Documentation
CyberArk
Connecting REAP to CyberArk (opens in a new tab): prerequisites, permissions, setup, what is read and written, troubleshooting.
Overview
Connectors retrieve device credentials from CyberArk (opens in a new tab) at time of use so that no standing device credentials are held in REAP.
Prerequisites
- CyberArk (opens in a new tab) PAM with Central Credential Provider (CCP) or Application Access Manager reachable from the connector cluster supported interface
- A safe containing the read-only device account(s)
Permissions requested
| Scope | Permission | Why |
|---|---|---|
| Retrieve | Application identity permitted to retrieve from the REAP safe | Credential brokering |
| Runbooks (optional) | Second safe with the scoped write account | Approved runbooks only |
Setup
- Create the safe and add the read-only account(s).
- Define the application identity for the connector (certificate or allowed machines).
- Configure safe, folder and object names in the connector; test retrieval.
- Enable session recording per your policy (unchanged by REAP).
What REAP reads
- Credentials at time of use; nothing else
What REAP writes
- Nothing; REAP does not write to CyberArk (opens in a new tab)
Troubleshooting
| Symptom | Likely cause | Check |
|---|---|---|
| Retrieval denied | Application identity not authorized on the safe | Check safe membership and allowed machines |
| Collection stops after rotation | Object name changed | Confirm object names in the connector |
Changelog
- September 2026 · page created (draft).
Engineering to confirm
- Supported CyberArk (opens in a new tab) interfaces and authentication of the connector application
Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai