Skip to main content
GET
Get secret credentials
Retrieves a secret’s actual credentials — login, password, and (for SSH-type secrets) the SSH private key. The canonical endpoint that automation consumers call to retrieve credentials at deployment time, runtime, or scheduled-task execution. The most frequently called ACB endpoint.
For ACB deployments updated from a version prior to 1.2, switch to the https://{hostname}/EkranACB server in the Playground.

Permissions required

The user owning the Access Token must have at least PAM User role on the secret.

Check-out and approval interactions

  • If the secret is configured with check-out enabled, this call checks the secret out — and the next caller is blocked until check-in.
  • If the secret requires approval, the call returns 403 until an approver grants access.
Treat credentials returned from this endpoint as ephemeral. Don’t write them to disk, log them, or cache them beyond the lifetime of the operation that needed them. The point of using ACB is so credentials never live anywhere outside the secrets vault and the in-memory consumer context.

Response shape varies by SecretType

The response includes only the fields relevant to the secret’s typedomain for ADAccount, server for Unix/MSSQL, computer_name for WindowsAccount, url for WebAccount, ssh_key for UnixAccountSSH with key auth, etc.

Rate limit

60 requests per minute per Access Token. This is intentionally higher than other endpoints — credential retrieval is the highest-volume API operation.

Errors

See Status codes. Common errors:
  • 403 Forbidden — user lacks PAM User role, OR the secret requires approval and hasn’t been approved.
  • 404 Not Found — secret doesn’t exist.
  • 409 Conflict — secret is currently checked out by another user (when check-out is enabled).

Get secret

Read metadata without retrieving credentials.

Get secret details (old)

Pre-v1.3 equivalent.

Rotate password

Trigger rotation after retrieval if policy requires.

Force check-in

Release a checked-out secret.

Authorizations

Authorization
string
header
required

Access token for authentication

Path Parameters

id
integer<int32>
required

The ID of the secret to retrieve credentials for

Required range: x >= 1

Response

Secret credentials retrieved successfully

id
integer<int32>
required

Unique identifier of the secret

name
string
required

Name of the secret

type
enum<string>
required

Type of secret

Available options:
None,
UnixAccountSSH,
UnixAccountTelnet,
WindowsAccount,
ADAccount,
WebAccount,
MSSQLAccount
login
string
required

Login username

description
string

Description of the secret

password
string

The password value

ssh_key
object
domain
string

Domain for AD accounts

computer_name
string

Computer name for Windows/Unix accounts

url
string

URL for web accounts

server
string

Server for database accounts