Documentation Suite v26.2.1

Submit Search

PUT PAM Providers

The PUT /PamProviders operation updates an existing PAM PAM (Privileged Access Management): Controls privileged access by vaulting credentials, enforcing least-privilege/just-in-time access, rotating secrets, and auditing sessions. Across Keyfactor products, PAM protects diverse sensitive operations and secrets—for example certificate stores and CA credentials—via built-in or third-party providers; external integrations are delivered as custom PAM extensions (several published on Keyfactor’s public GitHub). provider. On success, the operation returns HTTP 200 OK with details for the updated provider.

Tip: The following permissions (see Security Roles and Claims) are required to use this feature:

/pam/modify/

/pam/modify/#/ (where # is a specific PAM provider ID)

Permissions for PAM providers can be set at the system-wide level or with fine-grained control at the PAM provider level. See PAM Permissions for more information about the differences between system-wide and more targeted permissions.

Important: This operation replaces the entire record. Any fields not included in the request are cleared or set to their default values.

To avoid unintended data loss, first perform a GET to retrieve the existing record, update only the required fields, and then submit the full set of values in the PUT request.

This operation has two available versions. Keyfactor recommends using the newer operation when possible. For more information, see Endpoint Definition Versioning.

Version 2

Version 1

Version 2 of PUT /PamProviders has been redesigned to remove references to PAM associations with areas and containers.

Table 649: PUT PamProviders v2 Input Parameters

Name

Description

Id Body Required. An integer indicating the Keyfactor Command reference ID for the PAM provider. This ID is automatically set by Keyfactor Command.

Name

Body

Required. A string indicating the name of the PAM provider. This name is used to identify the PAM provider throughout Keyfactor Command.

Important: The name you give to your PAM provider in Keyfactor Command must match the name of the PAM provider as referenced in the manifest.json file (see Installing Custom PAM Provider Extensions).

Provider Type

Body

Required. An object containing details about the provider type for the provider. Only the provider type ID is needed on input. Show provider type details.

Value	Description
Id	Required. A string indicating the Keyfactor Command reference GUID for the provider type. Use the GET PAM Providers Types operation to retrieve a list of all the PAM provider types to determine the PAM provider type's GUID.

Provider Type Param Values

Body

Required in some cases. An array of objects containing the values for the provider types specified by ProviderTypeParam. Values are only supported in this field if the Remote parameter is set to false, in which case they are required. Show provider type parameter value details.

Value

Description

Value

Required. A string indicating the value set for the parameter (for example, the name of the CyberArk folder where the protected object that stores the username or password resides).

Instance Id

An integer indicating the Keyfactor Command reference ID for the provider. If you are attaching to something with an integer Id, this will be used.

This is considered deprecated and may be removed in a future release.

Instance Guid

A string indicating the Keyfactor Command reference GUID for the provider. If you are attaching to something with a GUID ID, this will be used.

This is considered deprecated and may be removed in a future release.

Provider Type Param

An object indicating parameters that the provider type uses for data input in Keyfactor Command when creating new PAM provider and records using PAM providers. Show provider type parameters.

Value	Description
Id	Required. An integer indicating the Keyfactor Command reference ID for the PAM provider type parameter. Use the GET PAM Providers Types operation to retrieve a list of all the PAM provider types to determine this value for each parameter for the provider type.
Name	Required. A string indicating the internal name for the PAM provider type parameter. Use the GET PAM Providers Types operation to retrieve a list of all the PAM provider types to determine this value for each parameter for the provider type.
Display Name	A string indicating the display name for the PAM provider type parameter. For parameters with an InstanceLevel of False, this name appears on the PAM provider dialog for the parameter when a user creates a new PAM provider. For parameters with an InstanceLevel of True, this name appears on the Server dialog for the parameter when a user creates a new PAM provider.
DataType	An integer indicating the data type for the parameter. Possible values are: 1 = String 2 = Secret
Instance Level	A Boolean that sets whether the parameter is used to define the underlying PAM provider (False) or a field that needs to be set to a value when configuring a certificate store to use the PAM provider (True). See example, above.

