Configure Connection
CyberArk PAM guide
Arrange PAM API access, configure tenant credentials in NIM, and validate account data and intended Safe access changes.
Before you beginDirect link to Before you begin
Follow the vendor's PAM Self-Hosted REST API documentation with your CyberArk administrator. Confirm that your environment and license allow API access and that the integration account can authenticate and perform the required operations.
NIM requires Tenant URL, Username, and Password.
Obtain tenant and account credentialsDirect link to Obtain tenant and account credentials
- Use the vendor documentation to arrange API access for the intended PAM environment.
- Obtain the Tenant URL and the integration account's Username and Password.
- Confirm read permissions for accounts, Safes, and Safe members needed for auditing.
- Arrange permissions for intended Safe creation or deletion and membership changes, and store credentials securely.
Enter the connection settingsDirect link to Enter the connection settings
- In NIM Studio, open Systems > Overview and add a CyberArk PAM system, or select the existing system.
- Open Connection, enter the following settings, and save.
| NIM setting | Value |
|---|---|
| Tenant URL | The PAM API tenant address for your environment, using the format expected by the Connection screen. |
| Username | The account authorized for API access. |
| Password | The corresponding account password. |
Test account retrievalDirect link to Test account retrieval
-
Select Test Connection. NIM attempts to retrieve accounts using:
GET /PasswordVault/API/Accounts?offset=0&limit=1 -
If the test fails, verify the Tenant URL, account credentials, network access, and account read permissions with your administrator.
-
Collect accounts, Safes, and Safe members needed by your process and validate identity matching and access relationships.
-
Test each intended Safe or membership change with safe test records before enabling automation.
The connection test checks account retrieval. Validate Safe and membership collection permissions and each intended write operation separately.