Ansible | PS

🚧

Important information

• Do not log the secrets to stdout. Security-minded engineers must review playbooks composition before changes are run with access to secrets.
• Ansible writes lookup plugin arguments to stdout. Do not put secret text directly in the lookup plugin arguments. Use variables as an alternative.

ℹ️

For more information, see the Ansible Galaxy Registry.

ℹ️

Not preparing the environment is the most common cause of a failed install.

For more information, see Troubleshooting.

✅

Example

✅

Example

✅

Example

- name: Create Folder
  beyondtrust.secrets_safe.folders_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      name: "my_folder_name"
      folder_name: "parent_folder"
      description: "folder description"

✅

Example

- name: Create Safe
  beyondtrust.secrets_safe.safes_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      name: "my_safe_name"
      description: "safe description"

✅

Example

- name: Create File Secret in PS
  beyondtrust.secrets_safe.secrets_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      title: "Secret Title"
      username: "test_user"
      password: "Secret content"
      folder_name: "my_folder_name"
      description: "Folder Description"
      owner_id: 12
      owner_type: "User"
      owners:
        - owner_id: 12
- name: Create Credential Secret in PS
  beyondtrust.secrets_safe.secrets_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      title: "Secret Title"
      text: "Secret content"
      folder_name: "my_folder_name"
      description: "Folder Description"
      owner_id: 12
      owner_type: "User"
      owners:
        - owner_id: 12
- name: Create Text Secret in PS
  beyondtrust.secrets_safe.secrets_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      title: "Secret Title"
      file_path: "my_secret.txt"
      folder_name: "my_folder_name"
      description: "Folder Description"
      owner_id: 12
      owner_type: "User"
      owners:
        - owner_id: 12

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    safes: "{{ lookup('beyondtrust.password_safe.safes_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Safes list
      debug:
        msg: "{{ safes }}"
    - name: Print my_new_safe_name safe
      debug:
        msg: "{{ safes | selectattr('Name', 'equalto', 'my_new_safe_name') | first }}"

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    folders: "{{ lookup('beyondtrust.password_safe.folders_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Folders list
      debug:
        msg: "{{ folders }}"
    - name: Print folder2 folder
      debug:
        msg: "{{ folders | selectattr('Name', 'equalto', 'folder2') | first }}"

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret:
      "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    certificatePasswordFromEnVar:
      "{{ lookup('ansible.builtin.env', 'CERTIFICATE_PASSWORD') }}"
    certificatePath: "<path>/ClientCertificate.pfx"
    secretManagedAccounts:
      "fake_system/fake_managed_account,fake_system/fake_managed_account01"
    gotManagedAccount:
      "{{lookup('beyondTrust.secrets_safe.secrets_safe_lookup',
        api_url=api_url,
        retrieval_type='MANAGED_ACCOUNT',
        client_id=client_id,
        client_secret=client_secret,
        secret_list=secretManagedAccounts,
        certificate_path=certificatePath,
        certificate_password=certificatePasswordFromEnVar,
        wantlist=False)}}"
    secretList: "fake_grp/credential,fake_grp/file"
    gotSecrets:
      "{{lookup('beyondTrust.secrets_safe.secrets_safe_lookup',
        api_url=api_url,
        retrieval_type='SECRET',
        client_id=client_id,
        client_secret=client_secret,
        secret_list=secretList,
        certificate_path=certificatePath,
        certificate_password=certificatePasswordFromEnVar,
        wantlist=False,
        verify_ca=True)}}"

✅

Example

- name: Create Asset
  beyondtrust.password_safe.assets_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      workgroup_id: 10
      ip_address: "192.168.1.100"
      asset_name: "my_asset"
      dns_name: "my-asset.example.com"
      domain_name: "example.com"
      mac_address: "00:1A:2B:3C:4D:5E"
      asset_type: "Server"
      description: "Linux application server"
      operating_system: "Ubuntu 22.04 LTS"

