name: CyberArk API Plans
specification: API Commons Plans
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/Plans
provider: CyberArk
providerId: cyberark
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Identity Security
  - Privileged Access Management
  - Secrets Management
  - Machine Identity
  - Workforce Identity
description: CyberArk Identity Security Platform is sold as enterprise subscriptions across four pillars
  (Privileged Access, Workforce Access, Machine Identity / Secrets, Identity Governance). No public price
  list; pricing is per-seat / per-machine-identity / per-vault and quoted by sales. Most APIs ship with
  the underlying product license; there is no separate API metering.
sources:
  - https://www.cyberark.com/products/
notes: CyberArk does not publish a public pricing page. Plans are negotiated; replace prices once contract
  values are available.
plans:
  - id: cyberark-privileged-access
    name: Privileged Access (PAM)
    type: enterprise
    description: Privileged Access Manager (Self-Hosted or Privilege Cloud), Vendor PAM, and Endpoint Privilege
      Manager. Per-privileged-user / per-endpoint subscription.
    entries:
      - label: Per privileged user / endpoint
        description: Negotiated per-seat / per-endpoint subscription
        name: privileged_seat
        type: subscription
        metric: seat
        limit: -1
        timeFrame: year
        geo: global
        domains:
          - https://www.cyberark.com
        unit: 1
        price: contact sales
        userMultiplied: true
    elements:
      - name: Privileged Access Manager (Self-Hosted / Cloud)
      - name: Vendor Privileged Access Manager
      - name: Endpoint Privilege Manager
      - name: CyberArk PAM Self-Hosted REST API
      - name: CyberArk Privilege Cloud REST API
  - id: cyberark-workforce-access
    name: Workforce Access (Identity)
    type: enterprise
    description: Workforce SSO, MFA, passwordless, password management, secure web sessions, and B2B
      Identity. Per-user subscription.
    entries:
      - label: Per workforce user
        description: Negotiated per-seat workforce identity subscription
        name: workforce_seat
        type: subscription
        metric: seat
        limit: -1
        timeFrame: year
        geo: global
        domains:
          - https://www.cyberark.com
        unit: 1
        price: contact sales
        userMultiplied: true
    elements:
      - name: Single Sign-On (SSO)
      - name: Multi-Factor Authentication (MFA)
      - name: Passwordless Authentication
      - name: Workforce Password Management
      - name: Secure Web Sessions
      - name: Customer / B2B Identity
      - name: CyberArk Identity REST API
  - id: cyberark-secrets-management
    name: Secrets Management & Machine Identity
    type: enterprise
    description: Conjur Secrets Manager (SaaS / Self-Hosted), Secrets Hub, Credential Providers, Certificate
      Manager, Code Sign, SSH Manager. Priced per machine identity / certificate.
    entries:
      - label: Per machine identity / secret
        description: Negotiated per-machine-identity subscription
        name: machine_identity
        type: subscription
        metric: machine
        limit: -1
        timeFrame: year
        geo: global
        domains:
          - https://www.cyberark.com
        unit: 1
        price: contact sales
        userMultiplied: false
    elements:
      - name: Conjur Secrets Manager (SaaS / Self-Hosted)
      - name: Secrets Hub
      - name: Credential Providers
      - name: Certificate Manager (incl. Kubernetes)
      - name: Code Sign Manager
      - name: Zero Touch PKI
      - name: SSH Manager for Machines
      - name: CyberArk Conjur Secrets Manager API
  - id: cyberark-identity-governance
    name: Modern Identity Governance
    type: enterprise
    description: Access Review Compliance, Provisioning, Lifecycle Management, Identity Flows. Per-user
      subscription.
    entries:
      - label: Per governed user
        description: Negotiated per-seat identity governance subscription
        name: governed_seat
        type: subscription
        metric: seat
        limit: -1
        timeFrame: year
        geo: global
        domains:
          - https://www.cyberark.com
        unit: 1
        price: contact sales
        userMultiplied: true
    elements:
      - name: User Access Review Compliance
      - name: Provisioning
      - name: Lifecycle Management
      - name: Identity Flows
      - name: CyberArk Identity REST API
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com
x-canonical:
  generated: '2026-10-08'
  vocabulary: all/0-working/economics/plans-canonical.yml
  models:
  - seat
  - subscription
  units:
  - seat
  plans:
  - name: Privileged Access (PAM)
    access: enterprise
    model: seat
    model_how: derived
    units:
    - seat
    periods:
    - year
  - name: Workforce Access (Identity)
    access: enterprise
    model: seat
    model_how: derived
    units:
    - seat
    periods:
    - year
  - name: Secrets Management & Machine Identity
    access: enterprise
    model: subscription
    model_how: derived
    units:
    - other
    periods:
    - year
  - name: Modern Identity Governance
    access: enterprise
    model: seat
    model_how: derived
    units:
    - seat
    periods:
    - year