Automate Credential Rotation

Automating the rotation of RPA Console credentials using the Appian RPA REST API reduces manual effort, minimizes the window of exposure for compromised credentials, and ensures your RPA robots stay running without interruption when passwords change.

What you need before automating credential rotation

Before you begin, make sure you have:

• An Appian API key associated with a service account that has System Administrator rights in Appian RPA. See Authentication for details.
• The UUID of the credential you want to rotate. You can find this in the RPA Console on the credential's detail page, or by calling the List credentials endpoint.
• Network access from the machine running your automation script to your Appian environment.
• A password management system or process for generating new passwords.

Rotate a credential

Follow these steps to rotate a credential in the RPA Console.

Step 1: List credentials to find UUIDs

Call the List credentials endpoint to retrieve the UUIDs of the credentials you want to rotate.

1
2
curl -s -H "Authorization: Bearer ${API_KEY}" \
  "${SITE_URL}/rpa/rest/oo/credentials"

Verify that the response contains "invocationResult": "OK" and that the application and username fields match the credentials you intend to update.

Step 2: Optionally verify a specific credential

Call the Get credential details endpoint to confirm the credential exists before updating it.

1
2
curl -s -H "Authorization: Bearer ${API_KEY}" \
  "${SITE_URL}/rpa/rest/oo/credentials/69c1c62dd6765634c8a95f6e"

Step 3: Generate or retrieve the new password

Obtain the new password from your password management system. Do not hardcode passwords in scripts. Use environment variables or a secrets manager to pass the new password to your script at runtime.

Step 4: Update the credential password

Call the Update credential password endpoint. Pass the UUID in the URL path and the new password in the request body.

1
2
3
4
5
curl -s -X PUT \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"password": "[new-password]"}' \
  "${SITE_URL}/rpa/rest/oo/credentials/69c1c62dd6765634c8a95f6e/password"

Step 5: Confirm the update succeeded

Verify the response contains "invocationResult": "OK". If it does not, check the exceptionThrownText field for details.

Step 6: Test with a robotic task execution

Trigger a test execution of a robotic task that uses the updated credential to confirm it can authenticate successfully. You can do this from the RPA Console or using the Execute Robotic Task with Parameters endpoint.

Step 7: Roll back if needed

If the test execution fails due to an authentication error, roll back by calling the Update credential password endpoint again with the previous password. Keep the previous password available in your secrets manager until you've confirmed the new password works.

Example: Scheduled rotation script (PowerShell)

The following PowerShell script demonstrates a complete credential rotation workflow. It retrieves a new password from an environment variable, updates the RPA Console credential, and verifies the update. Adapt it to integrate with your password vault or identity management system.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
$SiteUrl     = "https://rpa.example.com"
$ApiKey      = $env:RPA_API_KEY
$NewPassword = $env:NEW_CREDENTIAL_PASSWORD  # Retrieved from secrets manager at runtime

$Headers = @{
    "Authorization" = "Bearer $ApiKey"
    "Content-Type"  = "application/json"
}

# Step 1: List all credentials
Write-Host "Listing credentials..."
$listResponse = Invoke-RestMethod `
    -Uri     "$SiteUrl/rpa/rest/oo/credentials" `
    -Headers $Headers

if ($listResponse.invocationResult -ne "OK") {
    Write-Error "Could not list credentials: $($listResponse.exceptionThrownText)"
    exit 1
}

# Step 2: Rotate each credential's password
$listResponse.result.credentials | ForEach-Object {
    $uuid = $_.uuid
    Write-Host "Rotating credential $uuid ($($_.username))..."

    $body = @{ password = $NewPassword } | ConvertTo-Json

    $updateResponse = Invoke-RestMethod `
        -Uri     "$SiteUrl/rpa/rest/oo/credentials/$uuid/password" `
        -Method  PUT `
        -Headers $Headers `
        -Body    $body

    if ($updateResponse.invocationResult -eq "OK") {
        Write-Host "  Rotated successfully."
    } else {
        Write-Warning "  Failed: $($updateResponse.exceptionThrownText)"
    }
}

Rollback procedures

If a credential rotation causes robotic task failures:

1. Retrieve the previous password from your secrets manager.
2. Call the Update credential password endpoint with the previous password.
3. Confirm the response returns "invocationResult": "OK".
4. Investigate the root cause before attempting rotation again.

Monitoring and notifications

Add logging and alerting to your rotation script so your team is notified of both successes and failures. At minimum, log:

• The credential UUID and username.
• The timestamp of the rotation attempt.
• Whether the update succeeded or failed.
• Any error messages returned by the API.

For integration with enterprise monitoring tools, write log output in a structured format (for example, JSON) that your logging platform can parse.

Feedback