--- updatedAt: 2026-07-06T14:48:53.000Z --- # Get Managed Accounts by Quick Rule When `limit` is not given, returns up to 100,000 records. ### Required Permission(s) - Quick Rule Access (Read) # OpenAPI definition ````json { "components": { "schemas": { "ManagedAccountContainerModel": { "additionalProperties": false, "description": "Page of Managed Accounts", "properties": { "Data": { "description": "Requested page of data", "items": { "$ref": "#/components/schemas/ManagedAccountModel" }, "nullable": true, "type": "array" }, "TotalCount": { "description": "Total record count", "format": "int32", "type": "integer" } }, "type": "object" }, "ManagedAccountModel": { "additionalProperties": false, "description": "Managed Account", "properties": { "AccountName": { "description": "Name of the account", "maxLength": 245, "minLength": 0, "nullable": true, "type": "string" }, "ApiEnabled": { "default": false, "description": "True if the account can be requested through the API, otherwise false", "type": "boolean" }, "AutoManagementFlag": { "default": false, "description": "True if password auto-management is enabled, otherwise false", "type": "boolean" }, "ChangeComPlusFlag": { "default": false, "description": "True if COM+ Apps should be updated with the new password after a password change, otherwise false", "type": "boolean" }, "ChangeDComFlag": { "default": false, "description": "True if DCOM Apps should be updated with the new password after a password change, otherwise false", "type": "boolean" }, "ChangeFrequencyDays": { "description": "(days: 1-999) When `ChangeFrequencyType` is xdays, password changes occur every N days as configured by this property", "format": "int32", "type": "integer" }, "ChangeFrequencyType": { "default": "first", "description": "Change frequency for scheduled password changes:\n\n- first: Changes scheduled for the first day of the month\n- last: Changes scheduled for the last day of the month\n- xdays: Changes scheduled every x days (see: `ChangeFrequencyDays`)", "nullable": true, "type": "string" }, "ChangeIISAppPoolFlag": { "description": "True if IIS Application Pools run as this user should be updated with the new password after a password change, otherwise false", "type": "boolean" }, "ChangePasswordAfterAnyReleaseFlag": { "default": false, "description": "True to change passwords on release of a request, otherwise false", "type": "boolean" }, "ChangeSComFlag": { "default": false, "description": "True if SCOM Identities should be updated with the new password after a password change, otherwise false", "type": "boolean" }, "ChangeServicesFlag": { "default": false, "description": "True if services run as this user should be updated with the new password after a password change, otherwise false", "type": "boolean" }, "ChangeState": { "description": "Change state of the account credentials:\n \n- 0: Idle - No change taking place or scheduled within 5 minutes\n- 1: Changing - Credential currently changing\n- 2: Queued - Credential is queued to change or scheduled to change within 5 minutes", "format": "int32", "readOnly": true, "type": "integer" }, "ChangeTasksFlag": { "default": false, "description": "True if scheduled tasks run as this user should be updated with the new password after a password change, otherwise false", "type": "boolean" }, "ChangeTime": { "default": "23:30", "description": "(24hr: 00:00-23:59) UTC time of day scheduled password changes take place", "nullable": true, "type": "string" }, "ChangeWindowsAutoLogonFlag": { "default": false, "description": "True if Windows Auto Logon should be updated with the new password after a password change, otherwise false", "type": "boolean" }, "CheckPasswordFlag": { "default": false, "description": "True to enable password testing, otherwise false", "type": "boolean" }, "DSSAutoManagementFlag": { "default": false, "description": "True if DSS key auto-management is enabled, otherwise false. Can be set if `Platform.DSSAutoManagementFlag=true`.", "type": "boolean" }, "Description": { "description": "Description of the account", "maxLength": 1024, "minLength": 0, "nullable": true, "type": "string" }, "DistinguishedName": { "description": "Distinguished name of an LDAP account", "maxLength": 1000, "minLength": 0, "nullable": true, "type": "string" }, "DomainName": { "description": "Domain name for a domain-type account", "maxLength": 128, "minLength": 0, "nullable": true, "readOnly": true, "type": "string" }, "ISAReleaseDuration": { "default": 120, "description": "(minutes: 1-525600) Default Information Systems Administrator (ISA) release duration", "format": "int32", "type": "integer" }, "IsChanging": { "description": "True if the account