Skip to main content
Before the ACB API can be called, you need a Management Tool user with a Refresh Token — the long-lived credential that’s exchanged for short-lived Access Tokens during normal API operation. This page walks through creating that user and configuring the Application Account Settings.
NOT AVAILABLE IN SAAS. This procedure applies to on-premises deployments only.

​
Two account types, two use cases

The ACB API can authenticate against two different account types in Syteca: Application Accounts can’t have administrative permissions like User Management — that’s intentional. To rotate the admin password, you need a regular Internal or AD user with that permission, and the same external-app toggle enabled.

​
Prerequisites

Without these three, the Automation tab won’t appear on the Edit Secret and Edit Folder pages — making secret IDs and folder IDs inaccessible.

​
Create the user

1

Open the Users page

Sign in to the Management Tool as a user with the administrative User Management permission. Click Users in the left navigation.
2

Click Add User

Click the Add User button in the top right.
3

Pick the user type

Either add an Internal user or an Application Account user, or edit an existing Active Directory user.
For rotating the default admin user’s password, use an Internal or Active Directory user — Application Accounts can’t have the administrative User Management permission, which is required for the admin-password endpoints.
4

Configure user properties

Fill in the standard user fields (Login, password, etc.) as per the Add a user procedure.

​
Configure Application Account Settings

After creating the user, the Application Account Settings section on the User Details tab is where the Refresh Token lives.
User Details tab showing Application Account Settings with Allow external apps toggle, Refresh Token field, Authorization token lifetime and IP Address restriction

The Application Account Settings section — Refresh Token, token lifetime, and IP restriction become visible after enabling the external-app toggle.

1

Enable external application use

On the User Details tab, scroll to the Application Account Settings section. Move the Allow this user account to be used by external applications toggle to the right to enable.
2

Copy the Refresh Token

The Refresh Token field becomes visible after the toggle is enabled. Click the Copy icon next to it to copy the token to your clipboard.
Treat the Refresh Token like a password. Anyone with this token can obtain Access Tokens and call the API on this user’s behalf. Store it in a secrets vault, not in source control or pipeline config.
3

(Optional) Set Authorization token lifetime

The Authorization token lifetime (sec) field controls how long Access Tokens are valid after they’re issued.
Long-lived Access Tokens reduce friction for automation, but increase the blast radius if a token is leaked. The default 600s is a reasonable balance for most workflows.
4

(Optional) Restrict by IP address

The IP Address restriction field limits the API consumer to a specific IP address. Requests from any other IP return 403 Forbidden.Use this for production deployments where the API caller’s IP is known and stable (e.g. a dedicated CI/CD runner, a CMDB host, a SOAR appliance).
5

Save the user

Click Save to commit the changes.

​
What happens when the toggle is disabled

Disabling the Allow this user account to be used by external applications toggle:
  • Hides the Refresh Token, Authorization token lifetime, and IP Address restriction fields.
  • Expires the Refresh Token immediately. Any in-flight automation calling the API on behalf of this user starts failing with 401 Unauthorized.
Re-enabling the toggle generates a new Refresh Token — the old one is permanently invalid.

​
Next steps

Secret permissions

Grant the user Owner / Editor / PAM User roles on specific secrets and folders.

Users page

Full reference for adding and editing Syteca users.

Administrative permissions

The permissions required for ACB API access.

API reference

Base URL, authentication, status codes.