# Send a credential from credential vault to extension configuration **URL:** \ **Category:** Extensions\ **Tags:** credential-vault, extensions\ **Created:** [April 8, 2024, 8:10pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052 "2024-04-08T20:10:19Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Benji\_Dynatrace](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@Benji\_Dynatrace](https://community.dynatrace.com/u/Benji_Dynatrace)\ **Post date:** [April 8, 2024, 8:10pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/1 "2024-04-08T20:10:19Z")
Hi, Title is pretty self-explanatory. I am looking for a way to use the credential vault to fill in a configuration entry so that we can prevent a password leak or something like that. Right now the text entries don’t seem to provide a way to reference an item in the credential vault, unless I am wrong. If there isn’t a way to do this, is this something you would consider adding in the future? Thanks, Benji\_Dynatrace ---
**Author:** ![AntonioSousa](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/antoniosousa/32/50_2.png) [@AntonioSousa](https://community.dynatrace.com/u/AntonioSousa)\ **Post date:** [April 8, 2024, 8:26pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/2 "2024-04-08T20:26:16Z")
[@Benji\_Dynatrace](https://community.dynatrace.com/user/70814), Have not used this yet, but seems to be available, according to the following two threads: [https://community.dynatrace.com/t5/Product-ideas/RFE-Extend-the-use-of-Credential-Vault-to-Dynatrace-Hub/idi-p/195571](https://community.dynatrace.com/post/195571) [https://community.dynatrace.com/t5/Extensions/Vaults-eg-Hashicorp-CyberArk-in-Dynatrace-extensions/m-p/202878](https://community.dynatrace.com/post/202878) ---
**Author:** ![Mike\_L](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/mike_l/32/11717_2.png) [@Mike\_L](https://community.dynatrace.com/u/Mike_L)\ **Post date:** [April 9, 2024, 9:10am UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/3 "2024-04-09T09:10:52Z")
It’s up to each extension to implement such a feature. If you’re missing it for a specific one which is available on the Dynatrace hub, please raise a product idea on the community forum. When creating an extension in extension framework 2.0 it’s possible to add credential vault support to the activation schema using this format: ```javascript "useCredentialVault": { "displayName": "Use credential vault", "type": "boolean", "nullable": false, "default": true, "maxObjects": 1 }, "credentialVaultId": { "displayName": "Select Vault credentials", "nullable": true, "type": "text", "subType": "credential", "referencedType": "USERNAME_PASSWORD", "maxObjects": 1, "precondition": { "type": "EQUALS", "property": "useCredentialVault", "expectedValue": true }, "constraints": [ { "type": "NOT_BLANK" } ] }, "username": { "displayName": "User Name", "type": "text", "nullable": false, "default": "", "precondition": { "type": "EQUALS", "property": "useCredentialVault", "expectedValue": false }, "constraints": [ { "type": "LENGTH", "minLength": 1, "maxLength": 500 } ], "maxItems": 1 }, "password": { "displayName": "Password", "type": "secret", "nullable": false, "default": "", "precondition": { "type": "EQUALS", "property": "useCredentialVault", "expectedValue": false }, "constraints": [ { "type": "LENGTH", "minLength": 1, "maxLength": 500 } ], "maxItems": 1 } ``` ---
**Author:** ![Benji\_Dynatrace](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@Benji\_Dynatrace](https://community.dynatrace.com/u/Benji_Dynatrace)\ **Post date:** [April 9, 2024, 12:16pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/4 "2024-04-09T12:16:34Z")
That’s exactly it, thank you so much! ---
**Author:** ![pvr](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@pvr](https://community.dynatrace.com/u/pvr)\ **Post date:** [December 23, 2024, 6:54pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/5 "2024-12-23T18:54:34Z")
Hi [@Mike\_L](https://community.dynatrace.com/user/11520) , [@Benji\_Dynatrace](https://community.dynatrace.com/user/70814) , The above answers is oriented towards extensions developers,  not users.  What if I want to use an extension published on the extensions hub, with Vault based secrets in the configuration ?  it seems there is not type-ahead or suggest feature when I click on the text box ? e.g.  F5 Big IP extn 2.0 So, I say the original question still remains,  is it possible to use a specific format of intput to suggest that we are using a vault secret (similar to synthetics {} syntax) and not a plain text ? Please help ? ---
**Author:** ![Mike\_L](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/mike_l/32/11717_2.png) [@Mike\_L](https://community.dynatrace.com/u/Mike_L)\ **Post date:** [December 24, 2024, 1:11am UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/6 "2024-12-24T01:11:31Z")
It is only possible if the extension developer has added the above code, in which case you get a dropdown with your credential vault items. ---
