• April 28 2026

CyberArk REST API with PowerShell: Complete Automation Guide (2026)

Learn how to use CyberArk REST API with PowerShell to automate account onboarding, safe creation, and password management. Step-by-step guide with script.

---

🚀 Introduction to REST API in CyberArk

A REST API (Representational State Transfer – Application Programming Interface) allows applications to communicate over HTTPS.

👉 In simple terms:
It acts as a bridge between two systems to exchange data securely.

---

🌐 Real-World Example of REST API

Imagine:

• You want to update your status on Facebook automatically

• Instead of manual login, you use a script

👉 That script connects using APIs provided by the application

---

💡 Key Concept

Applications like:

• Facebook

• AWS

• Azure etc.

👉 Provide APIs for automation

Similarly, CyberArk provides APIs for:

✔ Account onboarding
✔ Safe creation
✔ Password rotation
✔ User management
✔ Reporting etc.

---

🔗 CyberArk REST API Endpoint

👉 You can view all APIs using Swagger:

https://PVWA/PasswordVault/Swagger

👉 This provides:

• API list

• Request format

• Response structure

---

🎯 Why Use CyberArk REST API?

---

📌 Benefits

✔ Automate repetitive tasks
✔ Reduce manual effort
✔ Improve accuracy
✔ Enable bulk operations
✔ Integrate with external tools

---

🔥 Real Use Case

👉 Onboard 1000 accounts automatically
👉 Instead of manual onboarding

---

⚙️ PowerShell + REST API Automation

---

💡 Why PowerShell?

👉 PowerShell is a scripting language used to:

✔ Automate OS-level tasks
✔ Call APIs
✔ Integrate systems

---

🧾 Automation Scenario

---

🎯 Requirement

👉 Onboard 1000 accounts or more into CyberArk

---

📌 Step-by-Step Process

---

1️⃣ Prepare Account Data (CSV File)

Create a CSV file:

userName,address,safeName,platformID,secret
admin1,server1,Windows-Safe,WinDomain,Pass@123
admin2,server2,Unix-Safe,UnixSSH,Pass@456

👉 Save at:

C:\Users\Administrator\Desktop\Accounts.csv

---

2️⃣ Identify Required APIs

---

🔐 Login API

https://PVWAURL/PasswordVault/API/auth/Cyberark/Logon

---

➕ Add Account API

https://PVWAURL/PasswordVault/API/Accounts

---

🚪 Logoff API

https://PVWAURL/PasswordVault/API/auth/Logoff

---

3️⃣ Choose Authentication Type

You can use:

✔ CyberArk Authentication
✔ LDAP Authentication
✔ SAML Authentication

👉 Just update API path accordingly

---

4️⃣ Use Secure Credentials

⚠️ Never hardcode password

✔ Use secure input method

---

5️⃣ Execute Script

👉 Run PowerShell ISE as Administrator
👉 Provide password securely
👉 Script will:

• Login

• Read CSV

• Onboard accounts

• Logoff

---

💻 PowerShell Script (CyberArk Account Onboarding)

# ==============================
# CyberArk Account Onboarding Script
# ==============================

# Variables
$PVWAURL = "https://PVWAURL/PasswordVault"
$AuthType = "Cyberark"
$Username = "Administrator"
$CSVPath = "C:\Users\Administrator\Desktop\Accounts.csv"

# Disable SSL warnings (if needed)
Add-Type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
    public bool CheckValidationResult(
        ServicePoint srvPoint, X509Certificate certificate,
        WebRequest request, int certificateProblem) {
        return true;
    }
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

# ==============================
# Get Secure Password
# ==============================
$SecurePassword = Read-Host "Enter CyberArk Password" -AsSecureString
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecurePassword)
$PlainPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)

# ==============================
# Login API
# ==============================
$LogonURL = "$PVWAURL/API/auth/$AuthType/Logon"

try {
    Write-Host "Logging into CyberArk..."

    $Body = @{
        username = $Username
        password = $PlainPassword
    } | ConvertTo-Json

    $Token = Invoke-RestMethod -Uri $LogonURL -Method POST -Body $Body -ContentType "application/json"

    Write-Host "Login Successful!" -ForegroundColor Green
}
catch {
    Write-Host "Login Failed: $_" -ForegroundColor Red
    exit
}

# ==============================
# Read CSV
# ==============================
try {
    $Accounts = Import-Csv -Path $CSVPath
}
catch {
    Write-Host "Failed to read CSV file: $_" -ForegroundColor Red
    exit
}

# ==============================
# Onboard Accounts
# ==============================
$AddAccountURL = "$PVWAURL/API/Accounts"

foreach ($Account in $Accounts) {
    try {
        Write-Host "Onboarding account: $($Account.userName)..."

        $AccountBody = @{
            name = $Account.userName
            address = $Account.address
            userName = $Account.userName
            platformId = $Account.platformID
            safeName = $Account.safeName
            secret = $Account.secret
        } | ConvertTo-Json -Depth 3

        Invoke-RestMethod -Uri $AddAccountURL `
            -Method POST `
            -Headers @{ Authorization = $Token } `
            -Body $AccountBody `
            -ContentType "application/json"

        Write-Host "Successfully onboarded: $($Account.userName)" -ForegroundColor Green
    }
    catch {
        Write-Host "Failed to onboard $($Account.userName): $_" -ForegroundColor Red
    }
}

# ==============================
# Logoff
# ==============================
$LogoffURL = "$PVWAURL/API/auth/Logoff"

try {
    Invoke-RestMethod -Uri $LogoffURL `
        -Method POST `
        -Headers @{ Authorization = $Token }

    Write-Host "Logged off successfully!" -ForegroundColor Green
}
catch {
    Write-Host "Logoff Failed: $_" -ForegroundColor Red
}

---

🧠 Script Explanation (Simple)

---

🔑 Step 1: Login

👉 Uses API to authenticate
👉 Returns session token

---

📂 Step 2: Read CSV

👉 Reads account details

---

➕ Step 3: Onboard Accounts

👉 Loop through each account
👉 Calls API to create account

---

🚪 Step 4: Logoff

👉 Ends session securely

---

⚠️ Important Best Practices

---

✔ Never hardcode passwords
✔ Use secure string input
✔ Use try-catch for error handling
✔ Validate CSV before execution
✔ Test in lower environment first

---

🔴 Common Errors

---

Login Failed

👉 Wrong credentials / Auth type

---

API Error

👉 Wrong endpoint / URL

---

Account Not Onboarded

👉 Missing Safe / Platform

---

SSL Issue

👉 Certificate validation problem

---

🎯 Final Thoughts

CyberArk REST API is a game-changer for automation

👉 Manual work → Automated workflows
👉 Time-consuming → Efficient

💡 If you master this → You move from Admin → Automation Engineer