---
title: "BeyondTrust Password Safe"
slug: "beyondtrust-password-safe"
updated: 2025-03-12T16:05:33Z
published: 2025-03-12T16:05:33Z
canonical: "docs.databee.buzz/beyondtrust-password-safe"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# BeyondTrust Password Safe

BeyondTrust Password Safe is an enterprise-grade privileged access management (PAM) solution that helps organizations manage and secure privileged credentials and access to critical systems. It is designed to control, monitor, and audit access to privileged accounts, such as those used by IT administrators, applications, and automated processes. More information can be found at [BeyondTrust Official Document](https://www.beyondtrust.com/products/password-safe).

**Integration Method:** API

**Tables**: User Inventory info (5003), Device Inventory info (5001)

This integration supports the following events.

| Event | Description |
| --- | --- |
| Managed Accounts | Get the list of all managed accounts |
| Managed Systems | Get the list of all managed systems |

This integration supports the following versions.

| BeyondTrust Password Safe Version | BeyondInsight 24.2.0.1324 |
| --- | --- |
| BeyondTrust Password Safe API version | v3 |

## Prerequisites

- The user should have to register API access policy for Oauth.
- The user should have to assign the features **Password Safe Account Management** and **Password Safe System Management** to the group to get all managed account and managed systems.
- The user needs to enable API option for all the managed accounts to get details of All managed accounts.
- The user should have access to DataBee console.

## Configuration Overview

1. Generate client credentials on the BeyondTrust platform.
2. Add the [BeyondTrust Password Safe data feed](/user-manual/docs/beyondtrust-password-safe#databee-configuration) integration in the DataBee console with the required Client credentials.

| **DataBee Parameter** | **BeyondTrust Password Safe Parameter** |
| --- | --- |
| Token URL: <cloud-instance-url> | BeyondTrust Cloud Instance URL |
| Client Key | Client ID |
| Client Secret | Client Secret |

## BeyondTrust Configuration

You will need to create the API Access Policy and get the necessary information for API authentication such as Client ID and Client Secret. These values are needed to configure the DataBee integration.

### BeyondTrust Cloud Instance URL

1. Get the BeyondTrust Password Safe instance from the URL as highlighted below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-3py7yurr.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)

### Configure API access policy registration

The API Access Policy registration is used specifically for OAuth. To create this in the BeyondInsight console:

1. Go to **Configuration** > **General** > **API Registrations**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-qxygllwv.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
2. Click **Create API Registration**.
3. Select **API Access Policy** from the dropdown list. The Details screen is displayed. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-dp1v8q9m.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
4. Fill out the new API registration details, including the ‘Access Token Duration’. This field determines how long the OAuth token stays active.
5. Click **Add Authentication Rule.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-0ly9ps1h.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
6. Select type **CIDR** and **IP Rule.** Add ‘CIDR’ **0.0.0.0/0** and click on **Create Rule**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-4w3wny4j.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)

### Create Group

1. From the left sidebar, click **Configuration**.
2. Under **Role Based Access**, click **User Management**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-iqsfer07.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
3. Click the **Groups** tab to display the list of groups in the grid.
4. Click **Create New Group** above the grid. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-qoy0uvu3.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
5. Select **Create a New Group** from the drop-down list.
6. Add ‘Group Name’ and ‘Description’ and click on **Create Group**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-fu706ril.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
7. Assign the features to a group to access Managed Systems and Managed Accounts Details.
8. Click the vertical ellipsis for the group, and then select **View Group details**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-b3tm2o5i.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
9. Click on **Features** tab > **All Features**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-imorkr11.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
10. Search for **Password Safe Account Management** and **Password Safe System Management** from the list of features and select checkbox.
11. Click on **Assign Permissions** and give **Read Only** permission. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-2z48mqyi.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
12. Click on **Smart Groups** and search for **All Managed Accounts** and **All Managed Systems**. Select them and click on **Assign Permissions** and give **Read only** permissions. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-jw1n2a6s.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
13. To get all Managed Account we need to give Password Safe Roles like **Requestor** or **Approver** to **All Managed Accounts** smart group**.**
14. From the ‘Show’ filter select **Enabled Smart Groups** and click on vertical eclipse of the **All Managed Accounts** smart group and click on **Edit Password Safe Roles**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-2h9e0m7m.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
15. Give **Requestor** Role and select **Default Auto-Approve Access Policy** from drop down. Then click on **Save Roles**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-6iitbx6z.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)

### Add Application User

Application users represent applications that interface with the BeyondInsight public API. Application users cannot log in to the BeyondInsight console. They can only authenticate and interact with the public API, using Client ID and Client Secret for credentials within the OAuth client credential flow.

An API Registration type of API Access Policy must be assigned to an application user and is used for processing IP rules. To create an application user, follow the below steps:

1. From the left sidebar, click **Configuration**.
2. Under **Role Based Access**, click **User Management**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-yfg4cb9c.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
3. Click the **Users** tab to display the list of users in the grid.
4. Click **Create New User** above the grid.
5. Select **Add an Application User** from the drop-down list. The “Create New Application User” screen displays. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-by75i3do.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
6. Add a ‘Username’.
7. Under ‘API Access Policy’, select the policy which we have created in the previous step.
8. Copy the information from the **Client ID** and **Client Secret** fields for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-6ycwm845.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
9. Click **Create User**.

### Assign User to Group

1. From the left sidebar, click **Configuration**.
2. Under **Role Based Access**, click **User Management**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-8hy59tht.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
3. Click on **Users** tab and select the user which we have created in Step 6 of [Add Application User](/user-manual/docs/beyondtrust-password-safe-feb2025#add-application-user) section.
4. Assign the user to a group that has the required permissions to access BeyondInsight and Password Safe features.
5. Click the vertical ellipsis for the user, and then select **View User Details**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-dfw5gaby.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
6. From the **User Details** pane, click **Groups**.
7. Click the drop-down under ‘Show’ filter and select **All Groups**, now locate the group which we created[,](/docs/beyondtrust-password-safe#Group_name) and click **Assign Group** above the grid. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-a4xipsta.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)

### Enabled API Option for all Managed Accounts

> [!NOTE]
> Note:
> 
> We will get all managed accounts in which API Enabled account setting is enabled.

Perform below steps to enable **API Enabled** settings.

1. Click on **Managed Accounts** from the side panel to get the list of Managed Accounts. ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-whc9grph.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
2. Click on **Manage Smart Rules** on the top right side to get a list of all smart rules. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-bdsr8xf9.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
3. Click on **Create Smart Rule** to create new rule. ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-zsnmut8r.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
4. Add the below details while creating new smart rule.
  - Category: Managed Accounts
  - Name: add the appropriate name of the smart rule.
  - Description: add the appropriate description of the smart rule.
  - Reprocessing limit: this is the time limit in that interval smart rule will be process on all the managed account and take the necessary action which will define later. So, we can set the limit to 6 or 12 hours. Make sure it will not be more than 24 hours because we are fetching data every 24 hours.
  - Selection Criteria: add selection criteria, based on that smart rule will be applied. As we want all Managed Accounts setting to be API enabled we must add filter in such a manner that rule will be applied to all the managed accounts and will be applied to newly created accounts as well.
    - Here we have added filter on ‘Account Name’ field as account name will always be not empty so all the managed accounts will match the regular expression “. +” and rules will be applied to all the Managed Accounts.

> [!NOTE]
> Note:
> 
> Since we must apply one filter and one action to create new rule, we must add above filter otherwise there is no need to add filter as we must apply rule to all the Managed Accounts.

![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-at2v16ad.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
5. Actions: select **Manage Account Settings**.
  - Account Options: select checkbox of **Enable API Access**. ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-2lowr3v6.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D) ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-2pw0qim1.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
6. Click on **Create Smart Rule**. ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-vq7bqxpp.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
7. Now all Managed Accounts will be accessible via API.

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-ho9vvvqe.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
2. Search for the **BeyondTrust Password Safe** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-j218e5zx.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
3. Click on the **API Ingest** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-iqbsz55n.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-qidfdzll.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
5. In the configuration page, confirm the following:
  - API Base URL: replace <cloud-instance-url> with your BeyondTrust cloud instance URL.
  - Authorization Method: OAuth2
  - Client Key: paste the Client Id generated earlier in the BeyondTrust Platform.
  - Client Secret: paste the Client Secret generated earlier in the BeyondTrust Platform.
  - Token URL: replace <cloud-instance-url> with your BeyondTrust cloud instance URL
  - Event Types: preselected for all the event types that integration pulls. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/beyondtrust-password-safe-feb2025-image-v21tclut.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A38Z&se=2026-10-30T12%3A35%3A38Z&sr=c&sp=r&sig=6XWtd7nAjTvuKBVIl%2BgIF3nWk6pn0dA8cmaB%2F7UBJ8s%3D)
  - Click **Submit**.

## Troubleshooting Tips

- Ensure **Password Safe System Management** and **Password Safe Account Management** features to a group to access Managed Systems and Managed Accounts Details.
- Ensure we have given Password Safe Roles like **Requestor** or **Approver** to **All Managed Account** Smart group of group which we have created.
- Ensure all managed accounts has **API Enabled** option enabled to get all managed accounts.