credentials are in the process of changing, otherwise false", "readOnly": true, "type": "boolean" }, "IsSubscribedAccount": { "description": "True if the account is a synced or subscribed account, otherwise false", "readOnly": true, "type": "boolean" }, "LastChangeDate": { "description": "Date and time of the last password change", "format": "date-time", "nullable": true, "readOnly": true, "type": "string" }, "LoginAccountFlag": { "description": "True if the account should use the Managed System login account for SSH sessions, otherwise false", "type": "boolean" }, "ManagedAccountID": { "description": "ID of the Managed Account", "format": "int32", "readOnly": true, "type": "integer" }, "ManagedSystemID": { "description": "ID of the parent Managed System", "format": "int32", "readOnly": true, "type": "integer" }, "MaxConcurrentRequests": { "default": 1, "description": "(0-999) (0 is Unlimited) Maximum number of concurrent password requests for this account", "format": "int32", "type": "integer" }, "MaxReleaseDuration": { "default": 525600, "description": "(minutes: 1-525600) Default maximum release duration", "format": "int32", "type": "integer" }, "NextChangeDate": { "description": "Date and time of the next scheduled password change", "format": "date-time", "nullable": true, "type": "string" }, "ObjectID": { "description": "ObjectID of the account (if applicable). Required when `Platform.RequiresObjectID=true`.", "maxLength": 36, "minLength": 0, "nullable": true, "type": "string" }, "ParentAccountID": { "description": "ID of the parent Managed Account (if this is a synced or subscribed account; see: `IsSubscribedAccount`)", "format": "int32", "nullable": true, "readOnly": true, "type": "integer" }, "PasswordFallbackFlag": { "default": false, "description": "True if failed DSS authentication can fall back to password authentication, otherwise false", "type": "boolean" }, "PasswordRuleID": { "default": 0, "description": "ID of the assigned Password Rule", "format": "int32", "type": "integer" }, "ReleaseDuration": { "default": 120, "description": "(minutes: 1-525600) Default release duration", "format": "int32", "type": "integer" }, "ReleaseNotificationEmail": { "description": "Email address used for notification emails related to this account", "maxLength": 255, "minLength": 0, "nullable": true, "type": "string" }, "ResetPasswordOnMismatchFlag": { "default": false, "description": "True to queue a password change when scheduled password test fails, otherwise false", "type": "boolean" }, "RestartIISAppPoolFlag": { "description": "True if IIS Application Pools should be restarted after the run as password is changed (see: `ChangeIISAppPoolFlag`), otherwise false", "type": "boolean" }, "RestartServicesFlag": { "default": false, "description": "True if services should be restarted after the run as password is changed (see: `ChangeServicesFlag`), otherwise false", "type": "boolean" }, "SAMAccountName": { "description": "(Active Directory Managed Systems only) SAM account name of an Active Directory account", "maxLength": 20, "minLength": 0, "nullable": true, "type": "string" }, "UseOwnCredentials": { "description": "True if the current account credentials should be used during change operations, otherwise false", "type": "boolean" }, "UserPrincipalName": { "description": "(Active Directory Managed Systems only) User Principal Name of an Active Directory account", "maxLength": 500, "minLength": 0, "nullable": true, "type": "string" }, "WorkgroupID": { "description": "ID of the assigned Workgroup", "format": "int32", "nullable": true, "type": "integer" } }, "type": "object" } }, "securitySchemes": { "ApiKey": { "description": "API key needed to access the endpoints. Example: `PS-Auth key=$key; runas=$user;`", "in": "header", "name": "Authorization", "type": "apiKey" } } }, "info": { "contact": { "name": "BeyondTrust Support", "url": "https://www.beyondtrust.com/support" }, "description": "
\n\nThis document specifies the Representational State Transfer (REST) compliant Application Programmer Interface (API) over HTTPS for BeyondInsight and Password Safe. It is a way to integrate a portion of the BeyondInsight and Password Safe functionality into your own applications.\n\nUsing the REST API makes it easier for users to build customized solutions for their specific needs while ensuring secure data transmission. The API provides a set of predefined operations, or endpoints, that can be accessed using HTTP Requests, including GET requests to retrieve data, POST requests to create new data, PUT requests to update existing data, and DELETE requests to remove data.\n\nThis resource is intended for readers with knowledge of HTTPS request and response processing, web development, and JSON notation.