Example: When creating or updating a PAM provider for Delinea local to Keyfactor Command, your request body might look like (where the ProviderType ID and ProviderTypeParam Ids and Names are retrieved using GET /PamProviders/Types):

Copy

{
   "Name": "PAMProviders.Delinea.PAMProvider",
   "Remote": false,
   "ProviderType": {
      "Id": "bd1762ce-3ea5-41fb-bfb4-1b6de6393fa3"
   },
   "ProviderTypeParamValues": [
      {
         "ProviderTypeParam": {
            "Id": 19,
            "Name": "SecretServerUrl"
         },
         "Value": "https://MyDelineaURL"
      },
      {
         "ProviderTypeParam": {
            "Id": 20,
            "Name": "Username"
         },
         "Value": "MyDelineaServiceAccountUser"
      },
      {
         "ProviderTypeParam": {
            "Id": 21,
            "Name": "Password"
         },
         "Value": "MySuperSecretPasswordtoAccessDelinea"
      }
   ]
}

Remote Body A Boolean indicating whether the PAM provider is local to the Keyfactor Command server (False) or local to the orchestrator (True). The default is False.

Table 650: PUT PamProviders v2 Response Data

Name

Description

Id An integer indicating the Keyfactor Command reference ID for the PAM provider. This ID is automatically set by Keyfactor Command.

Name

A string indicating the name of the PAM provider. This name is used to identify the PAM provider throughout Keyfactor Command.

Provider Type

An object containing details about the provider type for the provider. Show provider type details.

Value

Description

A string indicating the Keyfactor Command reference GUID for the provider type.

Name

A string indicating the name of the provider type.

Provider Type Params

An array of objects indicating parameters that the provider type uses for data input in Keyfactor Command when creating new PAM provider records and records using PAM providers. Show provider type parameters.

Value	Description
Id	An integer indicating the Keyfactor Command reference ID for the PAM provider type.
Name	A string indicating the internal name for the PAM provider type parameter.
Display Name	A string indicating the display name for the PAM provider type parameter. Instance Level False: This name appears on the PAM provider dialog when a user creates a new PAM provider. Instance Level True: This name appears on the dialog when a user creates a new record using the PAM provider (for example, a new certificate store using PAM for authentication).
Data Type	An integer indicating the data type for the parameter. Possible values are: 1 = String 2 = Secret
Instance Level	A Boolean that sets whether the parameter is used to define the underlying PAM provider (False) or a field that needs to be set to a value when configuring a record (for example, a certificate store) to use the PAM provider (True). Example: For Delinea when defining a PAM provider, you configure these Delinea-specific fields: Secret Server URL: The URL to the Secret Server vault instance, including port number if applicable (for example, https://websrvr38.keyexample.com/SecretServer). Secret Server Username: The name of the user that will be used to connect to SecretServer. Secret Server Password: The password of the user that will be used to connect to SecretServer. Because these fields are configured on the PAM provider definition, they appear as InstanceLevel False like so: Copy `{ "Name": "Host", "DisplayName":"Secret Server URL", "InstanceLevel":false, "DataType": 1 }, { "Name":"Username", "DisplayName":"Secret Server Username", "InstanceLevel":false, "DataType": 2 }, { "Name":"Password", "DisplayName":"Secret Server Password", "InstanceLevel":false, "DataType": 2 }` When you configure a certificate store to use Delinea as a credential provider, you enter the name of the secret field in Delinea referencing the protected object and you enter the ID of the projected object containing the username or password used to access the certificate store. Because these fields are configured on the certificate store level, they appear as InstanceLevel True like so: Copy `{ "Name":"SecretId", "DisplayName":"Secret Server Secret ID", "InstanceLevel":true, "DataType": 1 }, { "Name":"SecretFieldName", "DisplayName":"Secret Field Name", "InstanceLevel":true, "DataType": 1 }` In both cases, the values for the fields (for example, the actual name of the object in Delinea where the password is stored) are stored in the ProviderTypeParamValues array.
Provider Type	An internally used Keyfactor Command field.

Provider Type Param Values

An array of objects containing the values for the provider types specified by ProviderTypeParam. This field contains values only if the Remote parameter is set to False. Show provider type parameter value details.

Value

Description

An integer indicating the Keyfactor Command reference ID for the PAM provider type parameter.

Value

A string indicating the value set for the parameter (for example, the name of the CyberArk folder where the protected object that stores the username or password resides).

Instance Id

An integer indicating the Keyfactor Command reference ID for the provider. If you are attaching to something with an integer Id, this will be used.

This is considered deprecated and may be removed in a future release.

Instance Guid

A string indicating the Keyfactor Command reference GUID for the provider. If you are attaching to something with a GUID ID, this will be used.

This is considered deprecated and may be removed in a future release.

Provider Type Param

An object indicating parameters that the provider type uses for data input in Keyfactor Command when creating new PAM provider and records using PAM providers. Show provider type parameters.

