---
updatedAt: 2026-07-02T14:47:16.000Z
---

# Create PAM Integration

Creates a new PAM integration configuration

# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "x-explorer-enabled": false,
  "info": {
    "title": "Site API (Legacy)",
    "license": {
      "name": "(c) Copyright 2021 WhiteHat Security"
    },
    "version": "1.0.0"
  },
  "servers": [
    {
      "url": "https://sentinel.whitehatsec.com"
    }
  ],
  "paths": {
    "/api/pam_integration": {
      "post": {
        "description": "Creates a new PAM integration configuration",
        "operationId": "createPAMIntegration",
        "requestBody": {
          "content": {
            "application/json": {
              "examples": {
                "app_role": {
                  "summary": "App Role authentication example",
                  "value": {
                    "name": "Production Vault AppRole",
                    "pam_endpoint": "https://vault-prod.acme.com:8200",
                    "client_id": 789,
                    "pam_auth_type": "Vault",
                    "pam_authentication_method": "app_role",
                    "identifier": "my-app-role-id",
                    "identifier_secret": "secret-id-value",
                    "namespace": "admin/production"
                  }
                },
                "credentials": {
                  "summary": "Credentials authentication example",
                  "value": {
                    "name": "Dev Boundary Server",
                    "pam_endpoint": "https://boundary-dev.acme.com:9200",
                    "client_id": 789,
                    "pam_auth_type": "Boundary",
                    "pam_authentication_method": "credentials",
                    "identifier": "boundary-admin",
                    "identifier_secret": "SecureP@ssw0rd",
                    "pam_authentication_method_id": "ampw_1a2b3c4d5e"
                  }
                },
                "token": {
                  "summary": "Token authentication example",
                  "value": {
                    "name": "Staging Boundary API",
                    "pam_endpoint": "https://boundary.staging.acme.com:9200",
                    "client_id": 789,
                    "pam_auth_type": "Boundary",
                    "pam_authentication_method": "token",
                    "identifier_secret": "at_AbCdEf1234567890..."
                  }
                }
              },
              "schema": {
                "$ref": "#/components/schemas/CreatePAMIntegrationRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "description": "PAM integration created successfully",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PAMIntegration"
                },
                "examples": {
                  "app_role_response": {
                    "summary": "App Role authentication response",
                    "value": {
                      "id": 101,
                      "name": "Production Vault AppRole",
                      "pam_endpoint": "https://vault-prod.acme.com:8200",
                      "pam_authentication_method": "app_role",
                      "pam_authentication_method_id": null,
                      "namespace": "admin/production",
                      "organization": "Acme Corporation",
                      "client_id": 789,
                      "pam_auth_type": "Vault",
                      "pam_auth_type_id": 3,
                      "identifier_secret": null,
                      "identifier": "my-app-role-id"
                    }
                  },
                  "credentials_response": {
                    "summary": "Credentials authentication response",
                    "value": {
                      "id": 102,
                      "name": "Dev Boundary Server",
                      "pam_endpoint": "https://boundary-dev.acme.com:9200",
                      "pam_authentication_method": "credentials",
                      "pam_authentication_method_id": "ampw_1a2b3c4d5e",
                      "namespace": null,
                      "organization": "Acme Corporation",
                      "client_id": 789,
                      "pam_auth_type": "Boundary",
                      "pam_auth_type_id": 2,
                      "identifier_secret": null,
                      "identifier": "boundary-admin"
                    }
                  },
                  "token_response": {
                    "summary": "Token authentication response",
                    "value": {
                      "id": 103,
                      "name": "Staging Boundary API",
                      "pam_endpoint": "https://boundary.staging.acme.com:9200",
                      "pam_authentication_method": "token",
                      "pam_authentication_method_id": null,
                      "namespace": null,
                      "organization": "Acme Corporation",
                      "client_id": 789,
                      "pam_auth_type": "Boundary",
                      "pam_auth_type_id": 2,
                      "identifier_secret": null,
                      "identifier": null
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad Request - Missing/invalid fields",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BadRequestError"
                },
                "examples": {
                  "missing_field": {
                    "summary": "Missing required field",
                    "value": {
                      "error": "Missing or empty required field: name",
                      "status": 400
                    }
                  },
                  "invalid_format": {
                    "summary": "Invalid field format",
                    "value": {
                      "error": "Invalid endpoint URL format",
                      "status": 400
                    }
                  },
                  "invalid_method": {
                    "summary": "Invalid authentication method",
                    "value": {
                      "error": "Field 'identifier' is not allowed for token authentication method",
                      "status": 400
                    }
                  }
                }
              }
            }
          },
          "403": {
            "description": "Forbidden - Access denied",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ForbiddenError"
                }
              }
            }
          },
          "404": {
            "description": "Not Found - Client or auth type not found",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/NotFoundError"
                },
                "examples": {
                  "client_not_found": {
                    "summary": "Client not found",
                    "value": {
                      "error": "Client Id Not Found",
                      "status": 404
                    }
                  },
                  "auth_type_not_found": {
                    "summary": "Auth type not found",
                    "value": {
                      "error": "PAM Auth Type Not Found",
