--- title: "BeyondTrust Password Safe MCP server - actionlake" description: "Give Claude 272 BeyondTrust Password Safe actions through one MCP server: secrets safe. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/beyondtrust-password-safe updated: 2026-10-23 --- Connectors · Identity & security # BeyondTrust Password Safe MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to BeyondTrust Password Safe and the rest of your systems. It gives your agent 272 BeyondTrust Password Safe actions (131 reads, 77 writes and 64 that wait for a confirmation) and holds the BeyondTrust Password Safe credential itself, so the agent never does. It paces BeyondTrust Password Safe's limits and records every call. [Connect BeyondTrust Password Safe free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "beyondtrust_password_safe.users.list", intent: "check which BeyondTrust Password Safe account is connected" } # Get users · read · 1 upstream call ``` - 272 actions in one signed file - 131 read look, never change - 77 write create and update - 64 wait for a yes destructive, confirmed first Set up ## Connect BeyondTrust Password Safe in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect BeyondTrust Password Safe. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Client ID of a BeyondInsight Application user - `client_secret` Client secret of that Application user (it can be recycled with users.recycleclientsecret) - `host` Where your BeyondTrust Password Safe lives: your host ``` account { op: "connections.requirements", service: "beyondtrust_password_safe" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "beyondtrust_password_safe.users.list" } # get users · read · 1 upstream call check { action: "beyondtrust_password_safe.users.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` BeyondTrust Password Safe at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `host` **Limits we pace to** 300 calls a minute, per connection **API covered** BeyondInsight and Password Safe public API v3 (OpenAPI 3.0 fragments per operation), at your BeyondTrust Password Safe instance's API base URL, which you enter when connecting (path /BeyondTrust/api/public/v3) **Built from** BeyondTrust Password Safe's documentation, read 23 October 2026[docs.beyondtrust.com](https://docs.beyondtrust.com/bips/reference/introduction) [docs.beyondtrust.com](https://docs.beyondtrust.com/bips/reference/beyondinsight-and-password-safe-api-usage) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 91 of 131 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 4, so ask can line BeyondTrust Password Safe up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in BeyondTrust Password Safe. 272 actions in 49 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **131** read look, never change - **77** write create and update - **64** destructive wait for a confirmation 1. ### Secrets safe 35 16 read · 13 write · 6 destructive Create folder · Create credential secret · Create text secret · Create safe 2. ### Managedaccounts 27 8 read · 7 write · 12 destructive Assign application to managed account · Assign attribute to managed account · Assign propagation actions to managed account · Create Synced Account 3. ### Managedsystems 20 5 read · 5 write · 10 destructive Assign attribute to managed system · Create Linked Account · Create Managed Account in Managed System · Get Managed Systems 4. ### Usergroups 15 6 read · 5 write · 4 destructive Get user groups · Create new user group · Get user group · Delete user group by ID 5. ### Quickrules 13 4 read · 5 write · 4 destructive Create Quick Rule · Add Managed Account to Quick Rule · Add Managed System to Quick Rule · Get all Quick Rules 6. ### Assets 12 5 read · 4 write · 3 destructive Search assets · Get by ID · Update asset · Delete by ID 7. ### Users 11 3 read · 3 write · 5 destructive Get users · Create user account · Get User · Update user 8. ### Workgroups 11 5 read · 5 write · 1 destructive Create workgroup · Create asset workgroup by ID · Create asset workgroup by name · Create directory in workgroup **41 more areas · 128 actions** - Smartrules **10** - Addressgroups **8** - Organizations **8** - Apiregistrations **7** - Requests **7** - Attributetypes **6** - Databases **6** - Directories **6** - Sessions **6** - Functionalaccounts **5** - Aliases **4** - Customplatforms **4** - Oracleinternetdirectories **4** - PBSM **4** - Accesspolicies **3** - Addresses **3** - Keystrokes **3** - Applications **2** - Attributes **2** - Credentials **2** - Dsskeyrules **2** - Entitytypes **2** - Passwordrules **2** - Platforms **2** - Propagationactions **2** - Requestsets **2** - Useraudits **2** - Accesslevels **1** - Auth **1** - Configuration **1** - Entitlements **1** - Epmpolicies **1** - Isarequests **1** - Isasessions **1** - Nodes **1** - Operatingsystems **1** - Permissions **1** - Propagationactiontypes **1** - Roles **1** - Subscriptions **1** - Ticketsystems **1** Top actions ## The BeyondTrust Password Safe API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 15 of BeyondTrust Password Safe's 15 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `beyondtrust_password_safe.users.list` Get users | Get users. | read | `identity.user.list` 474 connectors | | `beyondtrust_password_safe.usergroups.list` Get user groups | Get user groups. | read | `identity.group.list` 262 connectors | | `beyondtrust_password_safe.roles.list` Get all roles | Get all roles. | read | `identity.role.list` 184 connectors | | `beyondtrust_password_safe.users.create` Create user account | Create user account. | write | `identity.user.create` 262 connectors | | `beyondtrust_password_safe.usergroups.create` Create new user group | Create new user group. | write | `identity.group.create` 205 connectors | | `beyondtrust_password_safe.users.update` Update user | Update user. | write | `identity.user.update` 280 connectors | | `beyondtrust_password_safe.users.delete` Delete user | Delete user. | destructive | `identity.user.delete` 253 connectors | | `beyondtrust_password_safe.usergroups.list_users` Get all users in group | Get all users in group. | read | `identity.group_member.list` 103 connectors | | `beyondtrust_password_safe.assets.search` Search assets | Search assets. | read | `asset.asset.search` 6 connectors | | `beyondtrust_password_safe.assets.get` Get by ID | Get by ID. | read | `asset.asset.get` 40 connectors | | `beyondtrust_password_safe.nodes.list` Get all Nodes | Get all Nodes. | read | this connector | | `beyondtrust_password_safe.aliases.list` Get requestable managed account aliases | Get requestable managed account aliases. | read | this connector | Try it ## Prompts to paste into Claude. Each one names the BeyondTrust Password Safe actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in BeyondTrust Password Safe? List every user and their role. calls `beyondtrust_password_safe.users.list` 2. Write write Create user account in BeyondTrust Password Safe. Show me exactly what you will send before you save it. calls `beyondtrust_password_safe.users.create` Governance for BeyondTrust Password Safe ## Destructive actions wait for a yes. 64 BeyondTrust Password Safe actions are destructive. The first 10: - Delete user `beyondtrust_password_safe.users.delete` - Delete user group by ID `beyondtrust_password_safe.usergroups.delete_by_id` - Delete by ID `beyondtrust_password_safe.assets.delete` - Delete address by ID `beyondtrust_password_safe.addresses.delete` - Delete database by ID `beyondtrust_password_safe.databases.delete` - Quarantine user `beyondtrust_password_safe.users.quarantine` - Delete attribute `beyondtrust_password_safe.attributes.delete` - Delete directory by ID `beyondtrust_password_safe.directories.delete` - Terminates the replay session `beyondtrust_password_safe.pbsm.delete_replay` - Delete address group `beyondtrust_password_safe.addressgroups.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do beyondtrust_password_safe.users.delete confirm_policy: **human** Delete user? **intent:** the user asked me to delete user run suspended · waiting for a named person · key _beyondtrust-password-safe-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "beyondtrust-password-safe-agent", allowed_actions: ["beyondtrust_password_safe.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "beyondtrust_password_safe.users.delete", approver: "lead@example.com" }, { match: "beyondtrust_password_safe.usergroups.delete_by_id", approver: "lead@example.com" }, { match: "beyondtrust_password_safe.assets.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to BeyondTrust Password Safe only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What BeyondTrust Password Safe costs on actionlake. Every BeyondTrust Password Safe action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call BeyondTrust Password Safe refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 272 BeyondTrust Password Safe actions - 272 actions page each page of a long list is one call - 91 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every BeyondTrust Password Safe action. 