Hello everyone,
I’m currently working on CyberArk External Vault integration in Dynatrace using the allowed machines (host-based) method and ran into confusing behavior.
Setup summary:
Using Application ID, Safe Name, and Account Name from CyberArk.
The default URL with the folder path was returning 404, so we removed the folder segment and passed the account name in the object parameter instead.
After this change, API calls return 200 and password rotation works. Dynatrace updates successfully when the authentication account password changes.
The challenge:
When I try to use another account stored in the same CyberArk safe (same Application ID and Safe Name but different account), Dynatrace still shows the same username/password from the authentication account rather than the new CyberArk credential. It looks like Dynatrace keeps pulling the authentication identity instead of the requested account.
Has anyone faced similar behavior while configuring CyberArk external vault integration?
Is this expected when using the same AppID/Safe, or is there an additional mapping or parameter required so Dynatrace retrieves the actual target account?
Any real-world experience or guidance would help.
