DocumentationAPI ReferenceRelease Notes
Documentation

API configuration

Suggest Edits

What is API configuration?

API configuration involves setting up the application programming interface (API) to allow secure and efficient communication between the B Series Appliance and external systems, enabling integration with other services.

How is API configuration useful for the B Series Appliance?

API configuration allows administrators to automate tasks, integrate third-party tools, and extend the functionality of the B Series Appliance, improving workflows and streamlining operations.

How do I access the API Configuration page?

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Management.
    The Managment page opens and the Software tab displays by default.
  3. Click the API Configuration tab.
    The API Configuration tab displays.

The API Configuration page

An image of a management interface for API configuration. The interface includes options for enabling XML APIs, viewing API documentation, and downloading the btapi CLI client. It also features a section for managing API accounts, including a button to add new accounts and a list of existing accounts with details such as OAuth Client ID, permissions (e.g., Reporting API: Vault Reports and Configuration API), and enabled status. Edit and delete options are available for each account.
  1. Left menu: Easy access to all pages in Privilege Remote Access, including Status, Consoles & Downloads, My Account, Configuration, Jump, Vault, Console Settings, Users & Security, Reports, Management, and Appliance pages.
  2. Status: Opens the Status page.
  3. Header: Change your tenant site, manage your profile, and access documentation.
  1. Enabled XML API: Allows APIs to be enabled or disabled globally.
  2. Add: Add an API account.
  3. API Account column: A list of API Account columns.
    API Account columns
    • Name: Displays the name of the account.
    • OAuth Client ID: The client id of the account.
    • Permissions: List of permissions for the account.
    • Enabled: Determines if the account is enabled or not.
  4. API account options: Edits or deletes an API account.

Add an API account

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Management.
    The Managment page opens and the Software tab displays by default.
  3. Click the API Configuration tab.
    The API Configuration tab displays.
  4. Select the Enabled XML API checkbox to allow APIs to be enabled or disabled globally. The "XML APIs" include the Command API, Reporting API, Backup API, and Client Scripting API. When enabled, API Account OAuth credentials are still required to authenticate each API request.
  5. Click btapi CLI Client Download and select the appropriate platform. The Command Line Interface (CLI) tool can be downloaded to make it easier to use and configure APIs and automation scripts, and integrate them with your BeyondTrust Privileged Remote Access installation. The CLI tool is available for Windows (x64), macOS, and Linux (x64) platforms.
    The download is a compressed executable file. Extract the file, and save or link it from an executable area (in your PATH).
    • For Windows systems: Open the file in a terminal such as Windows Command Prompt or Windows PowerShell.
    • For macOS systems: Run the file in the terminal.
      The Help information, including options, commands, and variable instructions, display when the program opens.

      ℹ️

      Note

      For more information about how to create APIs with CLI, see use case examples in the BeyondTrust Privileged Remote Access API Guide.

  6. In the API Accounts section, click Add.

    📘

    Note

    An API account stores all of the authentication and authorization settings for the API client. At least one API account is required to use the API, either in conjunction with the Integration Client, with a third-party app, or with your own in-house developed software.

  7. For Enabled, if selected, this account is allowed to authenticate to the API. When an account is not selected, all OAuth tokens associated with the account are immediately disabled.
  8. For Name, enter a unique name for the account. This is a required field.
  9. For Comments, add a comment to assist in identifying the account.
  10. For OAuth Client ID, this is a unique ID generated by the B Series Appliance. It cannot be modified. The client ID is considered public information and, therefore, can be shared without compromising the security of the integration.
  11. For OAuth Client Secret, this is generated by the B Series Appliance using a cryptographically secure pseudo-random number generator.

    ℹ️

    Note

    • The client secret cannot be modified, but it can be regenerated on the Edit page. When you regenerate a client secret and then save the account immediately invalidates any OAuth tokens associated with the account. Any API calls using those tokens cannot access the API.
    • The OAuth client ID and client secret are used to create OAuth tokens, necessary for authenticating to the API.
  12. In the Permissions section, select the areas of the API this account is allowed to use.
    For the Command API, choose to deny access, to allow read-only access, or to allow full access.
    For the Reporting API, check the allowed permissions:
    • Allow Access to Access Session Reports and Recordings
    • Allow Access to License Usage Reports
    • Allow Access to Vault Account Activity Reports
    • Allow Access to Jump Item Reports
    • Allow Access to Syslog Reports
    • For the Backup API, check to Allow Access and to Allow Vault Encryption Key Access.
    • The Configuration API allows for the management and configuration of common tasks in /login, which can be automated and work with your orchestration processes. Check to Allow Access and, if access is allowed, check if this API can Manage Vault Accounts.
    • Check to allow access to the Endpoint Credential Manager API.
    • The SCIM API allows the option to provision users from a different security provider.
  13. In the Network Restrictions section, list network address prefixes from which this account can authenticate.

    ℹ️

    Note

    API accounts are not restricted by the network prefixes configured on the Management > Security page. They are restricted only by the network prefixes configured for the API account.

  14. For ECM Groups, The ECM Groups feature provides support for multiple disconnected credential providers. It allows a single PRA deployment to integrate with multiple external credential providers like Password Safe or Privileged Identity. These can be located at various remote locations through multiple ECM instances.

    ℹ️

    Note

    This feature is only present if enabled when your site is built. If it is not present, please contact your site administrator. ECMs that are not associated with a group are located under Default. You can configure up to 50 ECM Groups.

Edit an API account

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Management.
    The Managment page opens and the Software tab displays by default.
  3. Click the API Configuration tab.
    The API Configuration tab displays.
  4. From the API Accounts table, select an account you wish to edit.
  5. Click the pencil to edit the account.
  6. Make the necessary changes and click Save.

Delete an API account

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Management.
    The Managment page opens and the Software tab displays by default.
  3. Click the API Configuration tab.
    The API Configuration tab displays.
  4. From the API Accounts table, select an account you wish to delete.
  5. Click Yes when the confirmation dialog box displays.

Updated 13 days ago

©2003-2025 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.