272 actions by area: the id your agent calls, what it does, and its effect. **Secrets safe 35** - `beyondtrust_password_safe.secrets_safe.create_folders` Create folder write - `beyondtrust_password_safe.secrets_safe.create_folders_secrets` Create credential secret write - `beyondtrust_password_safe.secrets_safe.create_folders_secrets_text` Create text secret write - `beyondtrust_password_safe.secrets_safe.create_safes` Create safe write - `beyondtrust_password_safe.secrets_safe.create_secrets_shares` Share secret to folder by ID write - `beyondtrust_password_safe.secrets_safe.delete_folders` Delete folder by ID destructive - `beyondtrust_password_safe.secrets_safe.delete_safes` Delete safe by ID destructive - `beyondtrust_password_safe.secrets_safe.delete_safes_safe_permissions` Revoke safe permissions by ID destructive - `beyondtrust_password_safe.secrets_safe.delete_secrets` Delete secret destructive - `beyondtrust_password_safe.secrets_safe.delete_secrets_shares_by_folder_id` Delete share destructive - `beyondtrust_password_safe.secrets_safe.delete_secrets_shares_by_secret_id` Delete all shares of secret destructive - `beyondtrust_password_safe.secrets_safe.folders_move` Move folder write - `beyondtrust_password_safe.secrets_safe.get_folders` Get folder by ID read - `beyondtrust_password_safe.secrets_safe.get_safes` Get safe by ID read - `beyondtrust_password_safe.secrets_safe.get_secret_file_metadata` Get file secret by ID read - `beyondtrust_password_safe.secrets_safe.get_secret_text` Get text secret by ID read - `beyondtrust_password_safe.secrets_safe.get_secret_totp_code` Get the current one-time (TOTP) code for a credential secret read - `beyondtrust_password_safe.secrets_safe.get_secrets` Get credential secret by ID read - `beyondtrust_password_safe.secrets_safe.get_secrets_password_versions` Get historical password value for a specific version read - `beyondtrust_password_safe.secrets_safe.get_secrets_text_versions` Get historical text value for a specific version read - `beyondtrust_password_safe.secrets_safe.get_secrets_versions` Get secret version history read - `beyondtrust_password_safe.secrets_safe.list_folders` Get all folders read - `beyondtrust_password_safe.secrets_safe.list_folders_secrets` Get all secrets by folder ID read - `beyondtrust_password_safe.secrets_safe.list_safes` Get all safes accessible to current user read - `beyondtrust_password_safe.secrets_safe.list_safes_safe_permissions_all` Get all possible safe permissions read - `beyondtrust_password_safe.secrets_safe.list_safes_safe_permissions_by_id` Get permissions assigned to safe read - `beyondtrust_password_safe.secrets_safe.list_secrets` Get all secrets read - `beyondtrust_password_safe.secrets_safe.list_secrets_shares` Get all shares of secret read - `beyondtrust_password_safe.secrets_safe.secrets_move` Move secrets and shares to folder write - `beyondtrust_password_safe.secrets_safe.secrets_versions_rollback` Rollback secret to a previous version write - `beyondtrust_password_safe.secrets_safe.update_folders` Update folder write - `beyondtrust_password_safe.secrets_safe.update_safes` Update safe by ID write - `beyondtrust_password_safe.secrets_safe.update_safes_safe_permissions` Update safe permissions by ID write - `beyondtrust_password_safe.secrets_safe.update_secrets` Update credential secret write - `beyondtrust_password_safe.secrets_safe.update_secrets_text` Update text secret write **Managedaccounts 27** - `beyondtrust_password_safe.managedaccounts.create_applications` Assign application to managed account write - `beyondtrust_password_safe.managedaccounts.create_attributes` Assign attribute to managed account write - `beyondtrust_password_safe.managedaccounts.create_propagationactions` Assign propagation actions to managed account write - `beyondtrust_password_safe.managedaccounts.create_syncedaccounts` Create Synced Account write - `beyondtrust_password_safe.managedaccounts.credentials_change` Change managed account credentials write - `beyondtrust_password_safe.managedaccounts.credentials_test` Test managed account credentials read - `beyondtrust_password_safe.managedaccounts.delete` Delete Managed Account destructive - `beyondtrust_password_safe.managedaccounts.delete_applications_by_application_id` Remove application from managed account destructive - `beyondtrust_password_safe.managedaccounts.delete_applications_by_managed_account_id` Remove all applications from managed account destructive - `beyondtrust_password_safe.managedaccounts.delete_attributes_by_attribute_id` Delete attribute from managed account destructive - `beyondtrust_password_safe.managedaccounts.delete_attributes_by_managed_account_id` Delete all attributes from managed account destructive - `beyondtrust_password_safe.managedaccounts.delete_propagationactions_by_managed_account_id` Unassign propagation actions from managed account destructive - `beyondtrust_password_safe.managedaccounts.delete_propagationactions_by_propagation_action_id` Unassign propagation action from managed account destructive - `beyondtrust_password_safe.managedaccounts.delete_syncedaccounts_by_id` Remove all Synced Accounts by Managed Account destructive - `beyondtrust_password_safe.managedaccounts.delete_syncedaccounts_by_synced_account_id` Remove Synced Account destructive - `beyondtrust_password_safe.managedaccounts.get` Get Managed Account read - `beyondtrust_password_safe.managedaccounts.get_credentials` Get credentials by Managed Account ID read - `beyondtrust_password_safe.managedaccounts.list` Get Requestable Managed