{
 "categories": [
  "identity",
  "enterprise"
 ],
 "deployment": "on-prem",
 "evidence": [
  {
   "date": "2026-09-13",
   "fact": "homepage",
   "note": "Opened CyberArk/Idira docs home for Privileged Access Manager - Self-Hosted. It describes protecting, controlling, and monitoring privileged access across on-premises, cloud, and hybrid infrastructure.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/resources/_topnav/cc_home.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "vendor",
   "note": "The opened docs home is published on docs.cyberark.com for Privileged Access Manager - Self-Hosted, separately from Privilege Cloud documentation.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/resources/_topnav/cc_home.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "name",
   "note": "The opened docs home titles the product Privileged Access Manager - Self-Hosted.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/resources/_topnav/cc_home.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "deployment",
   "note": "REST APIs are part of the PVWA installation on a customer PasswordVault server, not a CyberArk-hosted Privilege Cloud tenant.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "platforms[0]",
   "note": "PACLI package contents and setup paths (Pacli.exe, libeay64.dll, c:/windows/syswow64) document a Windows command-line utility.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/PACLI/Introduction.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "platforms[1]",
   "note": "The PAM Self-Hosted API is a REST web service on PVWA HTTPS URLs such as /PasswordVault/API/...",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "license",
   "note": "The opened REST overview states the license must enable the Idira PAM Self-Hosted APIs and to contact Technical Support. That is a commercial, license-gated product. The page still lives on docs.cyberark.com.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "status",
   "note": "The 2026 CyberArk docs home titles Privileged Access Manager - Self-Hosted as current documentation, distinct from Privilege Cloud.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/resources/_topnav/cc_home.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.exists",
   "note": "CyberArk documents REST APIs to create, list, modify, and delete PAM Self-Hosted entities from programs and scripts. APIs ship with PVWA.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.kinds[0]",
   "note": "The PAM Self-Hosted API is documented as a RESTful HTTPS interface. Swagger is at /PasswordVault/swagger/docs/v1.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.auth[0]",
   "note": "2nd gen Logon POSTs username and password to /PasswordVault/API/auth/Cyberark/Logon/, /Windows/Logon/, /LDAP/Logon/, or /RADIUS/Logon/ and returns a session token. Default session length is 20 minutes. Concurrent sessions are optional, up to 300.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/SDK/CyberArk%20Authentication%20-%20Logon_v10.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.auth[0]",
   "note": "Every REST call except Logon must include an HTTPS Authorization header containing the Logon session token.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.coverage",
   "note": "GET /PasswordVault/API/Accounts returns vault accounts as JSON with search, filter, offset, and limit (max 1000). List Accounts permission is required on the Safe.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/SDK/GetAccounts.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.coverage",
   "note": "POST /PasswordVault/API/Accounts adds a privileged account or SSH key. platformId and safeName are mandatory. Add account permission is required. An extra license is required for SSH keys.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/WebServices/Add%20Account%20v10.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.docs",
   "note": "Opened as the current PAM Self-Hosted REST APIs overview, including auth header rules, PUT semantics, return codes, and the PACLI fallback pointer.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.cli.exists",
   "note": "CyberArk documents PACLI as the Command Line Interface SDK (Pacli.exe). INIT, DEFINEFROMFILE, LOGON, OPENSAFE, STOREFILE, and SAFESLIST are shown. Vendor recommends PACLI only when REST cannot perform the task. Unspecified passwords prompt interactively.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/PACLI/Introduction.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.data_access.export[0]",
   "note": "GET /PasswordVault/API/Accounts returns application/json account collections.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/SDK/GetAccounts.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.data_access.import[0]",
   "note": "POST /PasswordVault/API/Accounts accepts an application/json body to create an account.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/WebServices/Add%20Account%20v10.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.rpa.ui_stack[0]",