\n\n\n## Usage\n\n### API key\n\nThe API key is a cryptographically strong random sequence of numbers hashed into a 128-character string. It is encrypted and stored internally using AES 256 encryption. Any language with a Representational State Transfer (REST) compliant interface can access the API with the API key and RunAs in the authorization header.\n\n### Session state\n\nThis section describes API key authentication. Session state is maintained between API calls. The method is dependent on the scripting language. Initiate a session using API **POST Auth/SignAppIn** and always call **POST Auth/Signout** when you are done.\n\nA successful sign-in returns a session cookie. Your HTTP client must store that cookie and send it on every subsequent request; the examples below show how to do this in each language. The session expires after 20 minutes of inactivity, after which you must sign in again.\n\nIf you authenticate with an OAuth bearer token instead, a session is optional. See **OAuth public API authentication** below.\n\nThe authentication endpoints are:\n\n- **POST Auth/SignAppIn** - authenticate and establish a session.\n- **POST Auth/Signout** - end the session.\n- **POST Auth/Connect/Token** - obtain an OAuth bearer token. See **OAuth public API authentication** below.\n\n### Base endpoint\n\nThe following base endpoint is used throughout this document. For on-premises instances, **the-server** is a placeholder and should be replaced with the server name in your environment.\n\n```\n{base} = https://the-server/BeyondTrust/api/public/v3\n```\n\nFor cloud instances, **the-cloud-instance-url** is a placeholder and should be replaced with the cloud instance URL in your environment.\n\n```\n{base} = https://the-cloud-instance-url/BeyondTrust/api/public/v3\n```\n\nSSL is required to use the Password Safe Public API.\n\n### Authorization header\n\nUse the web request authorization header to communicate the API application key, the **RunAs** username, and the user password:\n\n- **key:** The API key configured in BeyondInsight for your application.\n- **runas:** The username of a BeyondInsight user that has been granted permission to use the API key.\n- **pwd:** The **RunAs** user password surrounded by square brackets (required only if the **User Password** factor is enabled on the application API registration).\n- **token:** A Personal Access Token (required only if the **Personal Access Token** factor is enabled on the application API registration). See **Authentication factors** below.\n- **challenge:** The answer to a two-factor challenge. See **Two-Factor authentication** below.\n\n```\nAuthorization=PS-Auth key=c479a66f…c9484d; runas=doe-main\\johndoe; pwd=[un1qu3];\n```\n\nParameter names are not case sensitive. Semicolons separate parameters, so a value may not contain one - except **pwd**, which is read as everything between its square brackets and so may contain semicolons.\n\n> ⚠️ \n> \n> The pwd value must be enclosed in square brackets and followed by a semicolon. If either is omitted the password is read as empty and the request fails with 401. The token value requires neither.\n\n> ℹ️ \n> \n> The API keys in the examples have been shortened for brevity. A domain user is being used. When using a domain user, depending on the programming or scripting tool used, you may need to escape the backslash (`\\`) character between the domain name and username.\n\n### Authentication factors\n\nAn API registration may require one or more additional factors beyond the API key. Each is configured on the registration in BeyondInsight:\n\n- **Multi-factor authentication** - see **Two-Factor authentication** below.\n- **User password** - supply the **pwd** parameter in the authorization header.\n- **Personal Access Token** - supply the **token** parameter in the authorization header.\n- **Source address** - the request must originate from an address allowed by the registration.\n- **X-Forwarded-For** - the request must carry an `X-Forwarded-For` header containing exactly one address.\n\nWhen a required factor is missing or invalid the request fails with 401 and a generic message. The specific reason is not returned in the response; it is recorded in a BeyondInsight User Audit entry.\n\nRepeated failures of the user password, Personal Access Token or two-factor factors count towards the account lockout threshold configured in BeyondInsight, and will lock the RunAs user once it is reached. An invalid API key does not count towards it. A successful sign-in resets the counter.