Account(s) read - `beyondtrust_password_safe.managedaccounts.list_applications` Get applications by managed account ID read - `beyondtrust_password_safe.managedaccounts.list_attributes` Get attributes for managed account read - `beyondtrust_password_safe.managedaccounts.list_propagationactions` Get managed account propagation actions read - `beyondtrust_password_safe.managedaccounts.list_syncedaccounts` Get Synced Accounts by Managed Account read - `beyondtrust_password_safe.managedaccounts.requests_terminate` Terminate requests by managed account ID destructive - `beyondtrust_password_safe.managedaccounts.sessions_lock` Lock active Sessions by Managed Account destructive - `beyondtrust_password_safe.managedaccounts.sessions_terminate` Terminate active Sessions by Managed Account destructive - `beyondtrust_password_safe.managedaccounts.update` Update Managed Account write - `beyondtrust_password_safe.managedaccounts.update_credentials` Update managed account credentials by ID write **Managedsystems 20** - `beyondtrust_password_safe.managedsystems.create_attributes` Assign attribute to managed system write - `beyondtrust_password_safe.managedsystems.create_linkedaccounts` Create Linked Account write - `beyondtrust_password_safe.managedsystems.create_managedaccounts` Create Managed Account in Managed System write - `beyondtrust_password_safe.managedsystems.delete` Delete Managed System destructive - `beyondtrust_password_safe.managedsystems.delete_attributes_by_attribute_id` Delete attribute from managed system destructive - `beyondtrust_password_safe.managedsystems.delete_attributes_by_managed_system_id` Delete all attributes from managed system destructive - `beyondtrust_password_safe.managedsystems.delete_linkedaccounts_by_directory_account_id` Remove Linked Account destructive - `beyondtrust_password_safe.managedsystems.delete_linkedaccounts_by_managed_system_id` Remove all Linked Accounts by Managed System destructive - `beyondtrust_password_safe.managedsystems.delete_managedaccounts_by_account_name` Delete Managed Account by Managed System ID and Managed Account name destructive - `beyondtrust_password_safe.managedsystems.delete_managedaccounts_by_managed_system_id` Delete all Managed Accounts by Managed System destructive - `beyondtrust_password_safe.managedsystems.get` Get Managed System read - `beyondtrust_password_safe.managedsystems.list` Get Managed Systems read - `beyondtrust_password_safe.managedsystems.list_attributes` Get attributes for managed system read - `beyondtrust_password_safe.managedsystems.list_linkedaccounts` Get Linked Accounts by Managed System read - `beyondtrust_password_safe.managedsystems.list_managedaccounts` Get Managed Account(s) by Managed System read - `beyondtrust_password_safe.managedsystems.managedaccounts_credentials_change` Update all managed account credentials by Managed System ID write - `beyondtrust_password_safe.managedsystems.requests_terminate` Terminate requests by managed system ID destructive - `beyondtrust_password_safe.managedsystems.sessions_lock` Lock active Sessions by Managed System destructive - `beyondtrust_password_safe.managedsystems.sessions_terminate` Terminate active Sessions by Managed System destructive - `beyondtrust_password_safe.managedsystems.update` Update Managed System write **Usergroups 15** - `beyondtrust_password_safe.usergroups.create` Create new user group write - `beyondtrust_password_safe.usergroups.create_permissions` Assign permissions to user group write - `beyondtrust_password_safe.usergroups.create_smartrules_accesslevels` Create access level assignment write - `beyondtrust_password_safe.usergroups.create_smartrules_roles` Assign role to user group and smart rule write - `beyondtrust_password_safe.usergroups.create_users` Create user in group write - `beyondtrust_password_safe.usergroups.delete_all` Delete user group by name destructive - `beyondtrust_password_safe.usergroups.delete_by_id` Delete user group by ID destructive - `beyondtrust_password_safe.usergroups.delete_permissions` Delete all permissions for user group destructive - `beyondtrust_password_safe.usergroups.delete_smartrules_roles` Remove role from user group and smart rule destructive - `beyondtrust_password_safe.usergroups.get` Get user group read - `beyondtrust_password_safe.usergroups.list` Get user groups read - `beyondtrust_password_safe.usergroups.list_permissions` Get all permissions for user group read - `beyondtrust_password_safe.usergroups.list_smartrules` Get all Smart Rules for user group and access level read - `beyondtrust_password_safe.usergroups.list_smartrules_roles` Get roles assigned to user group and smart rule read - `beyondtrust_password_safe.usergroups.list_users` Get all users in group read **Quickrules 13** - `beyondtrust_password_safe.quickrules.create` Create Quick Rule write - `beyondtrust_password_safe.quickrules.create_managedaccounts` Add