   "note": "CyberArk states REST automates tasks usually performed in the UI. The interactive console in scope is the PVWA web application. No UI probe was run.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "https://docs.cyberark.com/llms.txt returned 404 on 2026-09-13, so llms_txt is recorded as false.",
   "source": "https://docs.cyberark.com/llms.txt",
   "tier": "scraped"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.mcp.first_party",
   "note": "The opened REST and PACLI pages document HTTP APIs and PACLI. They do not declare a first-party MCP server or its absence, so first_party stays unknown.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "verdict.scores.api",
   "note": "Official, versioned REST with Logon session tokens, Swagger, account list/create, and a documented compatibility policy is a broad on-prem path. License gates, 20-minute sessions, Safe ACLs, and PACLI-only leftovers keep the score at 7.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "verdict.scores.cli",
   "note": "PACLI is official and can manage users, Safes, files, and lists, but CyberArk tells callers to prefer REST, and LOGON prompts for a password when it is omitted. That is a usable but gated fallback, scored 5.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/PACLI/Introduction.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as the current PAM Self-Hosted REST APIs overview.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current 2nd gen Logon reference for CyberArk, Windows, LDAP, and RADIUS.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/SDK/CyberArk%20Authentication%20-%20Logon_v10.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current PACLI SDK introduction.",
   "source": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/PACLI/Introduction.htm",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current Privileged Access Manager - Self-Hosted docs home.",
   "source": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/resources/_topnav/cc_home.htm",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-13",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm"
   },
   {
    "type": "docs",
    "url": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/SDK/CyberArk%20Authentication%20-%20Logon_v10.htm"
   },
   {
    "type": "docs",
    "url": "https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/PACLI/Introduction.htm"
   },
   {
    "type": "docs",
    "url": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/resources/_topnav/cc_home.htm"
   }
  ]
 },
 "homepage": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/resources/_topnav/cc_home.htm",
 "id": "cyberark-pam-self-hosted",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": false
  },
  "api": {
   "auth": [
    "session-token"
   ],
   "coverage": "partial",
   "docs": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json"
   ],
   "import": [
    "json"
   ]
  },
  "extensibility": {
   "scripting": [],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": "unknown",
   "third_party": [],
   "verdict": "unknown"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. Documented machine paths are the PAM Self-Hosted REST APIs on PVWA and the PACLI command-line SDK. This record is CyberArk Privileged Access Manager Self-Hosted. It is not CyberArk Privilege Cloud and not HashiCorp Vault.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "CyberArk Privileged Access Manager Self-Hosted",
 "platforms": [
  "windows",
  "web"
 ],
 "related": {
  "alternatives": [
   "hashicorp-vault",
   "1password",
   "bitwarden"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "CyberArk",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 7,
   "cli": 5,
   "computer_use": null,
   "integrations": null,
   "mcp": null,
   "overall": 7,
   "rpa": null
  },
  "summary": "CyberArk Privileged Access Manager Self-Hosted is automatable today through its PVWA REST APIs. This record is the self-hosted Password Vault / PVWA edition. It is not Privilege Cloud. Opened docs title the product Privileged Access Manager - Self-Hosted and state that REST commands create, list, modify, and delete PAM entities from programs and scripts. APIs ship with PVWA. After Logon, every other call sends the session token in the Authorization header. The 2nd gen Logon paths are POST /PasswordVault/API/auth/Cyberark/Logon/, /Windows/Logon/, /LDAP/Logon/, and /RADIUS/Logon/; the default session is 20 minutes. GET /PasswordVault/API/Accounts lists vault accounts with search, filter, offset, and a 1000-row limit. POST /PasswordVault/API/Accounts adds a privileged account or SSH key when the caller has Add account permission. Swagger is at /PasswordVault/swagger. CyberArk recommends PACLI only when a REST method does not exist; PACLI INIT/LOGON/STOREFILE examples can prompt for a password. Material limits are an on-prem vault and PVWA, a license that must enable the APIs, short-lived session tokens, Safe-level permissions, and some vault tasks remaining PACLI-only. First-party MCP ownership is not established. Computer-use viability is unassessed. API scores 7 and is the best path because vendor docs present REST as the primary automation surface and PACLI as the fallback.\n"
 }
}