---
title: Add Vault Account
slug: kron-pam-api-collection-381-patch3/add-vault-account
docTags: 
createdAt: 2026-10-21T06:07:16.182Z
---

{
  "id": "1YpigEm_PugcIuFHf9E3i",
  "type": "api-oas-v2",
  "data": {
    "method": "POST",
    "url": "{{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount",
    "name": "",
    "description": "<p><strong>Request Overview</strong></p>\n<p>This API allows a Vault account to be added. The account can be of type <code>STATIC</code> or <code>DYNAMIC</code>, and additional parameters may be included based on the use case (such as SSH key passphrases or device bindings). The response will include the created Vault account.</p>\n<p><strong>Required Parameters</strong></p>\n<ul>\n<li>\n<p><strong>secretName</strong>: Name of the secret associated with the Vault account.</p>\n</li>\n<li>\n<p><strong>privateType</strong>: Indicates whether the account is private.</p>\n</li>\n<li>\n<p><strong>secretType</strong>: Type of the secret (e.g., STATIC).</p>\n</li>\n<li>\n<p><strong>password</strong>: Password associated with the account.</p>\n</li>\n<li>\n<p><strong>sapmGroupdbId</strong>: ID of the SAPM group database.</p>\n</li>\n<li>\n<p><strong>sapmConfigId</strong>: ID of the SAPM configuration.</p>\n</li>\n<li>\n<p><strong>passwordChangePeriod</strong>: Period after which the password will be changed.</p>\n</li>\n</ul>\n<p><strong>Optional Parameters</strong></p>\n<ul>\n<li>\n<p>sapmUserName: Username to be associated with the secret</p>\n</li>\n<li>\n<p>deviceId: UUID of the device to bind the Vault account to</p>\n</li>\n<li>\n<p>sshKeyPassphrase: Passphrase used if the password field represents an SSH private key</p>\n</li>\n</ul>\n<hr>\n<h3>Add Vault Account parameters</h3>\n<p><code>POST /rest/sc/sapm/addSapmAccount</code> accepts <code>SapmRequestModel</code>. Request field names differ from the SAPM account object returned in the response.</p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<table><thead><tr><th align=\"left\">JSON field</th><th align=\"left\">Type</th><th align=\"left\">Required</th><th align=\"left\">Description</th></tr></thead><tbody><tr><td align=\"left\"><code>secretName</code></td><td align=\"left\">String</td><td align=\"left\">Yes</td><td align=\"left\">Vault account name. <code>/</code> is not allowed.</td></tr><tr><td align=\"left\"><code>sapmConfigId</code></td><td align=\"left\">Long</td><td align=\"left\">Yes</td><td align=\"left\">Existing Vault configuration ID. Use a configuration whose strategy matches the account type.</td></tr><tr><td align=\"left\"><code>secretType</code></td><td align=\"left\">String</td><td align=\"left\">Yes</td><td align=\"left\">Account type, such as <code>STATIC</code> or <code>DYNAMIC</code>.</td></tr><tr><td align=\"left\"><code>sapmUserName</code></td><td align=\"left\">String</td><td align=\"left\">Config-dependent</td><td align=\"left\">Username stored by credential-based configurations.</td></tr><tr><td align=\"left\"><code>password</code> / <code>secretData</code></td><td align=\"left\">String / Object</td><td align=\"left\">Config-dependent</td><td align=\"left\">Initial secret in the format expected by the selected configuration.</td></tr><tr><td align=\"left\"><code>privateType</code></td><td align=\"left\">String</td><td align=\"left\">No</td><td align=\"left\">Private-account option, normally <code>YES</code> or <code>NO</code>; server configuration may supply or lock the value.</td></tr><tr><td align=\"left\"><code>sapmGroupDbId</code></td><td align=\"left\">Long</td><td align=\"left\">No</td><td align=\"left\">Parent Vault group database ID.</td></tr><tr><td align=\"left\"><code>passwordChangePeriod</code></td><td align=\"left\">String</td><td align=\"left\">No</td><td align=\"left\">Rotation interval in <strong>days</strong>. The server stores it internally in minutes.</td></tr><tr><td align=\"left\"><code>passwordChangePeriodCronExpression</code></td><td align=\"left\">String</td><td align=\"left\">No</td><td align=\"left\">Cron-based rotation schedule.</td></tr><tr><td align=\"left\"><code>masterSapmDbId</code></td><td align=\"left\">Long</td><td align=\"left\">No</td><td align=\"left\">Master SAPM account database ID when the selected strategy requires one.</td></tr><tr><td align=\"left\"><code>description</code></td><td align=\"left\">String</td><td align=\"left\">No</td><td align=\"left\">Account description.</td></tr><tr><td align=\"left\"><code>secretNotes</code></td><td align=\"left\">String</td><td align=\"left\">No</td><td align=\"left\">Encrypted notes; maximum length is 100,000 characters.</td></tr><tr><td align=\"left\"><code>permissions</code></td><td align=\"left\">Array</td><td align=\"left\">No</td><td align=\"left\">Initial account permissions.</td></tr><tr><td align=\"left\"><code>accountLevelProperties</code></td><td align=\"left\">Object</td><td align=\"left\">No</td><td align=\"left\">Configuration-specific account properties.</td></tr></tbody></table>\n<p>Response-only fields such as <code>validationStatus</code>, <code>passwordSeenStatus</code>, <code>groupFullPath</code>, <code>createdAt</code>, and <code>updatedAt</code> must not be sent as configuration inputs.</p>",
    "contentType": "application/json",
    "request": {
      "headerParameters": [
        {
          "name": "Content-Type",
          "description": "",
          "default": "application/json",
          "value": "application/json",
          "type": "string"
        },
        {
          "name": "Cookie",
          "description": "",
          "default": "{{netrightCookie}} ",
          "value": "{{netrightCookie}} ",
          "type": "string"
        },
        {
          "name": "X-XSRF-TOKEN",
          "description": "",
          "default": "{{csrftoken}}",
          "value": "{{csrftoken}}",
          "type": "string"
        }
      ],
      "queryParameters": [],
      "pathParameters": [
        {
          "name": "url",
          "description": "",
          "default": "url",
          "value": "url",
          "type": "string"
        }
      ],
      "bodyDataParameters": [
        {
          "name": "body",
          "description": "",
          "default": "{\n  \"secretName\": \"static-app-account\",\n  \"sapmUserName\": \"app_user\",\n  \"password\": \"CHANGE_ME\",\n  \"privateType\": \"YES\",\n  \"secretType\": \"STATIC\",\n  \"sapmConfigId\": 12345,\n  \"sapmGroupDbId\": 383826\n}",
          "value": "{\n  \"secretName\": \"static-app-account\",\n  \"sapmUserName\": \"app_user\",\n  \"password\": \"CHANGE_ME\",\n  \"privateType\": \"YES\",\n  \"secretType\": \"STATIC\",\n  \"sapmConfigId\": 12345,\n  \"sapmGroupDbId\": 383826\n}",
          "type": "object"
        }
      ],
      "formDataParameters": [],
      "oAuthParameters": []
    },
    "responses": [
      {
        "statusCode": "200",
        "description": "<p>Add Vault Account - STATIC</p>",
        "jsonExample": "{\n  \"dbId\": 2000001,\n  \"device\": null,\n  \"secretName\": \"static-app-account\",\n  \"config\": {\n    \"configId\": 12345,\n    \"name\": \"Example Static Configuration\",\n    \"description\": \"Example static configuration\",\n    \"strategy\": \"STATIC\",\n    \"properties\": {\n      \"static.secret.type\": \"USER_CREDENTIAL\"\n    },\n    \"staticSecretType\": \"USER_CREDENTIAL\"\n  },\n  \"changePeriod\": null,\n  \"username\": \"app_user\",\n  \"description\": null,\n  \"secretNotes\": null,\n  \"lastChangeTime\": null,\n  \"nextChangeTime\": null,\n  \"passwordSeenStatus\": \"UNSEEN\",\n  \"validationStatus\": \"UNKNOWN\",\n  \"masterAccountId\": null,\n  \"accountLevelProperties\": {},\n  \"permissions\": [],\n  \"identicalSapmAccounts\": [],\n  \"parentSapmGroup\": {\n    \"dbId\": 383826,\n    \"id\": \"00000000-0000-4000-8000-000000000001\",\n    \"name\": \"Example Group\",\n    \"description\": null\n  },\n  \"secretType\": \"STATIC\",\n  \"owner\": {\n    \"id\": \"00000000-0000-4000-8000-000000000002\",\n    \"eid\": \"example.admin\"\n  },\n  \"createdAt\": 1893456000000,\n  \"updatedAt\": 1893456000000,\n  \"managers\": [],\n  \"userPermissionLevel\": 6,\n  \"approvalStatus\": null,\n  \"groupFullPath\": \"/Example Group\",\n  \"approvedBy\": null,\n  \"approvedDate\": null,\n  \"approvalRequired\": false\n}"
      }
    ],
    "examples": {
      "languages": [
        {
          "id": "Wa5A9ZyTz_sJhb9vcQnYJ",
          "language": "curl",
          "label": "cURL",
          "code": "curl --request POST \\\n     --url {{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount \\\n     --header 'accept: application/json' \\\n     --header 'content-type: application/json' \\\n     --cookie {{netrightCookie}}  \\\n     --header 'x-xsrf-token: {{csrftoken}}' \\\n     --data '\"{\\n  \\\"secretName\\\": \\\"static-app-account\\\",\\n  \\\"sapmUserName\\\": \\\"app_user\\\",\\n  \\\"password\\\": \\\"CHANGE_ME\\\",\\n  \\\"privateType\\\": \\\"YES\\\",\\n  \\\"secretType\\\": \\\"STATIC\\\",\\n  \\\"sapmConfigId\\\": 12345,\\n  \\\"sapmGroupDbId\\\": 383826\\n}\"'"
        },
        {
          "id": "UPfwYlUi6DX-rCx_Fpnhk",
          "language": "javascript",
          "label": "javascript",
          "code": "var myHeaders = new Headers();\nmyHeaders.append(\"accept\", \"application/json\");\nmyHeaders.append(\"content-type\", \"application/json\");\nmyHeaders.append(\"cookie\", \"{{netrightCookie}} \");\nmyHeaders.append(\"x-xsrf-token\", \"{{csrftoken}}\");\n\nvar raw = JSON.stringify(\"{\\n  \\\"secretName\\\": \\\"static-app-account\\\",\\n  \\\"sapmUserName\\\": \\\"app_user\\\",\\n  \\\"password\\\": \\\"CHANGE_ME\\\",\\n  \\\"privateType\\\": \\\"YES\\\",\\n  \\\"secretType\\\": \\\"STATIC\\\",\\n  \\\"sapmConfigId\\\": 12345,\\n  \\\"sapmGroupDbId\\\": 383826\\n}\");\n\nvar requestOptions = {\n   method: 'POST',\n   headers: myHeaders,\n   body: raw,\n   redirect: 'follow'\n};\n\nfetch(\"{{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount\", requestOptions)\n   .then(response => response.text())\n   .then(result => console.log(result))\n   .catch(error => console.log('error', error));"
        },
        {
          "id": "F6W5FIzAH5QAzRLMla0gS",
