CyberArk

Connect your own CyberArk PVWA vault by saving its base URL and credentials, after checking they actually work.

Disconnect a CyberArk vault: deletes only the saved credentials. Nothing in CyberArk itself is changed.

List the connected CyberArk vaults.

Build one aggregated health report for the connected CyberArk vault: Safe count, Account count, and pending access requests.

List Safes in the connected CyberArk vault, optionally filtered by a search string.

Read one CyberArk Safe in full.

Create a new Safe in the connected CyberArk vault.

List the members (users/groups with access) of a CyberArk Safe.

Grant a user or group access to a CyberArk Safe.

List privileged Accounts in the connected CyberArk vault, optionally filtered by a search string or Safe name.

Read one privileged Account's metadata in full (never the secret itself -- use retrieve_account_password for that).

Onboard a new privileged Account into a Safe.

Update selected fields of an existing Account (name, address). Only given fields change.

Permanently delete a privileged Account from CyberArk. Cannot be undone.

Retrieve a privileged Account's current password/secret. This exposes real credentials -- use with care.

Verify a privileged Account's stored password still matches the target system (CyberArk's own reconciliation check).

Force-reconcile a privileged Account's password using its Safe's configured reconciliation account -- use after a manual out-of-band change desynced the vault.

Rotate a privileged Account's password immediately (CPM-managed or explicit new value). This changes the real credential in the target system.

Create a Just-In-Time access request for a privileged Account -- for Safes configured with dual control, this must be confirmed before retrieval succeeds.

List Just-In-Time access requests for a privileged Account.

Confirm a pending Just-In-Time access request on a dual-control Safe -- required from a second approver before the requestor can retrieve the credential.

Cancel a pending Just-In-Time access request before it is confirmed or used.

List AAM/CCP Application identities configured on the connected CyberArk vault -- the programmatic identities that can fetch credentials without a human.

Read one AAM/CCP Application identity in full.

List account-type Platforms (templates) configured on the connected CyberArk vault, e.g. 'WinServerLocal', 'UnixSSH' -- required when onboarding a new Account.

Read the Security Events audit trail for the connected CyberArk vault -- who accessed or changed what, and when.