name: CyberArk API FinOps
specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
provider: CyberArk
providerId: cyberark
publisherName: CyberArk Software Ltd.
serviceCategory: Identity Security
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Identity Security
  - Privileged Access Management
  - Secrets Management
  - FinOps
  - FOCUS
description: 'FOCUS-aligned FinOps for CyberArk: enterprise per-seat / per-machine-identity subscriptions
  across PAM, Workforce Access, Secrets Management, and Identity Governance. APIs are entitlements of
  the product license rather than separately metered.'
sources:
  - https://www.cyberark.com/products/
notes: No public pricing. Replace meter targets with contract-derived values (per-privileged-user, per-machine-identity,
  per-workforce-user).
principles:
  - name: Visibility
    description: Use CyberArk Identity Security Intelligence and the per-product admin consoles to count
      privileged users, machine identities, and workforce seats; export to your CMDB / FinOps store.
  - name: Allocation
    description: Tag Safes (PAM), platforms, and Conjur policy branches by business unit / application
      to attribute identity spend; use Identity Flows for joiner/mover/leaver attribution.
  - name: Optimization
    description: Decommission unused privileged / workforce seats at quarterly access reviews; consolidate
      Conjur secrets across applications; right-size Privilege Cloud vs Self-Hosted PAM by deployment
      density.
  - name: Accountability
    description: Identity / security org owns the CyberArk contract; coordinate with finance for chargeback
      based on Safe ownership and identity governance rollups.
domains:
  - name: Understand Usage and Cost
    capabilities:
      - Allocation
      - Reporting and Analytics
  - name: Quantify Business Value
    capabilities:
      - Forecasting
      - Budgeting
      - Unit Economics
  - name: Optimize Usage and Cost
    capabilities:
      - Workload Optimization
      - Licensing and SaaS
  - name: Manage the FinOps Practice
    capabilities:
      - Invoicing and Chargeback
      - Onboarding Workloads
billingModel:
  pricingCategory: Enterprise Subscription
  billingFrequency: Annual
  billingCurrency: USD
  chargeCategories:
    - Purchase
    - Usage
    - Tax
    - Adjustment
  chargeFrequency: Recurring
focusColumns:
  ServiceName: CyberArk
  ServiceCategory: Identity Security
  ProviderName: CyberArk
  PublisherName: CyberArk Software Ltd.
  InvoiceIssuerName: CyberArk Software Ltd.
  PricingCategory: Subscription
  PricingUnit: seat-year
  BillingCurrency: USD
  ChargeCategory: Purchase
meters:
  - name: privileged_users
    description: Licensed privileged users / endpoints under PAM coverage
    unit: seat-year
    aggregation: max
    dimensions:
      - product
      - business_unit
  - name: workforce_users
    description: Licensed workforce identity seats (SSO / MFA / passwordless)
    unit: seat-year
    aggregation: max
    dimensions:
      - product
      - business_unit
  - name: machine_identities
    description: Licensed machine identities / secrets / certificates
    unit: machine-year
    aggregation: max
    dimensions:
      - product
      - environment
  - name: api_requests
    description: API calls against CyberArk REST APIs (not separately billed; observed for capacity)
    unit: request
    aggregation: sum
    dimensions:
      - api
      - tenant
apis:
  - name: CyberArk Conjur Secrets Manager API
    baseURL: https://conjur.example.com
    tags:
      - Authentication
      - Conjur
      - DevOps Secrets
      - Machine Identity
      - Policies
      - Resources
      - Roles
      - Secrets
      - Vault
    serviceName: CyberArk Conjur Secrets Manager API
    serviceCategory: API
  - name: CyberArk PAM Self-Hosted REST API
    baseURL: ''
    tags:
      - Accounts
      - PAM
      - Privileged Access
      - REST
      - Safes
      - Sessions
      - Vault
    serviceName: CyberArk PAM Self-Hosted REST API
    serviceCategory: API
  - name: CyberArk Privilege Cloud REST API
    baseURL: ''
    tags:
      - Accounts
      - PAM
      - Privilege Cloud
      - Safes
      - SaaS
      - Vault
    serviceName: CyberArk Privilege Cloud REST API
    serviceCategory: API
  - name: CyberArk Identity REST API
    baseURL: ''
    tags:
      - Identity
      - MFA
      - OAuth2
      - SCIM
      - SSO
      - Workforce Identity
    serviceName: CyberArk Identity REST API
    serviceCategory: API
unitEconomics:
  - name: Cost per Privileged User
    metric: billed_cost / privileged_users
  - name: Cost per Machine Identity
    metric: billed_cost / machine_identities
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com