openapi: 3.0.3
info:
  title: BeyondTrust Password Safe Authentication Credentials API
  description: The BeyondTrust Password Safe API provides programmatic access to privileged credential management, secrets management, session management, and access request workflows. It enables developers to integrate privileged account security into CI/CD pipelines, automation frameworks, and enterprise applications.
  version: v3
  contact:
    name: BeyondTrust Support
    url: https://docs.beyondtrust.com/
  x-generated-from: documentation
servers:
- url: https://{hostname}/BeyondTrust/api/public/v3
  description: BeyondTrust Password Safe API v3
  variables:
    hostname:
      default: beyondtrust.example.com
      description: Your BeyondTrust appliance hostname
security:
- apiKeyAuth: []
tags:
- name: Credentials
  description: Manage privileged account credentials and passwords
paths:
  /requests/{requestId}/credentials:
    get:
      operationId: getRequestCredentials
      summary: BeyondTrust Get Request Credentials
      description: Retrieves the credentials for an approved access request.
      tags:
      - Credentials
      parameters:
      - name: requestId
        in: path
        required: true
        description: The unique identifier of the approved request.
        schema:
          type: integer
        example: 1001
      responses:
        '200':
          description: Credentials for the approved request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialResponse'
              examples:
                GetRequestCredentials200Example:
                  summary: Default getRequestCredentials 200 response
                  x-microcks-default: true
                  value:
                    Password: Xk2!mP9@nQ7#rT5
                    PrivateKey: null
        '403':
          description: Request not yet approved or already expired.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ErrorResponse:
      title: Error Response
      description: Standard BeyondTrust API error response.
      type: object
      properties:
        Message:
          type: string
          description: Human-readable error message.
          example: Access denied
        ErrorCode:
          type: integer
          description: Numeric error code.
          example: 4003
    CredentialResponse:
      title: Credential Response
      description: Credentials retrieved for an approved access request.
      type: object
      properties:
        Password:
          type: string
          nullable: true
          description: The retrieved password. Only present for password-based accounts.
          example: Xk2!mP9@nQ7#rT5
        PrivateKey:
          type: string
          nullable: true
          description: SSH private key. Only present for SSH key-based accounts.
          example: null
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: PS-Auth key={APIKey}; runas={AppID}. Authenticate by first calling /auth/signappin to get a session cookie, then use PS-Auth header for subsequent requests.