topic Re: Is there a way to send a credential from credential vault to extension configuration in Extensions

Send a credential from credential vault to extension configuration

Benji_Dynatrace — Fri, 10 May 2024 14:18:11 GMT

Hi,

Title is pretty self-explanatory. I am looking for a way to use the credential vault to fill in a configuration entry so that we can prevent a password leak or something like that. Right now the text entries don't seem to provide a way to reference an item in the credential vault, unless I am wrong. If there isn't a way to do this, is this something you would consider adding in the future?

Thanks,

Benji_Dynatrace

Re: Is there a way to send a credential from credential vault to extension configuration

AntonioSousa — Mon, 08 Apr 2024 20:26:16 GMT

@Benji_Dynatrace,

Have not used this yet, but seems to be available, according to the following two threads:
https://community.dynatrace.com/t5/Product-ideas/RFE-Extend-the-use-of-Credential-Vault-to-Dynatrace-Hub/idi-p/195571

https://community.dynatrace.com/t5/Extensions/Vaults-eg-Hashicorp-CyberArk-in-Dynatrace-extensions/m-p/202878

Re: Is there a way to send a credential from credential vault to extension configuration

Mike_L — Tue, 09 Apr 2024 09:10:52 GMT

It's up to each extension to implement such a feature. If you're missing it for a specific one which is available on the Dynatrace hub, please raise a product idea on the community forum.

When creating an extension in extension framework 2.0 it's possible to add credential vault support to the activation schema using this format:

"useCredentialVault": { "displayName": "Use credential vault", "type": "boolean", "nullable": false, "default": true, "maxObjects": 1 }, "credentialVaultId": { "displayName": "Select Vault credentials", "nullable": true, "type": "text", "subType": "credential", "referencedType": "USERNAME_PASSWORD", "maxObjects": 1, "precondition": { "type": "EQUALS", "property": "useCredentialVault", "expectedValue": true }, "constraints": [ { "type": "NOT_BLANK" } ] }, "username": { "displayName": "User Name", "type": "text", "nullable": false, "default": "", "precondition": { "type": "EQUALS", "property": "useCredentialVault", "expectedValue": false }, "constraints": [ { "type": "LENGTH", "minLength": 1, "maxLength": 500 } ], "maxItems": 1 }, "password": { "displayName": "Password", "type": "secret", "nullable": false, "default": "", "precondition": { "type": "EQUALS", "property": "useCredentialVault", "expectedValue": false }, "constraints": [ { "type": "LENGTH", "minLength": 1, "maxLength": 500 } ], "maxItems": 1 }

Re: Is there a way to send a credential from credential vault to extension configuration

Benji_Dynatrace — Tue, 09 Apr 2024 12:16:34 GMT

That's exactly it, thank you so much!

Re: Is there a way to send a credential from credential vault to extension configuration

pvr — Mon, 23 Dec 2024 18:54:34 GMT

Hi @Mike_L , @Benji_Dynatrace ,

The above answers is oriented towards extensions developers, not users. What if I want to use an extension published on the extensions hub, with Vault based secrets in the configuration ? it seems there is not type-ahead or suggest feature when I click on the text box ? e.g. F5 Big IP extn 2.0

So, I say the original question still remains, is it possible to use a specific format of intput to suggest that we are using a vault secret (similar to synthetics {} syntax) and not a plain text ?

Please help ?

Re: Is there a way to send a credential from credential vault to extension configuration

Mike_L — Tue, 24 Dec 2024 01:11:31 GMT

It is only possible if the extension developer has added the above code, in which case you get a dropdown with your credential vault items.

Re: Is there a way to send a credential from credential vault to extension configuration

r_weber — Sat, 19 Jul 2025 18:41:30 GMT

Came accross this, becasue I just wanted to build vault support into one extension as well.

From a UI configuration side this is all fine, but how would I get the actual value of the CV item in e.g. the python code of my extension?

Re: Is there a way to send a credential from credential vault to extension configuration

TorstenHellwig — Wed, 13 Aug 2025 10:09:28 GMT

Well, that's half of it I'd say. There is no documented way to access the content of a credential vault entry. The REST api just delivers meta data and I could not find an extension function to do this. So what am I missing here?

Re: Is there a way to send a credential from credential vault to extension configuration

Julius_Loman — Wed, 13 Aug 2025 13:29:02 GMT

@TorstenHellwig, afaik, Dynatrace automatically populates the values (in the example above for username and password), you will also get the credential vault entry id). So you don't need to call anything, you just have the values directly in activation_config as for any other configuration properties.

Re: Is there a way to send a credential from credential vault to extension configuration

r_weber — Wed, 13 Aug 2025 13:41:04 GMT

That's what I would have expected, but it doesn't seem to be the case ...

In the above example 'password' and 'username' would only be filled if 'useCredentialVault' is false.
Otherwise 'credentialVaultId' just contains the vault ID, but no additional fields for 'username' or 'password'.

Re: Is there a way to send a credential from credential vault to extension configuration

Julius_Loman — Wed, 13 Aug 2025 14:46:39 GMT

@r_weber works for me. A very dirty minimal example attached.

If executed and configured with a credential vault, I get the values from the vault. Actual snippet from extension log on a oneagent.

[b9fbad40-5573-32cf-8a7e-26873b3d0e38][python-b9fbad40-5573-32cf-8a7e-26873b3d0e38][3344887][out]2025-08-13 16:41:29,029 [INFO] credential_vault (ThreadPoolExecutor-0_0): query method started for credential_vault. [b9fbad40-5573-32cf-8a7e-26873b3d0e38][python-b9fbad40-5573-32cf-8a7e-26873b3d0e38][3344887][err]2025-08-13 16:41:29,029 [ERROR] credential_vault (ThreadPoolExecutor-0_0): ActivationConfig(version='0.0.2', enabled=True, description='test', type=ActivationType.LOCAL, config={'endpoints': [{'useCredentialVault': True, 'credentialVaultId': 'CREDENTIALS_VAULT-8E8E7AC5C1C97734', 'username': 'api-dyntrace-user', 'password': 'DynaPassword'}]}) [b9fbad40-5573-32cf-8a7e-26873b3d0e38][python-b9fbad40-5573-32cf-8a7e-26873b3d0e38][3344887][out]2025-08-13 16:41:29,029 [INFO] credential_vault (ThreadPoolExecutor-0_0): query method ended for credential_vault.

Re: Is there a way to send a credential from credential vault to extension configuration

calfanonerey — Thu, 14 Aug 2025 15:26:12 GMT

thanks for providing this! is there any documentation out there that you referenced to accomplish this?

Re: Is there a way to send a credential from credential vault to extension configuration

r_weber — Thu, 14 Aug 2025 16:14:16 GMT

Thanks @Julius_Loman , that is interesting indeed. Exactly what I'd have expected. Wondering why it didn't work in my example and where I went wrong. However I used a more complex example with custom schemas, but in principle it was the same config.

So in one case (not using credential vault) the config['username'] is filled and in the other case (using credential vault) the config['credentialvaultid']['username'] is populated.

Maybe I was looking at a way to always populate config['username'] so that there is no special handling in code required.

Re: Is there a way to send a credential from credential vault to extension configuration

Julius_Loman — Thu, 14 Aug 2025 17:08:56 GMT

@r_weber no, it's in the same properites, so no special code is needed.
Without vault:
[{'useCredentialVault': False, 'username': 'user', 'password': 'password'}]

With vault:
[{'useCredentialVault': True, 'credentialVaultId': 'CREDENTIALS_VAULT-8E8E7AC5C1C97734', 'username': 'api-dyntrace-user', 'password': 'Ap;DynTR4ceUs3r'}]

activationSchema is still a magic without (public) documentation. The best way to get with it is to find an extension which uses the feature you want, download it and look in the source how to do it.

Re: Is there a way to send a credential from credential vault to extension configuration

shahin24093 — Wed, 27 Aug 2025 18:15:26 GMT

@Julius_Loman thank you for your insight and sharing of this information, the zip file you shared helped me massively. And I was able to successfully pass credential vault id and capture username and password.
would you happen to know how to download an extension where there is a feature I want to take from for my Development? I currently am using VS code and extensions are visible in our environment but I am unable to download/view the source code. My api key has all the extensions 2.0 scopes available.

Re: Is there a way to send a credential from credential vault to extension configuration

Julius_Loman — Wed, 27 Aug 2025 19:18:50 GMT

@shahin24093

If the extension is already in your environment, you can download it directly to your VS Code workspace when initializing the workspace:

Another option is to grab it directly from the hub page:

Find the extension you want, Open release notes (1), release (2), and click on download (3). You will download the extension package, which contains the extension, schema, and all python packages.

Re: Is there a way to send a credential from credential vault to extension configuration

TheAnswerIs42 — Mon, 16 Mar 2026 10:20:53 GMT

Hello,

Here an extract of activationSchema.json file :

{

"types":{

"pythonRemote":{

"type":"object",

"properties":{

"useCredentialVault":{

"displayName":"Use credential vault",

"type":"boolean",

"nullable":false,

"default":true,

"maxObjects":1

"sshCredentialId":{

"displayName":"Clé privée SSH (depuis le Credential Vault)",

"type":"text",

"subType":"credential",

"referencedType":"TOKEN",

"nullable":true,

"precondition":{

"type":"EQUALS",

"property":"useCredentialVault",

"expectedValue":true

"constraints":[

{

"type":"NOT_BLANK"

}

]

},
[...]

I'm did cross test and I think the issue is about CredentialVault.

My goal is to use the content of Id Rsa key as a Token in CredentialVault.

Error when I deploy and add monitoring my python extension :

Content

Failed to assign monitoring configuration to ActiveGate. Reason:

Regards

Re: Send a credential from credential vault to extension configuration

TheAnswerIs42 — Tue, 17 Mar 2026 08:52:43 GMT

Hello,

The issue was other in setup.py :

install_requires=["dt-extensions-sdk", "paramiko"],

This cause issue "PARAMIKO".