Managed Account to Quick Rule write - `beyondtrust_password_safe.quickrules.create_managedsystems` Add Managed System to Quick Rule write - `beyondtrust_password_safe.quickrules.delete_all` Delete Quick Rule by title destructive - `beyondtrust_password_safe.quickrules.delete_by_id` Delete Quick Rule by ID destructive - `beyondtrust_password_safe.quickrules.delete_managedaccounts` Remove Managed Account from Quick Rule destructive - `beyondtrust_password_safe.quickrules.delete_managedsystems` Remove Managed System from Quick Rule destructive - `beyondtrust_password_safe.quickrules.get` Get Quick Rule by ID read - `beyondtrust_password_safe.quickrules.list` Get all Quick Rules read - `beyondtrust_password_safe.quickrules.list_managedaccounts` Get Managed Accounts by Quick Rule read - `beyondtrust_password_safe.quickrules.list_managedsystems` Get Managed Systems by Quick Rule read - `beyondtrust_password_safe.quickrules.update_managedaccounts` Update Quick Rule Managed Accounts write - `beyondtrust_password_safe.quickrules.update_managedsystems` Update Quick Rule Managed Systems write **Assets 12** - `beyondtrust_password_safe.assets.create_attributes` Assign attribute to asset write - `beyondtrust_password_safe.assets.create_databases` Create database for asset write - `beyondtrust_password_safe.assets.create_managedsystems` Create Asset-based Managed System write - `beyondtrust_password_safe.assets.delete` Delete by ID destructive - `beyondtrust_password_safe.assets.delete_attributes_by_asset_id` Delete all attributes for asset destructive - `beyondtrust_password_safe.assets.delete_attributes_by_attribute_id` Delete attribute from asset destructive - `beyondtrust_password_safe.assets.get` Get by ID read - `beyondtrust_password_safe.assets.get_managedsystems` Get Managed System by Asset read - `beyondtrust_password_safe.assets.list_attributes` Get all attributes for asset read - `beyondtrust_password_safe.assets.list_databases` Get all databases by asset ID read - `beyondtrust_password_safe.assets.search` Search assets read - `beyondtrust_password_safe.assets.update` Update asset write **Users 11** - `beyondtrust_password_safe.users.create` Create user account write - `beyondtrust_password_safe.users.create_usergroups` Add user to user group write - `beyondtrust_password_safe.users.delete` Delete user destructive - `beyondtrust_password_safe.users.delete_usergroups` Remove user from user group destructive - `beyondtrust_password_safe.users.get` Get User read - `beyondtrust_password_safe.users.list` Get users read - `beyondtrust_password_safe.users.list_usergroups` Get user groups for user read - `beyondtrust_password_safe.users.quarantine` Quarantine user destructive - `beyondtrust_password_safe.users.recycle_client_secret` Generate OAuth client secret for user destructive - `beyondtrust_password_safe.users.requests_terminate` Terminate requests by requestor user ID destructive - `beyondtrust_password_safe.users.update` Update user write **Workgroups 11** - `beyondtrust_password_safe.workgroups.create` Create workgroup write - `beyondtrust_password_safe.workgroups.create_assets_by_workgroup_id` Create asset workgroup by ID write - `beyondtrust_password_safe.workgroups.create_assets_by_workgroup_name` Create asset workgroup by name write - `beyondtrust_password_safe.workgroups.create_directories` Create directory in workgroup write - `beyondtrust_password_safe.workgroups.create_managedsystems` Create Managed System in Workgroup write - `beyondtrust_password_safe.workgroups.delete_assets` Delete by workgroup and asset name destructive - `beyondtrust_password_safe.workgroups.get` Get workgroup by ID read - `beyondtrust_password_safe.workgroups.list` Get workgroups by name read - `beyondtrust_password_safe.workgroups.list_assets_by_workgroup_id` Get all assets by workgroup ID read - `beyondtrust_password_safe.workgroups.list_assets_by_workgroup_name` Get all assets by workgroup name read - `beyondtrust_password_safe.workgroups.list_managedsystems` Get Managed Systems by Workgroup read **Smartrules 10** - `beyondtrust_password_safe.smartrules.delete_all` Delete Smart Rule by title destructive - `beyondtrust_password_safe.smartrules.delete_by_id` Delete Smart Rule by ID destructive - `beyondtrust_password_safe.smartrules.filter_asset_attribute` Create asset filtering Smart Rule write - `beyondtrust_password_safe.smartrules.filter_managed_account_attribute` Create Managed Account Smart Rule from Assigned Attributes and an optional Smart Group write - `beyondtrust_password_safe.smartrules.get` Get Smart Rule by ID read - `beyondtrust_password_safe.smartrules.list` Get Smart Rules read - `beyondtrust_password_safe.smartrules.list_assets` Get all assets by Smart Rule ID read - `beyondtrust_password_safe.smartrules.list_managedaccounts` Get Managed Accounts by Smart Rule read - `beyondtrust_password_safe.smartrules.list_managedsystems` Get Managed Systems by Smart Rule read - `beyondtrust_password_safe.smartrules.process` Process Smart Rule write **Addressgroups 8** - `beyondtrust_password_safe.addressgroups.create` Create address group write - `beyondtrust_password_safe.addressgroups.create_addresses` Create address within address group write - `beyondtrust_password_safe.addressgroups.delete` Delete address group destructive - `beyondtrust_password_safe.addressgroups.delete_addresses` Delete address by group ID destructive - `beyondtrust_password_safe.addressgroups.get` Get address group by ID read - `beyondtrust_password_safe.addressgroups.list` Get address groups read - `beyondtrust_password_safe.addressgroups.list_addresses` Get all addresses in address group read - `beyondtrust_password_safe.addressgroups.update` Update address group write **Organizations 8** - `beyondtrust_password_safe.organizations.delete_quickrules` Delete Quick Rule by organization and title destructive - `beyondtrust_password_safe.organizations.delete_smartrules` Delete Smart Rule by organization ID and title destructive - `beyondtrust_password_safe.organizations.get` Get organization by ID read - `beyondtrust_password_safe.organizations.get_quickrules` Get Quick Rule by organization and title read - `beyondtrust_password_safe.organizations.get_smartrules` Get Smart Rule by organization ID and title read - `beyondtrust_password_safe.organizations.list` Get organizations read - `beyondtrust_password_safe.organizations.list_addressgroups` Get address groups for organization ID read - `beyondtrust_password_safe.organizations.list_oracleinternetdirectories` Get Oracle Internet Directories by organization read **Apiregistrations 7** - `beyondtrust_password_safe.apiregistrations.create` Create API registration write - `beyondtrust_password_safe.apiregistrations.delete` Delete API registration destructive - `beyondtrust_password_safe.apiregistrations.get` Get API registration by ID read - `beyondtrust_password_safe.apiregistrations.get_key` Get API key by ID read - `beyondtrust_password_safe.apiregistrations.list` Get all API registrations read - `beyondtrust_password_safe.apiregistrations.rotate` Rotate API key by ID destructive - `beyondtrust_password_safe.apiregistrations.update` Update API registration write **Requests 7** - `beyondtrust_password_safe.requests.approve` Approve pending request write - `beyondtrust_password_safe.requests.checkin` Check-in/release request write - `beyondtrust_password_safe.requests.create` Create release request write - `beyondtrust_password_safe.requests.create_sessions` Create Session by Request write - `beyondtrust_password_safe.requests.deny` Deny/cancel pending request destructive - `beyondtrust_password_safe.requests.list` Get release requests read - `beyondtrust_password_safe.requests.rotateoncheckin` Update request to rotate credentials on check-in/expiry destructive **Attributetypes 6** - `beyondtrust_password_safe.attributetypes.create` Create attribute type write - `beyondtrust_password_safe.attributetypes.create_attributes` Create attribute write - `beyondtrust_password_safe.attributetypes.delete` Delete attribute type destructive - `beyondtrust_password_safe.attributetypes.get` Get attribute type by ID read - `beyondtrust_password_safe.attributetypes.list` Get all attribute types read - `beyondtrust_password_safe.attributetypes.list_attributes` Get attributes by type read **Databases 6** - `beyondtrust_password_safe.databases.create_managedsystems` Create Database-based Managed System write - `beyondtrust_password_safe.databases.delete` Delete database by ID destructive - `beyondtrust_password_safe.databases.get` Get database by ID read - `beyondtrust_password_safe.databases.get_managedsystems` Get Managed System by Database read - `beyondtrust_password_safe.databases.list` Get all databases read - `beyondtrust_password_safe.databases.update` Update database by ID write **Directories 6** - `beyondtrust_password_safe.directories.create_managedsystems` Get Managed System by Directory write - `beyondtrust_password_safe.directories.delete` Delete directory by ID destructive - `beyondtrust_password_safe.directories.get` Get directory by ID read - `beyondtrust_password_safe.directories.get_managedsystems` Get Managed System by Directory read - `beyondtrust_password_safe.directories.list` Get all directories read - `beyondtrust_password_safe.directories.update` Update directory by ID write **Sessions 6** - `beyondtrust_password_safe.sessions.admin` Create Admin Session write - `beyondtrust_password_safe.sessions.get` Get Session read - `beyondtrust_password_safe.sessions.list` Get Sessions read - `beyondtrust_password_safe.sessions.list_keystrokes` Get all keystrokes for session read - `beyondtrust_password_safe.sessions.lock` Lock active Session destructive - `beyondtrust_password_safe.sessions.terminate` Terminate