Value	Description
Id	An integer indicating the Keyfactor Command reference ID for the PAM provider type parameter.
Name	A string indicating the internal name for the PAM provider type parameter.
Display Name	A string indicating the display name for the PAM provider type parameter. For parameters with an InstanceLevel of False, this name appears on the PAM provider dialog for the parameter when a user creates a new PAM provider. For parameters with an InstanceLevel of True, this name appears on the Server dialog for the parameter when a user creates a new PAM provider.
DataType	An integer indicating the data type for the parameter. Possible values are: 1 = String 2 = Secret
Instance Level	A Boolean that sets whether the parameter is used to define the underlying PAM provider (False) or a field that needs to be set to a value when configuring a certificate store to use the PAM provider (True). See example, above.

Remote A Boolean indicating whether the PAM provider is local to the Keyfactor Command server (False) or local to the orchestrator (True). The default is False.

Version 1 of PUT /PamProviders includes the same capabilities as version 2 except it includes references to the deprecated parameters related to the area of Keyfactor Command to which the PAM provider applies.

Table 651: PUT PamProviders v1 Input Parameters

Name

Description

Id Body Required. An integer indicating the Keyfactor Command reference ID for the PAM provider. This ID is automatically set by Keyfactor Command.

Name

Body

Required. A string indicating the name of the PAM provider. This name is used to identify the PAM provider throughout Keyfactor Command.

Provider Type

Body

Required. An object containing details about the provider type for the provider. Only the provider type ID is needed on input. Show provider type details.

Value	Description
Id	Required. A string indicating the Keyfactor Command reference GUID for the provider type. Use the GET PAM Providers Types operation to retrieve a list of all the PAM provider types to determine the PAM provider type's GUID.

Provider Type Param Values

Body

Value

Description

Value

Required. A string indicating the value set for the parameter (for example, the name of the CyberArk folder where the protected object that stores the username or password resides).

Instance Id

An integer indicating the Keyfactor Command reference ID for the provider. If you are attaching to something with an integer Id, this will be used.

This is considered deprecated and may be removed in a future release.

Instance Guid

A string indicating the Keyfactor Command reference GUID for the provider. If you are attaching to something with a GUID ID, this will be used.

This is considered deprecated and may be removed in a future release.

Provider Type Param

An object indicating parameters that the provider type uses for data input in Keyfactor Command when creating new PAM provider and records using PAM providers. Show provider type parameters.

Value	Description
Id	Required. An integer indicating the Keyfactor Command reference ID for the PAM provider type parameter. Use the GET PAM Providers Types operation to retrieve a list of all the PAM provider types to determine this value for each parameter for the provider type.
Name	Required. A string indicating the internal name for the PAM provider type parameter. Use the GET PAM Providers Types operation to retrieve a list of all the PAM provider types to determine this value for each parameter for the provider type.
Display Name	A string indicating the display name for the PAM provider type parameter. For parameters with an InstanceLevel of False, this name appears on the PAM provider dialog for the parameter when a user creates a new PAM provider. For parameters with an InstanceLevel of True, this name appears on the Server dialog for the parameter when a user creates a new PAM provider.
DataType	An integer indicating the data type for the parameter. Possible values are: 1 = String 2 = Secret
Instance Level	A Boolean that sets whether the parameter is used to define the underlying PAM provider (False) or a field that needs to be set to a value when configuring a certificate store to use the PAM provider (True). See example, above.

Copy

{
   "Name": "PAMProviders.Delinea.PAMProvider",
   "Remote": false,
   "ProviderType": {
      "Id": "bd1762ce-3ea5-41fb-bfb4-1b6de6393fa3"
   },
   "ProviderTypeParamValues": [
      {
         "ProviderTypeParam": {
            "Id": 19,
            "Name": "SecretServerUrl"
         },
         "Value": "https://MyDelineaURL"
      },
      {
         "ProviderTypeParam": {
            "Id": 20,
            "Name": "Username"
         },
         "Value": "MyDelineaServiceAccountUser"
      },
      {
         "ProviderTypeParam": {
            "Id": 21,
            "Name": "Password"
         },
         "Value": "MySuperSecretPasswordtoAccessDelinea"
      }
   ]
}

Remote Body A Boolean indicating whether the PAM provider is local to the Keyfactor Command server (False) or local to the orchestrator (True). The default is False.

Table 652: PUT PamProviders v1 Response Data

Name

Description

Id An integer indicating the Keyfactor Command reference ID for the PAM provider. This ID is automatically set by Keyfactor Command.

Name

A string indicating the name of the PAM provider. This name is used to identify the PAM provider throughout Keyfactor Command.

Area

An integer indicating the area of Keyfactor Command the provider is used for.

This is considered deprecated and may be removed in a future release.

