PRA and API call to force check in for all Vault accounts

Hello ​@CBlackadder

Please have a look at this API call. 

https://docs.beyondtrust.com/pra/reference/apiconfigvaultaccountforce-check-in

Is this what you are looking for?

Regards,

John

Yes, however I thought i could use the BYTAPI call and do it that way, instead it looks like i have to do something a bit different than what i had previously thought. Tanks for the steer on this.

I would be a nice added feature on the system to have an option to force checkin on specific days.

instead of using API calls, it would be just nice to have it there within the system

We are having the exact same issue and think this would be a powerful feature to automatically check-in vault accounts that are left in status checked-out after a configurable time (“Max checkout threshold”) with a notification sent to users (first notifcation that soon account will be checked in - graceful notification period; second notification that account was forced checked-in).

The entire benefit of BT’s proposal for a Zero-Trust PAM solution is somehow broken, since a user knows the password and rotation can be prevented. User’s are smart and found that shortcut very quickly in our case:-) We have to allow that certain users checkout of passwords because injection sometimes does not work for certain apps.

We now are trying to write a script. However the /vault/account endpoint does not provide the runtime status of an account (e.g. checked out) but seems to be only the static configuration of the account.

We would like only to force check-in via API for accounts filteres in checked-out status (e.g. /vault/account?status=checked_out).

How can this be achived?

This would be a starting point but it seems that the API is not providing “run-time” status information about the account. We would first only filter on checked-out accounts and those force check-in something like $AccountsUri = "$BaseUrl/api/config/v1/vault/account?status=checked-out"

It does seem odd that there does not seem to be a way in the application to force check-in a vault account. I can set a max password age, but with no way to enforce check-in that is meaningless.