\n\n#### Personal Access Tokens\n\nTo authenticate with a Personal Access Token:\n\n1. Create the token for the user in the BeyondInsight console. There is no Public API endpoint for creating one.\n2. Enable the **Personal Access Token** factor on the API registration.\n3. Supply the token in the authorization header using the **token** parameter.\n\n```\nAuthorization=PS-Auth key=c479a66f…c9484d; runas=doe-main\\johndoe; token=8f14e45fceea167a;\n```\n\n> ℹ️ \n> \n> An expired token and an invalid token produce the same response. Both count towards the account lockout threshold.\n\n### Two-Factor authentication\n\nDepending on how the two-factor server is configured, a programmatic two-factor challenge is sometimes required.\n\n#### No challenge\n\nIf the two-factor server is configured to authenticate through a push or mobile two-factor challenge, a challenge response is often not required. The first call to **POST Auth/SignAppIn** logs the user in, as long as the authentication request to the two-factor server does not time out.\n\n#### Challenge\n\nWhen a two-factor challenge is configured, two calls to **POST Auth/SignAppIn** are required and session state must be maintained between these two calls to validate the two-factor challenge.\n\nThe initial call to POST Auth/SignAppIn results in a _401 Unauthorized response_ which contains a header WWW-Authenticate-2FA containing the prompt from the authentication service. The prompt can be used to prompt the user for the challenge answer.\n\n> ℹ️ \n> \n> If the WWW-Authenticate-2FA header is not present, a two-factor authentication challenge has not been configured for the user.\n\nWhen the challenge answer has been received from the user, **POST Auth/SignAppIn** is called again with the challenge answer in the authorization header, similar to the other authorization parameters:\n\n- **challenge:** The answer to the two-factor challenge.\n\n```\nAuthorization=PS-Auth key=c479a66f…c9484d; runas=doe-main\\johndoe; pwd=[un1qu3]; challenge=543687;\n```\n\n> ℹ️ \n> \n> The challenge answer is only required on the second call to POST Auth/SignAppIn and not on subsequent requests.\n\n### OAuth public API authentication\n\nThe OAuth sign-in method uses the OAuth client credential flow. The client credentials grant type is used by clients to obtain an access token outside of the context of a user.\n\nOnly users with user type **Application**, who are associated to an **API Access Policy** API registration in BeyondInsight, can use this authentication method.\n\nObtain an access token from **POST Auth/Connect/Token**, then send it on subsequent requests:\n\n```\nAuthorization: Bearer [access_token]\n```\n\nWith a bearer token you can work in either of two ways.\n\n- **Send the token on every request.** You do not need to call **POST Auth/SignAppIn** at all. Each request is authenticated on its own and no session is created, so the sign-in and sign-out steps described under **Session state** and shown in the workflows below do not apply. This is the simpler option.\n- **Call POST Auth/SignAppIn once with the token.** This also creates a session cookie, so later requests can be made with the cookie alone, as they are with API key sign-in.\n\n> ⚠️ \n> \n> Once the session exists it runs on its own 20-minute idle timeout and no longer depends on the token. Later cookie-only requests are not checked against the token's expiry, so the session keeps working after the token has expired, until the session itself times out. If you need access to stop when a token expires, send the token on every request instead of establishing a session.\n\n> ℹ️ \n> \n> Impersonation for the OAuth client credential flow is different than API key. Instead of providing the RunAs user as part of the Authorization header you provide the RunAs user using a new RunAs header. You can only impersonate users who are in the same group as the application user.\n\n> ℹ️ \n> \n> Setting up an OAuth authentication method requires the following steps:\n\n### Use certificates with APIs\n\n> ⚠️ \n> \n> Client certificate authentication has been removed and is no longer supported for API registrations. An API registration that still has Client certificate required enabled will fail to authenticate. Update the registration to clear that setting.\n\n### Request body\n\nFor Password Safe API Endpoints, some request bodies have multiple versions available. The request body versions allow for different sets of data to be sent to a API endpoint dependent on what needs to be accomplished by the request. Each request body version is outlined on its relevant endpoint and these body versions are only relevant to their listed URI.