Provider Type

An object containing details about the provider type for the provider. Show provider type details.

Value

Description

A string indicating the Keyfactor Command reference GUID for the provider type.

Name

A string indicating the name of the provider type.

Provider Type Params

Value	Description
Id	An integer indicating the Keyfactor Command reference ID for the PAM provider type.
Name	A string indicating the internal name for the PAM provider type parameter.
Display Name	A string indicating the display name for the PAM provider type parameter. Instance Level False: This name appears on the PAM provider dialog when a user creates a new PAM provider. Instance Level True: This name appears on the dialog when a user creates a new record using the PAM provider (for example, a new certificate store using PAM for authentication).
Data Type	An integer indicating the data type for the parameter. Possible values are: 1 = String 2 = Secret
Instance Level	A Boolean that sets whether the parameter is used to define the underlying PAM provider (False) or a field that needs to be set to a value when configuring a record (for example, a certificate store) to use the PAM provider (True). Example: For Delinea when defining a PAM provider, you configure these Delinea-specific fields: Secret Server URL: The URL to the Secret Server vault instance, including port number if applicable (for example, https://websrvr38.keyexample.com/SecretServer). Secret Server Username: The name of the user that will be used to connect to SecretServer. Secret Server Password: The password of the user that will be used to connect to SecretServer. Because these fields are configured on the PAM provider definition, they appear as InstanceLevel False like so: Copy `{ "Name": "Host", "DisplayName":"Secret Server URL", "InstanceLevel":false, "DataType": 1 }, { "Name":"Username", "DisplayName":"Secret Server Username", "InstanceLevel":false, "DataType": 2 }, { "Name":"Password", "DisplayName":"Secret Server Password", "InstanceLevel":false, "DataType": 2 }` When you configure a certificate store to use Delinea as a credential provider, you enter the name of the secret field in Delinea referencing the protected object and you enter the ID of the projected object containing the username or password used to access the certificate store. Because these fields are configured on the certificate store level, they appear as InstanceLevel True like so: Copy `{ "Name":"SecretId", "DisplayName":"Secret Server Secret ID", "InstanceLevel":true, "DataType": 1 }, { "Name":"SecretFieldName", "DisplayName":"Secret Field Name", "InstanceLevel":true, "DataType": 1 }` In both cases, the values for the fields (for example, the actual name of the object in Delinea where the password is stored) are stored in the ProviderTypeParamValues array.
Provider Type	An internally used Keyfactor Command field.

Provider Type Param Values

Value

Description

An integer indicating the Keyfactor Command reference ID for the PAM provider type parameter.

Value

A string indicating the value set for the parameter (for example, the name of the CyberArk folder where the protected object that stores the username or password resides).

Instance Id

An integer indicating the Keyfactor Command reference ID for the provider. If you are attaching to something with an integer Id, this will be used.

This is considered deprecated and may be removed in a future release.

Instance Guid

A string indicating the Keyfactor Command reference GUID for the provider. If you are attaching to something with a GUID ID, this will be used.

This is considered deprecated and may be removed in a future release.

Provider Type Param

An object indicating parameters that the provider type uses for data input in Keyfactor Command when creating new PAM provider and records using PAM providers. Show provider type parameters.

Value	Description
Id	An integer indicating the Keyfactor Command reference ID for the PAM provider type parameter.
Name	A string indicating the internal name for the PAM provider type parameter.
Display Name	A string indicating the display name for the PAM provider type parameter. For parameters with an InstanceLevel of False, this name appears on the PAM provider dialog for the parameter when a user creates a new PAM provider. For parameters with an InstanceLevel of True, this name appears on the Server dialog for the parameter when a user creates a new PAM provider.
DataType	An integer indicating the data type for the parameter. Possible values are: 1 = String 2 = Secret
Instance Level	A Boolean that sets whether the parameter is used to define the underlying PAM provider (False) or a field that needs to be set to a value when configuring a certificate store to use the PAM provider (True). See example, above.

Remote A Boolean indicating whether the PAM provider is local to the Keyfactor Command server (False) or local to the orchestrator (True). The default is False.

Secure Area Id

An integer indicating the Keyfactor Command reference ID for the certificate store container the PAM provider is associated with, if any.

This is considered deprecated and may be removed in a future release.

Tip: See the Keyfactor API

An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. Reference and Utility, which allows you to call API operations and view results. It is primarily intended for validation, testing, and workflow

A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. development, and also serves as an interactive supplement to this API documentation. You can access it from the help menu (

) in the Management Portal.

Was this page helpful? Provide Feedback

Version v26.2.1

On This Page