                      "status": 404
                    }
                  }
                }
              }
            }
          },
          "409": {
            "description": "Conflict - Name already exists",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConflictError"
                }
              }
            }
          },
          "500": {
            "description": "Internal Server Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalServerError"
                }
              }
            }
          }
        },
        "summary": "Create PAM Integration",
        "tags": [
          "PAM Integration API v1.0"
        ]
      }
    }
  },
  "components": {
    "schemas": {
      "CreatePAMIntegrationRequest": {
        "type": "object",
        "required": [
          "name",
          "pam_endpoint",
          "client_id",
          "pam_auth_type",
          "pam_authentication_method",
          "identifier_secret"
        ],
        "properties": {
          "name": {
            "type": "string",
            "description": "Name for the PAM integration (must be unique per client)",
            "example": "Staging Boundary API"
          },
          "pam_endpoint": {
            "type": "string",
            "format": "uri",
            "description": "PAM service endpoint URL (must start with http:// or https://)",
            "example": "https://boundary.staging.acme.com:9200"
          },
          "client_id": {
            "type": "integer",
            "description": "Client ID",
            "example": 789
          },
          "pam_auth_type": {
            "type": "string",
            "enum": [
              "Boundary",
              "Vault"
            ],
            "description": "PAM system type",
            "example": "Boundary"
          },
          "pam_authentication_method": {
            "type": "string",
            "enum": [
              "token",
              "credentials",
              "app_role"
            ],
            "description": "Authentication method. Required additional fields:\n- **token**: none\n- **credentials**: identifier, pam_authentication_method_id\n- **app_role**: identifier, namespace\n",
            "example": "token"
          },
          "identifier_secret": {
            "type": "string",
            "description": "Required: API token (token), password (credentials), or Secret ID (app_role)",
            "example": "at_AbCdEf1234567890..."
          },
          "identifier": {
            "type": "string",
            "description": "Required for credentials (username/email) and app_role (role ID). Not used for token",
            "example": "boundary-admin"
          },
          "pam_authentication_method_id": {
            "type": "string",
            "description": "Required for credentials only. Boundary auth method ID",
            "example": "ampw_1a2b3c4d5e"
          },
          "namespace": {
            "type": "string",
            "description": "Required for app_role only. Vault namespace path",
            "example": "admin/production"
          }
        }
      },
      "Error": {
        "type": "object",
        "required": [
          "error",
          "status"
        ],
        "properties": {
          "error": {
            "type": "string",
            "description": "Error message describing what went wrong"
          },
          "status": {
            "type": "integer",
            "description": "HTTP status code"
          }
        }
      },
      "BadRequestError": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Error"
          },
          {
            "type": "object",
            "example": {
              "error": "Missing or empty required field: name",
              "status": 400
            }
          }
        ]
      },
      "ForbiddenError": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Error"
          },
          {
            "type": "object",
            "example": {
              "error": "Access denied",
              "status": 403
            }
          }
        ]
      },
      "NotFoundError": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Error"
          },
          {
            "type": "object",
            "example": {
              "error": "PAM integration not found for ID 1",
              "status": 404
            }
          }
        ]
      },
      "ConflictError": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Error"
          },
          {
            "type": "object",
            "example": {
              "error": "PAM credentials with name 'Production Vault' already exists for this client",
              "status": 409
            }
          }
        ]
      },
      "InternalServerError": {
        "allOf": [
          {
            "$ref": "#/components/schemas/Error"
          },
          {
            "type": "object",
            "example": {
              "error": "Internal server error",
              "status": 500
            }
          }
        ]
      },
      "PAMIntegration": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "example": 453
          },
          "name": {
            "type": "string",
            "example": "Staging Boundary API"
          },
          "pam_endpoint": {
            "type": "string",
            "example": "https://boundary.staging.acme.com:9200"
          },
          "pam_authentication_method": {
            "type": "string",
            "enum": [
              "token",
              "credentials",
              "app_role"
            ],
            "example": "token"
          },
          "pam_authentication_method_id": {
            "type": "string",
            "nullable": true,
            "description": "Auth method ID. Present for credentials, null otherwise",
            "example": null
          },
          "namespace": {
            "type": "string",
            "nullable": true,
            "description": "Namespace path. Present for app_role, null otherwise",
            "example": null
          },
          "organization": {
            "type": "string",
            "example": "Acme Corporation"
          },
          "client_id": {
            "type": "integer",
            "example": 789
          },
          "pam_auth_type": {
            "type": "string",
            "enum": [
              "Boundary",
              "Vault"
            ],
            "example": "Boundary"
          },
          "pam_auth_type_id": {
            "type": "integer",
            "description": "2 for Boundary, 3 for Vault",
            "example": 2
          },
          "identifier_secret": {
            "type": "string",
            "nullable": true,
            "description": "Always null in responses",
            "example": null
          },
          "identifier": {
            "type": "string",
            "nullable": true,
            "description": "Username (credentials), role ID (app_role), or null (token)",
            "example": null
          }
        }
      }
    }
  },
  "x-readme": {
    "proxy-enabled": true
  }
}
```