This section includes CyberArks's REST API commands, how to use them, and samples for typical implementations.


Use REST APIs to create, list, modify and delete entities in the PAS solution from within programs and scripts.

You can automate tasks that are usually performed manually using the UI, and to incorporate them into system and account-provisioning scripts.

REST APIs are part of the PVWA installation, and can be used immediately without any additional configuration. Make sure your CyberArk license enables you to use the CyberArk PAS SDK. For more information, contact your CyberArk support representative.

Our REST APIs are stable and predictable. If a change is needed in one of our APIs that causes the API to break, we will either create an alternate API or communicate the change in advance. Changes that break APIs are rare.

Changes that are considered to break an API:

  • Changing the URL
  • Changing a parameter name
  • Adding mandatory parameters
  • Removing parameters

Changes that are not considered to break an API:

  • Adding optional parameters in the request
  • Returning additional values in the response
  • Changes due to security issues

As a general rule, we recommend that you always use the newest REST API version. The newer versions include better performance and have more capabilities. If you cannot find a corresponding REST API for the task that you want to perform, you can use the command line interface (PACLI). For details, see Command Line Interface (PACLI) .

SDK Supported Platforms

The PAS SDK is a RESTful API that can be invoked by any RESTful client for various programming and scripting environments, including Java, C#, Perl, PHP, Python and Ruby.


The PAS SDK enables you to perform activities on PAS objects via a REST Web Service interface. Each PAS object has its own URL path in the PVWA website that can be accessed using the relevant HTTPS request verb.

Every HTTPS request must contain an HTTPS header field named Authorization that contains the value of a session token received from the Logon method.

REST APIs can be accessed with any tool or language that enables you to create HTTPS requests and handle HTTPS responses. For more information, refer to the C# and Java examples in Usage examples.

API commands

Try out our API commands in swagger (/PasswordVault/swagger).


For every REST API call except for Logon, the request must include an HTTPS header field named Authorization, containing the value of a session token received from the Logon activity.

In this section:

Return Codes

The following table lists all the return codes that are returned from the REST APIs.

Return Code

Code Number




The request succeeded. The actual response will depend on the request method used.



The request was fulfilled and resulted in a new resource being created.

Bad request


The request could not be understood by the server due to incorrect syntax.



The request requires user authentication.



The server received and understood the request, but will not fulfill it. Authorization will not help and the request MUST NOT be repeated.

Not Found


The server did not find anything that matches the Request-URI. No indication is given of whether the condition is temporary or permanent.



The request could not be completed due to a conflict with the current state of the resource.

Too Many Requests


The user has sent too many requests in a given amount of time ("rate limiting").

Internal Server Error


The server encountered an unexpected condition which prevented it from fulfilling the request.


This section includes information on troubleshooting issues.

405 Method not allowed

A delete request was sent to the Vault, and the following response was received:

405 Method not allowed.


Uninstall WebDAV on the IIS.

REST API does not work

By default, HTTPS is configured. If REST APIs do not work, make sure that the binding is defined in the web.config file.


  1. In the PasswordVault installation folder, open the web.config file.

  2. In the service tag, add bindingConfiguration="httpsBinding", as shown in the following example:


    <service behaviorConfiguration="defaultBehavior" name="CyberArk.WSAuthentication.Cyberark.CyberArkAuthenticationService">

    <endpoint name="AuthEndpoint" address="/" behaviorConfiguration="web" binding="webHttpBinding" bindingConfiguration="httpsBinding" contract="CyberArk.WSAuthentication.Cyberark.ICyberArkAuthenticationService" />


    <service behaviorConfiguration="defaultBehavior" name="CyberArk.PasswordVault.WebServices.WF.PIMServices">

    <endpoint name="PIMEndpoint" address="/" behaviorConfiguration="web" binding="webHttpBinding" bindingConfiguration="httpsBinding" contract="CyberArk.PasswordVault.WebServices.WF.IPIMServices" />


  3. Save the web.config file and close it.