Documentation
Credentials and PAM brokering
How REAP obtains device and system credentials, why it holds as few as possible, and how you revoke them.
The credential model
- Read-only by default. Discovery, telemetry and reasoning use least-privilege, read-only accounts.
- Brokered, not stored. Where you run CyberArk (opens in a new tab) (HashiCorp Vault (opens in a new tab): planned, not available today), connectors request credentials at time of use; no standing device credentials are held in REAP.
- Write only for approved runbooks. A separate, scoped account is used for the runbooks you approve; it is subject to approval gates, pre-execution impact analysis, reverse steps where the change is reversible, and audit.
- Revocable at any time. Disabling the account or the PAM policy stops collection immediately; the console shows the effect.
CyberArk
- Create a safe for REAP with the read-only device account(s).
- Grant the connector application identity retrieval rights via Central Credential Provider or the Application Access Manager supported interface.
- Configure the safe and object names in the connector; test retrieval.
- For runbooks: a second safe with the scoped write account; approvals in REAP; session recording remains yours.
HashiCorp Vault (planned)
Status Planned Not available today; the steps below are the design and will be confirmed when the integration is released.
- Create a KV or dynamic-secrets path for REAP with the read-only device account.
- Issue an AppRole (or the auth method you standardize on) for the connector supported auth methods.
- Set TTLs to your policy; connectors renew within lease.
- For runbooks: a separate path and policy for the scoped write account.
Without a PAM
- Credentials are stored encrypted in the connector’s local secret store mechanism and never forwarded to the platform.
- Rotation: update in the connector; REAP records the rotation event.
Device account privileges
| Platform | Read-only account | Runbook account (optional) |
|---|---|---|
| Cisco IOS-XE (opens in a new tab) | Privilege 15 with TACACS+/RADIUS command authorization limited to show and archive commands, or a custom privilege level with show running-config explicitly enabled (reduced-privilege views omit sections); exact command set | Scoped to the approved runbook commands via AAA command authorization |
| Cisco (opens in a new tab) NX-OS (opens in a new tab) | network-operator role (read-only) | Custom role limited to the approved runbook commands |
| Arista EOS (opens in a new tab) | Read-only role | Scoped role |
| Junos (opens in a new tab) | read-only login class | Custom class limited to approved statements |
| HPE Aruba (opens in a new tab) | Operator role | Scoped role |
| Palo Alto Networks (opens in a new tab) / Fortinet (opens in a new tab) | Read-only admin profile / read-only access profile | Scoped profile |
Engineering to confirm
- Supported CyberArk (opens in a new tab) and Vault (opens in a new tab) interfaces and auth methods
- Connector local secret store mechanism when no PAM exists
- Per-platform command sets for read-only accounts
Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai