Credential Management

Use the credential management endpoints to list and retrieve credentials stored in the RPA Console, and to update credential passwords programmatically. These endpoints are useful for automating credential rotation workflows without manual intervention in the console.

Passwords are never returned by any credential endpoint.

List credentials

GET: /credentials

Returns all credentials the service account has permission to view.

Response

The call is successful if "invocationResult" = "OK".

The following elements are provided in the result.credentials array.

Example response body:

1
2
3
4
5
6
7
8
9
10
11
12
13
{
    "invocationResult": "OK",
    "result": {
        "credentials": [
            {
                "uuid": "69c1c62dd6765634c8a95f6e",
                "application": "SAP_PROD",
                "username": "svc_robot_01"
            }
        ]
    },
    "exceptionThrownText": null
}

Error codes

Get credential details

GET: /credentials/{uuid}

Returns the metadata for a specific credential. Use this endpoint to confirm a credential exists before updating its password.

Path parameters

Response

The call is successful if "invocationResult" = "OK".

Example response body:

1
2
3
4
5
6
7
8
9
{
    "invocationResult": "OK",
    "result": {
        "uuid": "69c1c62dd6765634c8a95f6e",
        "application": "SAP_PROD",
        "username": "svc_robot_01"
    },
    "exceptionThrownText": null
}

Error codes

Update credential password

PUT: /credentials/{uuid}/password

Updates the password for a credential. The new password takes effect immediately for all subsequent robot executions that use the credential.

Path parameters

Request body

Example request body:

1
2
3
{
    "password": "[new-password]"
}

Response

The call is successful if "invocationResult" = "OK". The result field is null on success.

Example response body:

1
2
3
4
5
{
    "invocationResult": "OK",
    "result": null,
    "exceptionThrownText": null
}

Error codes

Concurrency: Last-write-wins. Concurrent updates are accepted; the most recent write takes effect.

Audit logging: A security event is logged on each successful password update.

Credential endpoint code examples

The following examples show how to call the credential endpoints. Replace <SITE_URL> with your RPA Console hostname and <API_KEY> with your API key.

List credentials (cURL)

1
2
curl -s -H "Authorization: Bearer ${API_KEY}" \
  "${SITE_URL}/rpa/rest/oo/credentials"

Update credential password (cURL)

1
2
3
4
5
curl -s -X PUT \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"password": "[new-password]"}' \
  "${SITE_URL}/rpa/rest/oo/credentials/69c1c62dd6765634c8a95f6e/password"

Batch rotation (PowerShell)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
$SiteUrl = "https://rpa.example.com"
$ApiKey  = $env:RPA_API_KEY
$Headers = @{
    "Authorization" = "Bearer $ApiKey"
    "Content-Type"  = "application/json"
}

# List all credentials
$creds = Invoke-RestMethod -Uri "$SiteUrl/rpa/rest/oo/credentials" -Headers $Headers

# Rotate each credential's password
$creds.result.credentials | ForEach-Object {
    $uuid        = $_.uuid
    $newPassword = $env:NEW_CREDENTIAL_PASSWORD  # Retrieved from secrets manager at runtime
    $body        = @{ password = $newPassword } | ConvertTo-Json

    $response = Invoke-RestMethod `
        -Uri     "$SiteUrl/rpa/rest/oo/credentials/$uuid/password" `
        -Method  PUT `
        -Headers $Headers `
        -Body    $body

    if ($response.invocationResult -eq "OK") {
        Write-Host "Credential $uuid ($($_.username)) rotated successfully."
    } else {
        Write-Warning "Credential $uuid failed: $($response.exceptionThrownText)"
    }
}

Feedback