          "language": "ruby",
          "label": "Ruby",
          "code": "require \"uri\"\nrequire \"json\"\nrequire \"net/http\"\n\nurl = URI(\"{{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount\")\n\nhttp = Net::HTTP.new(url.host, url.port);\nrequest = Net::HTTP::Post.new(url)\nrequest[\"accept\"] = \"application/json\"\nrequest[\"content-type\"] = \"application/json\"\nrequest[\"cookie\"] = \"{{netrightCookie}} \"\nrequest[\"x-xsrf-token\"] = \"{{csrftoken}}\"\nrequest.body = JSON.dump(\"{\\n  \\\"secretName\\\": \\\"static-app-account\\\",\\n  \\\"sapmUserName\\\": \\\"app_user\\\",\\n  \\\"password\\\": \\\"CHANGE_ME\\\",\\n  \\\"privateType\\\": \\\"YES\\\",\\n  \\\"secretType\\\": \\\"STATIC\\\",\\n  \\\"sapmConfigId\\\": 12345,\\n  \\\"sapmGroupDbId\\\": 383826\\n}\")\n\nresponse = http.request(request)\nputs response.read_body\n"
        },
        {
          "id": "NUdGt27UM0rwW7Fs4KIru",
          "language": "python",
          "label": "Python",
          "code": "import requests\nimport json\n\nurl = \"{{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount\"\n\npayload = json.dumps(\"{\\n  \\\"secretName\\\": \\\"static-app-account\\\",\\n  \\\"sapmUserName\\\": \\\"app_user\\\",\\n  \\\"password\\\": \\\"CHANGE_ME\\\",\\n  \\\"privateType\\\": \\\"YES\\\",\\n  \\\"secretType\\\": \\\"STATIC\\\",\\n  \\\"sapmConfigId\\\": 12345,\\n  \\\"sapmGroupDbId\\\": 383826\\n}\")\nheaders = {\n   'accept': 'application/json',\n   'content-type': 'application/json',\n   'cookie': '{{netrightCookie}} ',\n   'x-xsrf-token': '{{csrftoken}}'\n}\n\nresponse = requests.request(\"POST\", url, headers=headers, data=payload)\n\nprint(response.text)\n"
        }
      ],
      "selectedLanguageId": "Wa5A9ZyTz_sJhb9vcQnYJ"
    },
    "results": {
      "languages": [
        {
          "id": "1zzsHt2NUKIdDPYCJbhAw",
          "language": "200",
          "code": "{\n  \"dbId\": 2000001,\n  \"device\": null,\n  \"secretName\": \"static-app-account\",\n  \"config\": {\n    \"configId\": 12345,\n    \"name\": \"Example Static Configuration\",\n    \"description\": \"Example static configuration\",\n    \"strategy\": \"STATIC\",\n    \"properties\": {\n      \"static.secret.type\": \"USER_CREDENTIAL\"\n    },\n    \"staticSecretType\": \"USER_CREDENTIAL\"\n  },\n  \"changePeriod\": null,\n  \"username\": \"app_user\",\n  \"description\": null,\n  \"secretNotes\": null,\n  \"lastChangeTime\": null,\n  \"nextChangeTime\": null,\n  \"passwordSeenStatus\": \"UNSEEN\",\n  \"validationStatus\": \"UNKNOWN\",\n  \"masterAccountId\": null,\n  \"accountLevelProperties\": {},\n  \"permissions\": [],\n  \"identicalSapmAccounts\": [],\n  \"parentSapmGroup\": {\n    \"dbId\": 383826,\n    \"id\": \"00000000-0000-4000-8000-000000000001\",\n    \"name\": \"Example Group\",\n    \"description\": null\n  },\n  \"secretType\": \"STATIC\",\n  \"owner\": {\n    \"id\": \"00000000-0000-4000-8000-000000000002\",\n    \"eid\": \"example.admin\"\n  },\n  \"createdAt\": 1893456000000,\n  \"updatedAt\": 1893456000000,\n  \"managers\": [],\n  \"userPermissionLevel\": 6,\n  \"approvalStatus\": null,\n  \"groupFullPath\": \"/Example Group\",\n  \"approvedBy\": null,\n  \"approvedDate\": null,\n  \"approvalRequired\": false\n}"
        }
      ],
      "selectedLanguageId": "1zzsHt2NUKIdDPYCJbhAw"
    }
  },
  "children": [
    {
      "text": ""
    }
  ]
}