Skip to main content
POST
Check secret password (Heartbeat)
NEW in ACB v1.4. Not available in v1.3 and earlier. Confirm your installed ACB version supports this endpoint before scripting against it.
Triggers a heartbeat check — Syteca attempts to authenticate against the target endpoint using the stored password to verify the password is still valid. Does not modify the password. Use this to detect drift between Syteca and the target system (when a sysadmin changed a service-account password outside of Syteca, or when a target system reset the password during a security incident).
For ACB deployments updated from a version prior to 1.2, switch to the https://{hostname}/EkranACB server in the Playground.

Permissions required

The user owning the Access Token must have Editor or Owner role on the secret.

Status values returned

The response includes a check_password_status field with one of four PasswordCheckStatus values:
  • None — No check has been performed yet.
  • Valid — The password is valid on the target endpoint.
  • Invalid — The password is not valid (drift detected — consider rotating).
  • Failed — The check itself failed (target unreachable, network error, etc.).
Scheduled heartbeat checks — rather than calling this endpoint manually, configure the secret with check_password: { enabled: true, check_every: 1, check_period_type: "Hour" } via Add secret or Update secret. Syteca then runs heartbeat checks automatically on schedule, and you read the result from the check_password_status field on GET /api/secrets/{id}.Use the manual heartbeat endpoint for on-demand verification — after suspected drift, after a target-system maintenance window, or as part of an incident-response playbook.

Errors

  • 403 Forbidden — user lacks Editor/Owner role.
  • 404 Not Found — secret doesn’t exist.
See Status codes for the full mapping.

Get secret

Read scheduled heartbeat results via check_password_status.

Rotate password

If heartbeat returns Invalid, rotate to fix drift.

Data models — CheckPassword

Schedule heartbeat checks per secret.

Data models — status enum

PasswordCheckStatus values.

Authorizations

Authorization
string
header
required

Access token for authentication

Path Parameters

id
integer<int32>
required

The ID of the secret to check

Required range: x >= 1

Response

Heartbeat check completed successfully

check_password_status
enum<string>
required

Status of the last password check (heartbeat)

Available options:
None,
Valid,
Invalid,
Failed