\n\nThe version is supplied as a **version** query parameter. If it is omitted the default version is used, which is 3.0 unless the endpoint states otherwise. Only endpoints that document a **version** parameter support this.\n\n```\nhttps://the-server/BeyondTrust/api/public/v3/endpoint?version=3.1\n```\n\n### Common response codes\n\nBelow are response codes common to all APIs. Custom responses are detailed in the individual endpoints.\n\n- 200 – Request successful.\n- 201 – Request successful. Resource created.\n- 204 – Request successful. No content in body.\n- 400 – Bad Request – Validation failure, missing request body, or string values exceed the maximum length. Reason in response body.\n- 401 – Unauthorized – User is not authenticated. Typical reasons include:\n - An invalid product license was detected.\n - The request headers were not set properly.\n - The server could not verify the validity of the request (due to one or more API factors).\n - The user session has expired.\n - The API key has been rotated but has not been updated in the calling script or application.\n\n> ℹ️ \n> \n> When you encounter a 401 error due to factor validation failure, a User Audit entry is created in BeyondInsight detailing the reason. Look here first for the reason why authorization failed.\n\n- 403: – Access forbidden. User does not have the appropriate role or permission.\n- 404 – Object not found where expected. Reason in response body.\n- 409 – Conflict. The request conflicts with the current state of the resource. Reason in response body.\n\n#### Examples\n\nEach example signs in, then reuses the session cookie on subsequent calls.\n\n##### C#\n\nCreate and reuse a persistent connection using the System.Net.Http.HttpClient class.\n\n```csharp\nHttpClient client = new HttpClient();\nclient.DefaultRequestHeaders.Add(\"Authorization\",\n\"PS-Auth key=c479a66f…c9484d; runas=doe-main\\\\johndoe;\");\n\nstring json = Newtonsoft.Json.JsonConvert.SerializeObject(null);\nSystem.Net.Http.StringContent content = new StringContent(json);\ncontent.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue(\"application/json\");\n\nHttpResponseMessage signInResponse = client.PostAsync(\"{base}/Auth/SignAppIn\", content).Result;\n```\n\nSubsequent calls:\n\n```csharp\nHttpResponseMessage getResponse = client.GetAsync(\"{base}/ManagedAccounts\").Result;\n```\n\nUser Password factor enabled (header example only):\n\n```csharp\nHttpClient client = new HttpClient();\nclient.DefaultRequestHeaders.Add(\"Authorization\",\n\"PS-Auth key=c479a66f…c9484d; runas=doe-main\\\\johndoe; pwd=[un1qu3];\");\n```\n\n##### PowerShell\n\nPowerShell internally creates a session variable to use for each subsequent call; Invoke-RestMethod CmdLet options -SessionVariable and -WebSession respectively. In the below example, the variable is named \"session\" and has script-level scope.\n\n```powershell\n$headers = @{ Authorization=\"PS-Auth key=c479a66f…c9484d; runas=doe-main\\johndoe;\"; };\n$uri = \"{base}/Auth/SignAppIn\";\n$signinResult = Invoke-RestMethod -Uri $uri -Method POST -Headers $headers -SessionVariable script:session;\n```\n\nSubsequent calls:\n\n```powershell\n$uri = \"{base}/ManagedAccounts\";\n$accounts = Invoke-RestMethod -Uri $uri -Method GET -WebSession $script:session -Headers $headers;\n```\n\n##### Java\n\nCreate and reuse a persistent connection using the java.net.HttpURLConnection class.\n\n```java\nURL baseURL = new URL(\"HTTPS\", \"the-server\", 443, \"/BeyondTrust/api/public/v3/\");\nURL url = new URL(baseURL, \"Auth/SignAppIn\");\nHttpURLConnection conn = (HttpURLConnection)url.openConnection();\nconn.setRequestMethod(\"POST\");\nconn.setRequestProperty(\"Authorization\",\"PS-Auth key=c479a66f…c9484d; runas=doe-main\\\\johndoe;\");\n```\n\n##### Ruby\n\nUsing the rest-client gem, carry the cookies returned by sign-in over to subsequent requests.\n\n```ruby\nsamp_key = 'PS-Auth key=c479a66f…c9484d; runas=doe-main\\\\johndoe;'\nresult = RestClient::Request.execute(method: :post, url: '{base}/Auth/SignAppIn', :headers => {'Authorization' => samp_key} )\ncookies = result.cookies\n```\n\nSubsequent calls:\n\n```ruby\nresult = RestClient::Request.execute(method: :get, url: '{base}/ManagedAccounts', headers: {'Authorization' => samp_key}, cookies: cookies)\n```\n\n##### Python\n\nCreate and reuse a persistent connection using the requests module.\n\n```python\nheader = {'Authorization': 'PS-Auth key=c479a66f…c9484d; runas=doe-main\\\\johndoe;'}\nsession = requests.Session()\nsession.headers.update(header)\nresponse = session.post('{base}/Auth/SignAppIn')\n```\n\nSubsequent calls:\n\n```python\naccounts = session.get('{base}/ManagedAccounts')\n```\n\n##### Bash\n\nUsing curl, option **-c** stores authentication information for subsequent requests and **-b** uses it in subsequent API calls.