✅

Example

- name: Create workgroup
  beyondtrust.password_safe.workgroups_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      name: "organization_name"

✅

Example

- name: Create Managed System
  beyondtrust.password_safe.managed_systems_create_by_workgroup_id:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      workgroup_id: 55
      entity_type_id: 1
      host_name: "test-server-01"
      ip_address: "192.168.1.100"
      dns_name: "test-server-01.example.com"
      instance_name: "SQLInstance1"
      template: "Standard"
      forest_name: "example.local"
      platform_id: 1
      net_bios_name: "TESTSRV01"
      contact_email: "[email protected]"
      description: "Test SQL Server"
      timeout: 60
      password_rule_id: 0
      account_name_format: 1
      oracle_internet_directory_service_name: "OIDService"
      release_duration: 180
      max_release_duration: 1440
      isa_release_duration: 120
      auto_management_flag: false
      check_password_flag: true
      change_password_after_any_release_flag: false
      reset_password_on_mismatch_flag: true
      change_frequency_type: "xdays"
      change_frequency_days: 30
      change_time: "02:00"
      remote_client_type: "EPM"
      is_application_host: false
      access_url: "https://test-server-01.example.com"
      is_default_instance: true
      use_ssl: true
      port: 1433
      ssh_key_enforcement_mode: 0
      dss_key_rule_id: 0
      login_account_id: 0
      oracle_internet_directory_id: "2a1ce180-2ae7-470a-9dda-1a8935407a1b"
      functional_account_id: 4
      elevation_command: "sudo"
      application_host_id: 5001

✅

Example

- name: Create Managed Accounts
  beyondtrust.password_safe.managed_accounts_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      managed_system_name: "System Name"
      account_name: "example_account"
      password: "SomePasswordValue123!"
      domain_name: "example.com"
      user_principal_name: "[email protected]"
      sam_account_name: "EXAMPLE\\user"
      distinguished_name: "CN=User Example,OU=Users,DC=example,DC=com"
      private_key: "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9...\n-----END PRIVATE KEY-----"
      passphrase: "MySecurePassphrase"
      password_fallback_flag: true
      login_account_flag: false
      description: "This is an example managed account"
      password_rule_id: 42
      api_enabled: true
      release_notification_email: "[email protected]"
      change_services_flag: true
      restart_services_flag: false
      change_tasks_flag: true
      release_duration: 180
      max_release_duration: 1440
      isa_release_duration: 120
      max_concurrent_requests: 3
      auto_management_flag: false
      dss_auto_management_flag: false
      check_password_flag: true
      reset_password_on_mismatch_flag: true
      change_password_after_any_release_flag: false
      change_frequency_type: "xdays"
      change_frequency_days: 30
      change_time: "02:00"
      next_change_date: "2025-10-13"
      use_own_credentials: false
      change_iis_app_pool_flag: true
      restart_iis_app_pool_flag: true
      workgroup_id: 501
      change_windows_auto_logon_flag: false
      change_com_plus_flag: true
      change_dcom_flag: false
      change_scom_flag: false
      object_id: "d27fee10-30b2-46ee-9d61-192c34fb2bfd"

✅

Example

- name: Create Functional account
  beyondtrust.password_safe.functional_accounts_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      platform_id: 123
      account_name: "my_account"
      domain_name: "example.com"
      display_name: "My Account Display Name"
      password: "SomePasswordValue"
      private_key: "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9...\n-----END PRIVATE KEY-----"
      passphrase: "MyPassphrase"
      description: "This is an example account description"
      elevation_command: "sudo su -"
      tenant_id: "a3f2c5e8-47b0-4b3f-8e9a-12c456789abc"
      object_id: "d47a9b1e-9f32-4c2e-8a3d-9e1b5f7f1c23"
      secret: "SomeSecretValue"
      service_account_email: "[email protected]"
      azure_instance: "AzurePublic"