**Author:** ![r\_weber](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/r_weber/32/24884_2.png) [@r\_weber](https://community.dynatrace.com/u/r_weber)\ **Post date:** [July 19, 2025, 6:41pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/7 "2025-07-19T18:41:30Z")
Came accross this, becasue I just wanted to build vault support into one extension as well. From a UI configuration side this is all fine, but how would I get the actual value of the CV item in e.g. the python code of my extension? ---
**Author:** ![TorstenHellwig](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/torstenhellwig/32/33996_2.png) [@TorstenHellwig](https://community.dynatrace.com/u/TorstenHellwig)\ **Post date:** [August 13, 2025, 10:09am UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/8 "2025-08-13T10:09:28Z")
Well, that’s half of it I’d say. There is no documented way to access the content of a credential vault entry. The REST api just delivers meta data and I could not find an extension function to do this. So what am I missing here? ---
**Author:** ![Julius\_Loman](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/julius_loman/32/51_2.png) [@Julius\_Loman](https://community.dynatrace.com/u/Julius_Loman)\ **Post date:** [August 13, 2025, 1:29pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/9 "2025-08-13T13:29:02Z")
[@TorstenHellwig](https://community.dynatrace.com/user/22828), afaik, Dynatrace automatically populates the values (in the example above for username and password), you will also get the credential vault entry id). So you don’t need to call anything, you just have the values directly in activation\_config as for any other configuration properties. ---
**Author:** ![r\_weber](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/r_weber/32/24884_2.png) [@r\_weber](https://community.dynatrace.com/u/r_weber)\ **Post date:** [August 13, 2025, 1:33pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/10 "2025-08-13T13:33:29Z")
That’s what I would have expected, but it doesn’t seem to be the case … In the above example ‘password’ and ‘username’ would only be filled if ‘useCredentialVault’ is false. Otherwise ‘credentialVaultId’ just contains the vault ID, but no additional fields for ‘username’ or ‘password’. ---
**Author:** ![Julius\_Loman](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/julius_loman/32/51_2.png) [@Julius\_Loman](https://community.dynatrace.com/u/Julius_Loman)\ **Post date:** [August 13, 2025, 2:46pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/11 "2025-08-13T14:46:39Z")
[@r\_weber](https://community.dynatrace.com/user/35901) works for me. A very dirty minimal example attached. If executed and configured with a credential vault, I get the values from the vault. Actual snippet from extension log on a oneagent. ```markup [b9fbad40-5573-32cf-8a7e-26873b3d0e38][python-b9fbad40-5573-32cf-8a7e-26873b3d0e38][3344887][out]2025-08-13 16:41:29,029 [INFO] credential_vault (ThreadPoolExecutor-0_0): query method started for credential_vault. [b9fbad40-5573-32cf-8a7e-26873b3d0e38][python-b9fbad40-5573-32cf-8a7e-26873b3d0e38][3344887][err]2025-08-13 16:41:29,029 [ERROR] credential_vault (ThreadPoolExecutor-0_0): ActivationConfig(version='0.0.2', enabled=True, description='test', type=ActivationType.LOCAL, config={'endpoints': [{'useCredentialVault': True, 'credentialVaultId': 'CREDENTIALS_VAULT-8E8E7AC5C1C97734', 'username': 'api-dyntrace-user', 'password': 'DynaPassword'}]}) [b9fbad40-5573-32cf-8a7e-26873b3d0e38][python-b9fbad40-5573-32cf-8a7e-26873b3d0e38][3344887][out]2025-08-13 16:41:29,029 [INFO] credential_vault (ThreadPoolExecutor-0_0): query method ended for credential_vault. ``` [credential\_vault.zip](https://community.dynatrace.com/uploads/short-url/ogi3yKDeeAlrGfkCMF5Jg8OE29w.zip) (10.9 KB) ---
**Author:** ![calfanonerey](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@calfanonerey](https://community.dynatrace.com/u/calfanonerey)\ **Post date:** [August 14, 2025, 3:26pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/12 "2025-08-14T15:26:12Z")
thanks for providing this! is there any documentation out there that you referenced to accomplish this? ---
**Author:** ![r\_weber](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/r_weber/32/24884_2.png) [@r\_weber](https://community.dynatrace.com/u/r_weber)\ **Post date:** [August 14, 2025, 4:08pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/13 "2025-08-14T16:08:08Z")
Thanks [@Julius\_Loman](https://community.dynatrace.com/user/3364) , that is interesting indeed. Exactly what I’d have expected. Wondering why it didn’t work in my example and where I went wrong. However I used a more complex example with custom schemas, but in principle it was the same config. So in one case (not using credential vault) the config[‘username’] is filled and in the other case (using credential vault) the config[‘credentialvaultid’][‘username’] is populated. Maybe I was looking at a way to always populate config[‘username’] so that there is no special handling in code required. ---