\n\n```bash\ncurl -i -c apiToken -X POST {base}/Auth/SignAppIn -H \"Content-Type: application/json\" -H \"Authorization: PS-Auth key=c479a66f…c9484d; runas=doe-main\\\\johndoe;\" -d \"\"\n```\n\nSubsequent calls:\n\n```bash\ncurl -i -b apiToken -X GET {base}/ManagedAccounts\n```\n\n#### Workflow\n\nThere are some loose dependencies between the APIs. A typical sequence is to list accounts or find an account, request a password, retrieve that password (once approved), and then release the password.\n\n##### Create and manage an asset, create user group, assign roles\n\nCase: Create and manage an asset, create a managed account, create a managed account quick rule, create/provision an LDAP/AD/BeyondInsight user group, grant **Read** access to new Smart Rule with requester role and access policy.\n\n- **POST {base}/Auth/SignAppIn**\n- **POST {base}/Workgroups/{ID}/Assets**\n- **POST {base}/Assets/{assetId}/ManagedSystems**\n- **POST {base}/ManagedSystems/{managedSystemId}/ManagedAccounts**\n- **POST {base}/QuickRules**\n- **POST {base}/UserGroups**\n- **POST {base}/UserGroups/{userGroupId}/SmartRules/{smartRuleId}/Roles**\n- **POST {base}/Auth/Signout**\n\n##### Retrieve a password\n\nCase: request, retrieve, and check in a password for a managed account:\n\n- **POST {base}/Auth/SignAppIn**\n- **GET {base}/ManagedAccounts** OR **GET {base}/ManagedAccounts?systemName={systemName}&accountName={accountName}**\n- **POST {base}/Requests**\n- **GET {base}/Credentials/{requestId}**\n- **PUT {base}/Requests/{requestId}/Checkin**\n- **POST {base}/Auth/Signout**\n\n##### Create a session\n\nCase: request a session, create a session, and check in the request for a managed account:\n\n- **POST {base}/Auth/SignAppIn**\n- **GET {base}/ManagedAccounts** OR **GET {base}/ManagedAccounts?systemName={systemName}&accountName={accountName}**\n- **POST {base}/Requests (AccessType=\"RDP\" or AccessType=\"SSH\" or AccessType=\"App\")**\n- **POST {base}/Requests/{requestId}/Sessions (SessionType == Request.AccessType above)**\n- **PUT {base}/Requests/{requestId}/Checkin**\n- **POST {base}/Auth/Signout**\n\n##### Retrieve a password as an ISA\n\nCase: create an ISA password request:\n\n- **POST {base}/Auth/SignAppIn**\n- **GET {base}/ManagedAccounts** OR **GET {base}/ManagedAccounts?systemName={systemName}&accountName={accountName}**\n- **POST {base}/ISARequests**\n- **POST {base}/Auth/Signout**\n\n##### Create a session as an ISA\n\nCase: create an ISA session:\n\n- **POST {base}/Auth/SignAppIn**\n- **GET {base}/ManagedAccounts** OR **GET {base}/ManagedAccounts?systemName={systemName}&accountName={accountName}**\n- **POST {base}/ISASessions**\n- **POST {base}/Auth/Signout**\n
\n", "title": "BeyondTrust Password Safe API", "version": "v3" }, "openapi": "3.0.4", "paths": { "/api/public/v3/quickrules/{quickRuleID}/managedaccounts": { "get": { "description": "When `limit` is not given, returns up to 100,000 records.\n\n### Required Permission(s)\n- Quick Rule Access (Read)\n", "operationId": "get-api-public-v3-quickrules-quickRuleID-managedaccounts", "parameters": [ { "description": "ID of the Quick Rule", "in": "path", "name": "quickRuleID", "required": true, "schema": { "format": "int32", "type": "integer" } }, { "description": "Number of records to return", "in": "query", "name": "limit", "schema": { "format": "int32", "type": "integer" } }, { "description": "Number of records to skip before returning `limit` records", "in": "query", "name": "offset", "schema": { "default": 0, "format": "int32", "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "oneOf": [ { "allOf": [ { "$ref": "#/components/schemas/ManagedAccountContainerModel" } ], "title": "limit is given" }, { "items": { "$ref": "#/components/schemas/ManagedAccountModel" }, "title": "limit is not given", "type": "array" } ] } } }, "description": "Request successful" }, "400": { "content": { "application/json": { "schema": { "type": "string" } } }, "description": "Validation failure" }, "401": { "content": { "application/json": { "schema": { "type": "string" } } }, "description": "Unauthorized" }, "403": { "content": { "application/json": { "schema": { "type": "string" } } }, "description": "Access forbidden" }, "404": { "content": { "application/json": { "schema": { "type": "string" } } }, "description": "Entity not found" } }, "summary": "Get Managed Accounts by Quick Rule", "tags": [ "Managed Accounts" ] } } }, "security": [ { "ApiKey": [] } ], "tags": [ { "description": "Provides access to Managed Account functionality including retrieving requestable accounts and account management.", "name": "Managed Accounts" } ] } ````