Retrieve a managed local-account password from history
GET/computers/:computerId/managed-sids/:adminSid/password-history/:passwordHistoryId/password
Returns the decrypted password recorded under passwordHistoryId for a local account that is, or was, managed by Netwrix Privilege Secure for Discovery.
The body is a JSON string, for example "s3cret". Each retrieval is written to the audit log with the optional comment.
Who can call it
superadminandadmintokens that belong to a directory user always.useronly if the computer's Offline Access Management policy hasjita_or_persistent_users_can_access_passwordsset to true (403 otherwise) and the user is a system administrator of the computer (403 otherwise).- The built-in
secureoneaccount gets a 500 error (generic{error}body) because the audit log needs a directory user record; the password is not returned.
comment is required (422 Comment required to access password) when the feature setting password_comments is enabled.
Not supported on domain controllers (422 PasswordManagementNotSupportedError).
An unknown or malformed passwordHistoryId, or an entry with no stored password, is 409 Invalid Admin Password. An adminSid that is a current
administrator but not a managed SID is 422 Invalid Admin ID. An adminSid that is neither a managed SID nor a current administrator returns 500 (generic {error} body); send an adminSid that is a managed SID.
Required role: superadmin or admin; user only with the OAM policy flag and system-administrator status.
Request
Responses
- 200
- 401
- 403
- 404
- 409
- 422
- 500
The decrypted password as a JSON string.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).
No record has the :id in the path (the id is malformed or unknown). The body is the bare text Invalid <Type> ID (for example Invalid Computer ID, Invalid User ID) with Content-Type text/html; charset=utf-8, not JSON. Some routes return an empty body.
Invalid Admin Password: the passwordHistoryId does not match any entry of the account (any unknown or malformed value), or the entry has no stored password.
The request could not be processed, for example an id that is not a valid object id.
The server returns 500 (generic {error} body) for an adminSid that is neither a managed SID nor a current administrator, and for the built-in secureone account. Send a valid adminSid and use a directory user token.