active Session destructive **Functionalaccounts 5** - `beyondtrust_password_safe.functionalaccounts.create` Create functional account write - `beyondtrust_password_safe.functionalaccounts.delete` Delete functional account destructive - `beyondtrust_password_safe.functionalaccounts.get` Get functional account by ID read - `beyondtrust_password_safe.functionalaccounts.list` Get all functional accounts read - `beyondtrust_password_safe.functionalaccounts.list_managedsystems` Get Managed Systems by Functional Account read **Aliases 4** - `beyondtrust_password_safe.aliases.create_requests` Create release request using an alias write - `beyondtrust_password_safe.aliases.get` Get a requestable managed account alias read - `beyondtrust_password_safe.aliases.get_credentials` Get Credentials by Alias and Request ID read - `beyondtrust_password_safe.aliases.list` Get requestable managed account aliases read **Customplatforms 4** - `beyondtrust_password_safe.customplatforms.get` Get custom platform configuration by ID read - `beyondtrust_password_safe.customplatforms.get_export` Export custom platform configuration read - `beyondtrust_password_safe.customplatforms.import` Import custom platform configuration write - `beyondtrust_password_safe.customplatforms.list` Get all custom platform configurations read **Oracleinternetdirectories 4** - `beyondtrust_password_safe.oracleinternetdirectories.get` Get an Oracle Internet Directory by ID read - `beyondtrust_password_safe.oracleinternetdirectories.list` Get all Oracle Internet Directories read - `beyondtrust_password_safe.oracleinternetdirectories.services_query` Query Oracle Internet Directory DB services read - `beyondtrust_password_safe.oracleinternetdirectories.test` Test Oracle Internet Directory LDAP connection read **PBSM 4** - `beyondtrust_password_safe.pbsm.create_replay` Creates a new replay session for a specified session token. The session token can be discovered using the `sessions` endpoints write - `beyondtrust_password_safe.pbsm.delete_replay` Terminates the replay session destructive - `beyondtrust_password_safe.pbsm.get_replay` Displays the replay session details read - `beyondtrust_password_safe.pbsm.update_replay` Controls the replay session status write **Accesspolicies 3** - `beyondtrust_password_safe.accesspolicies.list` Get all access policies read - `beyondtrust_password_safe.accesspolicies.list_assignees` Get assignees for access policy read - `beyondtrust_password_safe.accesspolicies.test` Test access to managed account read **Addresses 3** - `beyondtrust_password_safe.addresses.delete` Delete address by ID destructive - `beyondtrust_password_safe.addresses.get` Get address by ID read - `beyondtrust_password_safe.addresses.update` Update address write **Keystrokes 3** - `beyondtrust_password_safe.keystrokes.get` Get keystroke by ID read - `beyondtrust_password_safe.keystrokes.search` Search keystrokes read - `beyondtrust_password_safe.keystrokes.search_by_condition` Searches keystroke records by condition and type (deprecated endpoint) read **Applications 2** - `beyondtrust_password_safe.applications.get` Get application by ID read - `beyondtrust_password_safe.applications.list` Get all applications read **Attributes 2** - `beyondtrust_password_safe.attributes.delete` Delete attribute destructive - `beyondtrust_password_safe.attributes.get` Get attribute by ID read **Credentials 2** - `beyondtrust_password_safe.credentials.get` Get credentials by Request ID read - `beyondtrust_password_safe.credentials.update_all` Update managed account credentials by Workgroup Name, Asset Name, and Account Name write **Dsskeyrules 2** - `beyondtrust_password_safe.dsskeyrules.get` Get DSS key rule by ID read - `beyondtrust_password_safe.dsskeyrules.list` Get all DSS key rules read **Entitytypes 2** - `beyondtrust_password_safe.entitytypes.list` Get all entity types read - `beyondtrust_password_safe.entitytypes.list_platforms` Get platforms by entity type ID read **Passwordrules 2** - `beyondtrust_password_safe.passwordrules.get` Get password rule by ID read - `beyondtrust_password_safe.passwordrules.list` Get all password rules by product read **Platforms 2** - `beyondtrust_password_safe.platforms.get` Get platform by ID read - `beyondtrust_password_safe.platforms.list` Get all platforms read **Propagationactions 2** - `beyondtrust_password_safe.propagationactions.get` Get propagation action by ID read - `beyondtrust_password_safe.propagationactions.list` Get all propagation actions read **Requestsets 2** - `beyondtrust_password_safe.requestsets.create` Create release request set write - `beyondtrust_password_safe.requestsets.list` Get request sets read **Useraudits 2** - `beyondtrust_password_safe.useraudits.list` Get user audits read - `beyondtrust_password_safe.useraudits.list_userauditdetails` Get user audit by ID read **Accesslevels 