<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Privileged Access Management — API Reference

## HashiCorp Vault CLI

```bash
# Secret engines
vault secrets enable -path=ad ad
vault secrets enable -path=ssh ssh
vault secrets enable database

# AD credential checkout
vault read ad/creds/svc-backup

# SSH signed certificates
vault write ssh/sign/admin public_key=@id_rsa.pub

# Dynamic database credentials
vault read database/creds/app-readonly

# Audit configuration
vault audit enable file file_path=/var/log/vault_audit.log
vault audit list
```

## Azure PIM API

```bash
# List eligible role assignments
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilitySchedules

# Activate role
POST https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests

# List active assignments
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances

# PIM audit logs
GET https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?\
$filter=activityDisplayName eq 'Add member to role completed (PIM activation)'
```

## CyberArk REST API

```bash
# Authenticate
POST https://cyberark.target.com/PasswordVault/API/auth/Cyberark/Logon
{"username": "admin", "password": "pass"}

# Get accounts
GET https://cyberark.target.com/PasswordVault/API/Accounts?search=svc-

# Retrieve password
GET https://cyberark.target.com/PasswordVault/API/Accounts/{id}/Password/Retrieve

# Change password
POST https://cyberark.target.com/PasswordVault/API/Accounts/{id}/Change
```

## PowerShell AD Commands

```powershell
# Privileged group enumeration
Get-ADGroupMember -Identity "Domain Admins" -Recursive
Get-ADGroupMember -Identity "Enterprise Admins" -Recursive

# Service account audit
Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName, PasswordLastSet

# Password never expires
Get-ADUser -Filter {PasswordNeverExpires -eq $true -and Enabled -eq $true}
```

## Key PAM Controls

| Control | Implementation | Standard |
|---------|---------------|----------|
| Credential vaulting | All admin passwords in PAM | CIS 5.2 |
| Auto-rotation | ≤90 day password age | NIST 800-53 IA-5 |
| JIT access | Max 4-hour activation | NIST 800-207 |
| Session recording | All Tier 0 sessions recorded | CIS 6.7 |
| Break-glass | Sealed credentials, dual approval | NIST 800-53 AC-2 |
| MFA enforcement | All privileged access | CIS 6.5 |