✅

Example

- name: Create Database
  beyondtrust.password_safe.databases_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      asset_id=1
      platform_id=9
      port=1
      instance_name="data base name"
      is_default_instance=false
      version="1.2"
      template=""

✅

Example

- name: Create Managed System
  beyondtrust.password_safe.managed_systems_create_by_database_id:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      database_id: 2
      contact_email: "[email protected]"
      description: "Test SQL Server"
      timeout: 60
      password_rule_id: 0
      release_duration: 180
      max_release_duration: 1440
      isa_release_duration: 120
      auto_management_flag: false
      functional_account_id: 0
      check_password_flag: true
      change_password_after_any_release_flag: false
      reset_password_on_mismatch_flag: true
      change_frequency_type: "xdays"
      change_frequency_days: 30
      change_time: "02:00"

✅

Example

- name: Create Managed System
  beyondtrust.password_safe.managed_systems_create_by_asset_id:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      asset_id: 48
      platform_id: 1
      contact_email: "[email protected]"
      description: "Linux Test Server"
      release_duration: 125
      max_release_duration: 1440
      isa_release_duration: 125
      password_rule_id: 0
      check_password_flag: true
      change_password_after_any_release_flag: false
      reset_password_on_mismatch_flag: true
      change_frequency_type: "xdays"
      change_frequency_days: 30
      change_time: "02:00"
      is_application_host: false
      timeout: 60
      port: 22
      ssh_key_enforcement_mode: 1
      dss_key_rule_id: 0
      login_account_id: 0
      auto_management_flag: false
      functional_account_id: 4
      elevation_command: "sudo"
      remote_client_type: "EPM"
      application_host_id: 3001

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    functional_accounts: >-
      {{ lookup('beyondtrust.password_safe.functional_accounts_list',
        api_url=api_url,
        client_id=client_id,
        client_secret=client_secret) }}
  tasks:
    - name: Print functional accounts list
      debug:
        msg: "{{ functional_accounts }}"
    - name: Print test Functional account
      debug:
        msg: "{{ functional_accounts | selectattr('AccountName', 'equalto', 'test') | first }}"

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    workgroups: "{{ lookup('beyondtrust.password_safe.workgroups_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Workgroups list
      debug:
        msg: "{{ workgroups }}"
    - name: Default Workgroup
      debug:
        msg: "{{ workgroups | selectattr('Name', 'equalto', 'Default Workgroup') | first }}"

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    assets: "{{ lookup('beyondtrust.password_safe.assets_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Assets list
      debug:
        msg: "{{ assets }}"
    - name: Print MyNewAsset2 Asset
      debug:
        msg: "{{ assets | selectattr('AssetName', 'equalto', 'MyNewAsset2') | first }}"

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    managed_accounts: "{{ lookup('beyondtrust.password_safe.managed_accounts_list', api_url=api_url,
      client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Managed Accounts list
      debug:
        msg: "{{ managed_accounts }}"
    - name: Print managed_account01 Managed Account
      debug:
        msg: "{{ managed_accounts | selectattr('AccountDescription', 'equalto', 'managed_account01') | first }}"

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    platforms: "{{ lookup('beyondtrust.password_safe.folders_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Platforms list
      debug:
        msg: "{{ platforms }}"
    - name: Print XING Platform
      debug:
        msg: "{{ platforms | selectattr('Name', 'equalto', 'XING') | first }}"

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    managed_systems: "{{ lookup('beyondtrust.password_safe.managed_systems_list', api_url=api_url,
      client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Managed Systems list
      debug:
        msg: "{{ managed_systems }}"
    - name: Print system01 Managed System
      debug:
        msg: "{{ managed_systems | selectattr('SystemName', 'equalto', 'system01') | first }}"

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    databases: "{{ lookup('beyondtrust.password_safe.databases_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print databases list
      debug:
        msg: "{{ databases }}"
    - name: Print test database
      debug:
        msg: "{{ databases | selectattr('InstanceName', 'equalto', 'test') | first }}"