> ## Documentation Index > Fetch the complete documentation index at: https://docs.2501.ai/llms.txt > Use this file to discover all available pages before exploring further. # Privileged access > Read credentials from CyberArk or WALLIX A PAM system is the privileged access management system that keeps your account passwords. 2501 can read credentials from **CyberArk**, through its Central Credential Provider (CCP), or from **WALLIX**. A credential of the **PAM account** type names a PAM system and a path. [Credentials](https://docs.2501.ai/0.19/core-concepts/credentials.md#pam-accounts) explains how 2501 reads its value. ![Privileged access](https://mintcdn.com/2501/Nw-5R3i4HUHiTxUb/images/privileged_access_list.png?fit=max\&auto=format\&n=Nw-5R3i4HUHiTxUb\&q=85\&s=6f8265f0d5e0e808a2e7cb9c793e5755) Privileged access: each row is a PAM system with its type and address. ## Before you start * The `enablePrivilegedAccess` [feature toggle](https://docs.2501.ai/0.19/deployment/feature-toggles.md) must be on. When it is off, Command Center does not show **Privileged access** or the **PAM account** type. * You must be an administrator. Other roles do not see **Privileged access**. * The engine must reach the PAM system over HTTPS. When you set an [outbound proxy](https://docs.2501.ai/0.19/deployment/configuration.md#outbound-proxy), the engine goes through it. To reach the PAM system directly, add its host to `proxy.noProxy`. * For CyberArk, you need an application ID that signs in to the CCP with a client certificate. The application must have access to the safes that 2501 reads. * For WALLIX, you need an API user and its API key. The API user must have password retrieval on the accounts that 2501 checks out. ## Add a PAM system ![New PAM system](https://mintcdn.com/2501/Nw-5R3i4HUHiTxUb/images/privileged_access_new.png?fit=max\&auto=format\&n=Nw-5R3i4HUHiTxUb\&q=85\&s=f80bf0590f087192afcc652f12d54bd9) New PAM system: the sign-in fields change with the type. **1. Open the form** In Command Center, click **Privileged access**, then click **Add PAM system**. **2. Enter the name and the scope** Enter a name that tells the PAM system apart, for example `acme-cyberark`. Select the scope. An organization PAM system is available only to the credentials of that organization. A tenant-wide PAM system is available to all organizations. The tenant scope requires tenant-level access. **3. Select the type** Select **CyberArk** or **WALLIX**. **4. Enter the connection** Enter the **Address** of the PAM system, for example `https://ccp.acme.internal/AIMWebService` or `https://bastion.acme.internal`. For CyberArk, if you enter only the host, 2501 adds `/AIMWebService`. If the PAM system uses a private certificate authority, paste its **CA bundle** in PEM format. Keep **Verify the PAM system's certificate** selected. **5. Enter the sign-in values** Enter the values that 2501 signs in with. The [sign-in fields](#sign-in-fields) table lists them for each type. **6. Save and test** Click **Add PAM system**. On the page of the PAM system, click **Sign in** in the **Test** panel. The engine signs in as a task does and shows the answer of the PAM system. > [!WARNING] > > Clear **Verify the PAM system's certificate** only to try a PAM system with a self-signed certificate. Do not use this setting in production. ## Create a PAM account credential ![PAM account credential](https://mintcdn.com/2501/Nw-5R3i4HUHiTxUb/images/credential_pam_account.png?fit=max\&auto=format\&n=Nw-5R3i4HUHiTxUb\&q=85\&s=25af10f4da12dd516234d799fae5bedb) New credential of the PAM account type: a PAM system and a path. **1. Open the form** Click **Credentials**, then click **Create Credential**. **2. Select the type** Enter the name and the scope of the credential. Then select **PAM account** as the type. **3. Select the PAM system** Select the PAM system that keeps the account. The list shows only the PAM systems that the scope of the credential can use. **4. Enter the path** Enter the path of the account in the PAM system. The [path format](#path-format) section gives the format for each type. 2501 refuses a path that does not have the format of the PAM system. **5. Save** Click **Create Credential**. Use a PAM account credential as you use other credentials. You can [assign it to an agent](https://docs.2501.ai/0.19/configure/credentials.md#assigning-credentials-to-agents) to log in to a host. An agent can also use it by name during a task. ## Reference ### Sign-in fields 2501 keeps the sign-in values on the PAM system, not in a credential. The client certificate, the client key, the API key and the CA bundle are write-only. When you edit a PAM system, leave one of these fields empty to keep its saved value. | Type | Field | Value | | - | - | - | | CyberArk | **Application ID** | The application ID that 2501 signs in as, for example `2501-engine` | | CyberArk | **Client certificate (PEM)** | The client certificate of the application | | CyberArk | **Client key (PEM)** | The private key of the client certificate | | WALLIX | **API user** | The API user that 2501 signs in as, for example `svc-2501` | | WALLIX | **API key** | The API key of the API user | ### Path format | Type | Path | 2501 reads | | - | - | - | | CyberArk | `Safe/Object` | The password of the account | | CyberArk | `Safe/Object#UserName` | The `UserName` property. Use the name of a different property to read that property. | | WALLIX | `account@domain@device` | The password of the account. `#password` gives the same value. | | WALLIX | `account@domain@application` | The password of an application account | | WALLIX | `account@domain` | The password of an account in a global domain | | WALLIX | `account@domain@device#login` | The login of the account | | WALLIX | `account@domain@device#ssh_key` | The SSH private key of the account | ### Scope | Credential | PAM systems it can use | | - | - | | Organization credential | The PAM systems of its organization and the tenant-wide PAM systems | | Tenant-wide credential | The tenant-wide PAM systems only | ### Changes and deletion * You cannot change the type or the scope of a PAM system. To change them, add a new PAM system. * You can change the name, the address, the CA bundle and the sign-in values. Save the changes before you test. * You cannot delete a PAM system while credentials use it. The **Used by** panel shows these credentials. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.