Can AI agents automate CyberArk Privileged Access Manager Self-Hosted?

CyberArk Privileged Access Manager Self-Hosted is automatable today through its PVWA REST APIs. This record is the self-hosted Password Vault / PVWA edition. It is not Privilege Cloud. Opened docs title the product Privileged Access Manager - Self-Hosted and state that REST commands create, list, modify, and delete PAM entities from programs and scripts. APIs ship with PVWA. After Logon, every other call sends the session token in the Authorization header. The 2nd gen Logon paths are POST /PasswordVault/API/auth/Cyberark/Logon/, /Windows/Logon/, /LDAP/Logon/, and /RADIUS/Logon/; the default session is 20 minutes. GET /PasswordVault/API/Accounts lists vault accounts with search, filter, offset, and a 1000-row limit. POST /PasswordVault/API/Accounts adds a privileged account or SSH key when the caller has Add account permission. Swagger is at /PasswordVault/swagger. CyberArk recommends PACLI only when a REST method does not exist; PACLI INIT/LOGON/STOREFILE examples can prompt for a password. Material limits are an on-prem vault and PVWA, a license that must enable the APIs, short-lived session tokens, Safe-level permissions, and some vault tasks remaining PACLI-only. First-party MCP ownership is not established. Computer-use viability is unassessed. API scores 7 and is the best path because vendor docs present REST as the primary automation surface and PACLI as the fallback.

Best path today: api · Overall automatability: 7/10