and authorize, granting discovery permissions for platforms and requestable managed system targets. 5. Select **Create Registration**. ### Create an Application User and Add to a Group An API Access Policy must be assigned to an application user for processing IP rules. 1. Go to **Configuration \> Role Based Access \> User Management**. 2. Select the **Users** tab. 3. Select **Create New User**. 4. Select **Add an Application User** from the dropdown. 5. Enter a username. 6. In **API Access Policy**, select the API Access Policy created. 7. Copy the client ID and the client secret somewhere safe. 8. Select **Create User**. 9. Select the **Groups** tab. 10. Select **Create New Group**. 11. Enter a name and description. 12. Enter the group details: - **Users** - The user must be assigned to the group. - **Features** - The group must have **Password Safe System Management** with **read-only** permission. > [!NOTE] > > Store the client secret securely. It is required for OAuth token requests and must match the value configured in SailPoint. ## Required Permissions In BeyondTrust, this is commonly associated with **Password Safe System Management (Read)** (or equivalent) within the **API Access Policy** assigned to the Application user. Align the exact role and permission names with BeyondTrust's current documentation for your tenant. # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Invalid Client / Unauthorized (401 on Token) Description - This symptom occurs when the token request fails due to client authentication issues, resulting in a 401 unauthorized error. Resolution - To resolve this issue, verify the Client ID and client secret are accurate. Ensure the Application user account is still enabled. Confirm the secret was not rotated without updating SailPoint. ## Cannot Reach API Description - This symptom occurs when the system is unable to establish a connection to the API endpoint. Resolution - To resolve this issue, ensure the API base URL is correct (tenant host, path `/BeyondTrust/api/public/v3`). Check network and firewall rules to ensure outbound connectivity is allowed. ## Forbidden or Empty Platforms Description - This occurs when the API returns a forbidden error or fails to retrieve any platform data due to access restrictions. Resolution - To resolve this issue, ensure there are valid API Access Policy permissions. The Application user is explicitly allowed to Get all platforms and Get all managed systems (or equivalent permissions). ## TLS or Certificate Issues Description - This indicates a failure in establishing a secure connection to the API due to TLS or certificate validation errors. Resolution - To resolve this issue, ensure there are no expired certificates and that there is no hostname mismatch. Check if corporate TLS inspection proxies are blocking, stripping, or modifying the traffic.