> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Syteca Application Credentials Broker (ACB)

> The Syteca ACB is a stand-alone REST API for managing privileged-access secrets, folders, users, and the default admin password - for integrating Syteca PAM into automation, CI/CD pipelines, CMDB workflows, and custom security tooling.

## Privileged access automation, without picking a different PAM product to get it

Most PAM platforms expose two interfaces: a human-operated console for day-to-day secret use, and a REST API for automation. The quality of the second one is where buying decisions often turn - because the modern usage pattern isn't "an admin logs in to copy a password," it's "the CI pipeline retrieves the production database credential at deploy time," or "the CMDB rotates 4,000 service account passwords on a quarterly schedule." If the API is thin or undocumented, automation teams end up building shadow vaults - defeating the purpose of having centralized PAM.

**Syteca's Application Credentials Broker (ACB)** is a stand-alone REST API service that exposes the same secret-management capabilities that Syteca Connection Manager users see in the UI - get, add, update, delete secrets and folders; rotate passwords; force check-in; manage permissions; bulk-create. It runs alongside the Syteca Application Server, uses the same credentials database, and inherits the same role-based permission model. Same product, same license, no separate connector tiers.

<Info>
  **Use the Syteca ACB API when you need to:**

  * **Retrieve secrets from CI/CD pipelines** - Jenkins, GitHub Actions, GitLab CI fetch the deploy-time credentials they need at runtime, never store them in pipeline config.
  * **Onboard secrets in bulk** - migrate from a spreadsheet, CSV export, or another PAM product via the `BulkAdd` endpoint.
  * **Trigger password rotation programmatically** - from your CMDB, ITSM, or quarterly compliance workflow.
  * **Verify password validity via heartbeat checks** - confirm rotated passwords still work on the target endpoint without manual testing.
  * **Manage users and permissions programmatically** - provision Syteca users from your IdP, sync user groups from Active Directory automation.
  * **Rotate the default `admin` password from your secrets vault** - meet compliance requirements for built-in-admin password lifecycle.
  * **Integrate Syteca PAM with custom security tooling** - SOAR playbooks, custom service desk workflows, in-house automation.

  **Pair it with [Account Discovery](/docs/pam/discovery/overview)** for end-to-end automation: discover privileged accounts, onboard them via ACB BulkAdd, schedule rotation through ACB endpoints - without manual touch.
</Info>

<Warning>
  **NOT AVAILABLE IN SAAS.** ACB is a stand-alone component installed alongside an on-premises Syteca Application Server. SaaS customers should contact their Syteca vendor for SaaS-equivalent automation options.
</Warning>

## The API surface

The ACB API is split into four logical groups:

| Group                                                   | What it does                                                                                                             | Pages       |
| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------- |
| **Folder endpoints**                                    | Create, read, update, delete secret-organization folders                                                                 | 4 endpoints |
| **Secret endpoints**                                    | Full lifecycle for credential secrets - add, get, get-credentials, update, delete, rotate, force-checkin, **heartbeat**  | 8 endpoints |
| **Bulk action**                                         | Create multiple secrets and folders in a single call - for migration and onboarding                                      | 1 endpoint  |
| **Old endpoints**                                       | Pre-v1.3 authentication model - `get_access_token` and `get_secret_details` - still supported for backward compatibility | 2 endpoints |
| **User Management** *(spec only - see Phase 2)*         | Create / update / delete Syteca users and groups, manage administrative permissions                                      | 9 endpoints |
| **Admin password rotation** *(spec only - see Phase 2)* | Verify and rotate the built-in `admin` user's password from external systems                                             | 2 endpoints |

For the complete endpoint list with HTTP signatures, see [API reference](/docs/api/acb/api-reference#endpoints).

## How authentication works

Two authentication models, depending on which endpoint generation you're calling:

| Endpoint generation            | Auth model                                                                                                              |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| **Old endpoints** *(pre-v1.3)* | Refresh Token → POST to `get_access_token` → receive Access Token → pass `accessToken` in JSON body of subsequent calls |
| **New endpoints** *(v1.3+)*    | Refresh Token → POST to `get_access_token` → receive Access Token → pass `Authorization` header on subsequent calls     |

The Refresh Token is generated per Management Tool user, on the **Manage Account** page when the user has been [configured for external-application use](/docs/api/acb/setup-user-account). Access Tokens have configurable lifetimes (default 600 seconds; `0` means never expires).

See [API reference → Authentication](/docs/api/acb/api-reference#authentication) for the full mechanics.

## Architecture

| Component                        | Role                                                                                                                                                                                     |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **ACB service** *(this product)* | IIS-hosted REST API. Translates HTTP requests into Application Server queries. Exposes endpoints at `https://<hostname>/SytecaACB/...`.                                                  |
| **Syteca Application Server**    | Source of authority for secrets, folders, users, permissions. ACB reads from and writes to it. Requires AS 7.23+ for ACB 1.3, AS 7.22+ for ACB 1.2, AS 6.41.1+ for earlier ACB versions. |
| **Management Tool**              | Where users get their Refresh Token (Manage Account page), where secret/folder IDs come from (Automation tab), where ACB itself appears registered (Applications tab).                   |
| **API consumer** *(your tool)*   | CI/CD pipeline, CMDB, SOAR, custom script - anything that speaks HTTPS. Authenticates with `Authorization: <AccessToken>` header.                                                        |
| **Syteca ACB CLI** *(optional)*  | `SytecaACBConsole.exe` - command-line wrapper bundled with the ACB service for scripting and testing. See [CLI reference](/docs/api/acb/cli).                                                 |

## What's in this guide

| Step                                                               | Page                                                          |
| ------------------------------------------------------------------ | ------------------------------------------------------------- |
| **Install** the ACB service                                        | [Install](/docs/api/acb/install)                                   |
| **Set up a user account** with a Refresh Token                     | [Set up user account](/docs/api/acb/setup-user-account)            |
| **Configure secret and folder permissions** for the account        | [Secret permissions](/docs/api/acb/secret-permissions)             |
| **API reference** - auth, base URL, status codes, rate limiting    | [API reference](/docs/api/acb/api-reference)                       |
| **Data models** - request/response schemas shared across endpoints | [Data models](/docs/api/acb/data-models)                           |
| **Endpoints** - per-endpoint reference pages                       | [API reference → Endpoints](/docs/api/acb/api-reference#endpoints) |
| **CLI reference**                                                  | [CLI](/docs/api/acb/cli)                                           |

## Related

<CardGroup cols={2}>
  <Card title="Install ACB" icon="download" href="/docs/api/acb/install">
    System requirements, MSI install, version compatibility matrix.
  </Card>

  <Card title="API reference" icon="square-code" href="/docs/api/acb/api-reference">
    Base URL, authentication, status codes, rate limiting, endpoint list.
  </Card>

  <Card title="Data models" icon="braces" href="/docs/api/acb/data-models">
    Request and response schemas shared across endpoints.
  </Card>

  <Card title="CLI reference" icon="terminal" href="/docs/api/acb/cli">
    SytecaACBConsole.exe - command-line wrapper for scripting.
  </Card>
</CardGroup>