1** - `beyondtrust_password_safe.accesslevels.list` Get all access levels read **Auth 1** - `beyondtrust_password_safe.auth.sign_app_in` Sign in read **Configuration 1** - `beyondtrust_password_safe.configuration.get_version` Get current system version read **Entitlements 1** - `beyondtrust_password_safe.entitlements.list` Get user entitlements read **Epmpolicies 1** - `beyondtrust_password_safe.epmpolicies.epmapplications_add` Add Application to EPM policy group write **Isarequests 1** - `beyondtrust_password_safe.isarequests.create` Create ISA request write **Isasessions 1** - `beyondtrust_password_safe.isasessions.create` Create ISA session write **Nodes 1** - `beyondtrust_password_safe.nodes.list` Get all Nodes read **Operatingsystems 1** - `beyondtrust_password_safe.operatingsystems.list` Get all operating systems read **Permissions 1** - `beyondtrust_password_safe.permissions.list` Get all permissions read **Propagationactiontypes 1** - `beyondtrust_password_safe.propagationactiontypes.list` Get all propagation action types read **Roles 1** - `beyondtrust_password_safe.roles.list` Get all roles read **Subscriptions 1** - `beyondtrust_password_safe.subscriptions.list_delivery` Get subscription delivery identifiers read **Ticketsystems 1** - `beyondtrust_password_safe.ticketsystems.list` Get all configured ticket systems read Questions ## The BeyondTrust Password Safe MCP server, answered. **Is there a BeyondTrust Password Safe MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 272 BeyondTrust Password Safe actions across secrets safe, managedaccounts, managedsystems and usergroups, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by BeyondTrust Password Safe. **What do I need to connect BeyondTrust Password Safe?** Client ID of a BeyondInsight Application user and Client secret of that Application user (it can be recycled with users.recycleclientsecret). Plus your host. The free call account { op: "connections.requirements", service: "beyondtrust_password_safe" } lists exactly what to paste. **Can an AI agent delete or change things in BeyondTrust Password Safe?** Only if its key allows it, and only with an explicit confirmation. 64 BeyondTrust Password Safe actions are destructive, including delete user, delete user group by ID and delete by ID. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my BeyondTrust Password Safe API limit?** actionlake paces every call to the limits in the BeyondTrust Password Safe service file: 300 calls a minute per connection. Repeated reads are answered from cache (91 BeyondTrust Password Safe actions can be), which never reaches BeyondTrust Password Safe. **What does a BeyondTrust Password Safe action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (272 BeyondTrust Password Safe actions page). Cache hits, searches, dry runs and calls BeyondTrust Password Safe refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which BeyondTrust Password Safe API does it cover?** The BeyondInsight and Password Safe public API v3 (OpenAPI 3.0 fragments per operation) at your BeyondTrust Password Safe instance's API base URL, which you enter when connecting (path /BeyondTrust/api/public/v3). It is built from BeyondTrust Password Safe's documentation as read on 23 October 2026. 272 actions in 49 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my BeyondTrust Password Safe data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your BeyondTrust Password Safe credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like BeyondTrust Password Safe Shares the most action names with - [Keycloak Admin REST API 11](https://actionlake.com/connectors/keycloak-admin-rest-api) - [Bitwarden 10](https://actionlake.com/connectors/bitwarden) - [Zscaler Internet Access (ZIA) 8](https://actionlake.com/connectors/zscaler-internet-access-zia) - [Cloudflare 8](https://actionlake.com/connectors/cloudflare) - [SailPoint Identity Security Cloud 8](https://actionlake.com/connectors/sailpoint-identity-security-cloud) - [Mimecast 7](https://actionlake.com/connectors/mimecast) Joins with, on shared entities - [HaloPSA 4](https://actionlake.com/connectors/halopsa) - [Motive 4](https://actionlake.com/connectors/motive) - [ServiceNow 3](https://actionlake.com/connectors/servicenow) - [Fortinet FortiGate 3](https://actionlake.com/connectors/fortinet-fortigate) - [Genesys Cloud CX 3](https://actionlake.com/connectors/genesys-cloud-cx) - [Commvault Cloud 3](https://actionlake.com/connectors/commvault-cloud) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by BeyondTrust Password Safe; the name is the vendor's own. Counts are from the BeyondTrust Password Safe service file, version 1.0.0. ## Give your agent BeyondTrust Password Safe today. [Connect BeyondTrust Password Safe free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/beyondtrust-password-safe More: https://actionlake.com/llms.txt