Skip to main content

​
Privileged access automation, without picking a different PAM product to get it

Most PAM platforms expose two interfaces: a human-operated console for day-to-day secret use, and a REST API for automation. The quality of the second one is where buying decisions often turn - because the modern usage pattern isn’t “an admin logs in to copy a password,” it’s “the CI pipeline retrieves the production database credential at deploy time,” or “the CMDB rotates 4,000 service account passwords on a quarterly schedule.” If the API is thin or undocumented, automation teams end up building shadow vaults - defeating the purpose of having centralized PAM. Syteca’s Application Credentials Broker (ACB) is a stand-alone REST API service that exposes the same secret-management capabilities that Syteca Connection Manager users see in the UI - get, add, update, delete secrets and folders; rotate passwords; force check-in; manage permissions; bulk-create. It runs alongside the Syteca Application Server, uses the same credentials database, and inherits the same role-based permission model. Same product, same license, no separate connector tiers.
Use the Syteca ACB API when you need to:
  • Retrieve secrets from CI/CD pipelines - Jenkins, GitHub Actions, GitLab CI fetch the deploy-time credentials they need at runtime, never store them in pipeline config.
  • Onboard secrets in bulk - migrate from a spreadsheet, CSV export, or another PAM product via the BulkAdd endpoint.
  • Trigger password rotation programmatically - from your CMDB, ITSM, or quarterly compliance workflow.
  • Verify password validity via heartbeat checks - confirm rotated passwords still work on the target endpoint without manual testing.
  • Manage users and permissions programmatically - provision Syteca users from your IdP, sync user groups from Active Directory automation.
  • Rotate the default admin password from your secrets vault - meet compliance requirements for built-in-admin password lifecycle.
  • Integrate Syteca PAM with custom security tooling - SOAR playbooks, custom service desk workflows, in-house automation.
Pair it with Account Discovery for end-to-end automation: discover privileged accounts, onboard them via ACB BulkAdd, schedule rotation through ACB endpoints - without manual touch.
NOT AVAILABLE IN SAAS. ACB is a stand-alone component installed alongside an on-premises Syteca Application Server. SaaS customers should contact their Syteca vendor for SaaS-equivalent automation options.

​
The API surface

The ACB API is split into four logical groups: For the complete endpoint list with HTTP signatures, see API reference.

​
How authentication works

Two authentication models, depending on which endpoint generation you’re calling: The Refresh Token is generated per Management Tool user, on the Manage Account page when the user has been configured for external-application use. Access Tokens have configurable lifetimes (default 600 seconds; 0 means never expires). See API reference → Authentication for the full mechanics.

​
Architecture

​
What’s in this guide

Install ACB

System requirements, MSI install, version compatibility matrix.

API reference

Base URL, authentication, status codes, rate limiting, endpoint list.

Data models

Request and response schemas shared across endpoints.

CLI reference

SytecaACBConsole.exe - command-line wrapper for scripting.