**Author:** ![Julius\_Loman](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/julius_loman/32/51_2.png) [@Julius\_Loman](https://community.dynatrace.com/u/Julius_Loman)\ **Post date:** [August 14, 2025, 5:08pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/14 "2025-08-14T17:08:56Z")
[@r\_weber](https://community.dynatrace.com/user/35901) no, it’s in the same properites, so no special code is needed. Without vault: [{‘useCredentialVault’: False, ‘username’: ‘user’, ‘password’: ‘password’}] With vault: [{‘useCredentialVault’: True, ‘credentialVaultId’: ‘CREDENTIALS\_VAULT-8E8E7AC5C1C97734’, ‘username’: ‘api-dyntrace-user’, ‘password’: ‘Ap;DynTR4ceUs3r’}] activationSchema is still a magic without (public) documentation. The best way to get with it is to find an extension which uses the feature you want, download it and look in the source how to do it. ---
**Author:** ![shahin24093](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@shahin24093](https://community.dynatrace.com/u/shahin24093)\ **Post date:** [August 27, 2025, 6:15pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/15 "2025-08-27T18:15:26Z")
[@Julius\_Loman](https://community.dynatrace.com/user/3364) thank you for your insight and sharing of this information, the zip file you shared helped me massively. And I was able to successfully pass credential vault id and capture username and password.  would you happen to know how to download an extension where there is a feature I want to take from for my Development?  I currently am using VS code and extensions are visible in our environment but I am unable to download/view the source code. My api key has all the extensions 2.0 scopes available. ---
**Author:** ![Julius\_Loman](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/julius_loman/32/51_2.png) [@Julius\_Loman](https://community.dynatrace.com/u/Julius_Loman)\ **Post date:** [August 27, 2025, 7:18pm UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/16 "2025-08-27T19:18:50Z")
[@shahin24093](https://community.dynatrace.com/user/74298) If the extension is already in your environment, you can download it directly to your VS Code workspace when initializing the workspace: ![Julius_Loman_1-1756322294605.png](https://global.discourse-cdn.com/dynatrace/original/3X/c/1/c1184ba70e6e7a0aea1202b4ac3bb83f3b6fa317.png) Another option is to grab it directly from the [hub page:](https://www.dynatrace.com/hub/?filter=all&type=extension) ![Julius_Loman_0-1756322020574.png](https://global.discourse-cdn.com/dynatrace/original/3X/1/1/11318b0abdcdcee8924955cfe7b0f8d55f671579.png) Find the extension you want, Open release notes (1), release (2), and click on download (3). You will download the extension package, which contains the extension, schema, and all python packages. ---
**Author:** ![TheAnswerIs42](https://avatars.discourse-cdn.com/v4/letter/t/e480ec/32.png) [@TheAnswerIs42](https://community.dynatrace.com/u/TheAnswerIs42)\ **Post date:** [March 16, 2026, 10:20am UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/17 "2026-03-16T10:20:53Z")
Hello, Here an extract of activationSchema.json file : {   “types”:{      “pythonRemote”:{         “type”:“object”,         “properties”:{            “useCredentialVault”:{               “displayName”:“Use credential vault”,               “type”:“boolean”,               “nullable”:false,               “default”:true,               “maxObjects”:1            },            “sshCredentialId”:{               “displayName”:“Clé privée SSH (depuis le Credential Vault)”,               “type”:“text”,               “subType”:“credential”,               “referencedType”:“TOKEN”,               “nullable”:true,               “precondition”:{                  “type”:“EQUALS”,                  “property”:“useCredentialVault”,                  “expectedValue”:true               },               “constraints”:[                  {                     “type”:“NOT\_BLANK”                  }               ]            }, […] I’m did cross test and I think the issue is about CredentialVault. My goal is to use the content of Id Rsa key as a Token in CredentialVault. Error when I deploy and add monitoring my python extension : ContentFailed to assign monitoring configuration to ActiveGate. Reason: Regards ![Capture d’écran 2026-03-16 112001.png](https://global.discourse-cdn.com/dynatrace/original/2X/6/621566a05474887de613ac09a331cc755a6a83f8.png) ---
**Author:** ![TheAnswerIs42](https://avatars.discourse-cdn.com/v4/letter/t/e480ec/32.png) [@TheAnswerIs42](https://community.dynatrace.com/u/TheAnswerIs42)\ **Post date:** [March 17, 2026, 8:52am UTC](https://community.dynatrace.com/t/send-a-credential-from-credential-vault-to-extension-configuration/45052/18 "2026-03-17T08:52:43Z")
Hello, The issue was other in setup.py : install\_requires=[“dt-extensions-sdk”, “paramiko”], This cause issue “PARAMIKO”.