External credential vault in RPA Hub
Summarize
Summary of External credential vault in RPA Hub
The external credential vault feature in RPA Hub enables secure retrieval of sensitive credentials such as robot credentials, application credentials, and Time-based One-time Password (TOTP) seeds during automation execution. This feature integrates with external credential vaults (e.g., CyberArk, Azure Key Vault) to enhance credential security by avoiding storage or logging of sensitive data within the ServiceNow instance.
Show less
How It Works
- Robots in the customer environment request sensitive data via GraphQL API calls to RPA Hub during automation.
- The External Credential checkbox on robot, application credential, or TOTP authenticator forms determines the source of credentials:
- If unchecked, credentials are stored and retrieved from the ServiceNow instance (Password2 field).
- If checked, credentials or TOTP seeds are fetched from a configured external credential vault.
- When using an external vault, RPA Hub triggers a subflow that makes a REST API call to the vault, either directly or routed through a MID Server located in the customer environment, depending on organizational requirements.
- After retrieval, the credentials are securely sent to the robot to proceed with automation activities, such as logging into applications like SAP.
Key Configuration and Security Considerations
- Proper configuration of external credential settings is essential to prevent sensitive data from being stored or logged in ServiceNow.
- The Reporting field for the external credential vault subflow must be set to Off to ensure sensitive data is not captured in logs.
- Outbound request logging can be enabled to monitor and debug third-party service calls and integration activity without compromising security.
- Use of the MID Server for REST API calls to the external vault provides a secure connection option within the customer network.
Practical Benefits for ServiceNow Customers
- Enables secure, centralized management of credentials for RPA robots and applications without exposing sensitive data in ServiceNow instances.
- Supports compliance and security policies by integrating with established external vault solutions.
- Flexible connection options (direct or via MID Server) allow customization based on organizational infrastructure and security requirements.
- Helps maintain auditability and transparency through outbound logging while safeguarding credential confidentiality.
With the external credential vault feature, you can retrieve robot credentials, application credentials, or Time-based One-time Password (TOTP) seed.
External credential vault integration with RPA Hub
The following diagram shows the integration of an external credential vault with RPA Hub.
A robot resides in the customers' environment. If the robot requires sensitive data during the automation execution, then the robot makes a GraphQL Application Programming Interface (API) call to the RPA Hub. An example of the sensitive data is user name and password details while logging in to an SAP application.
- If the input is false (if the check box isn’t selected), the credentials are saved or retrieved from the instance.
- If the input is true (if the check box is selected in the robot credential form, an application credential form), the credentials are fetched from a configured external credential vault. If the check box is selected in the TOTP authenticator form, the seed is fetched from a configured external credential vault.
Examples of an external credential vault are CyberArk, Azure key Vault, and so on.
If the External Credential check box isn’t enabled, the API returns the data stored in the Password2 field of the ServiceNow instance and then the robot uses the sensitive data for the automation execution.
If the External Credential check box is enabled, the credentials are fetched from a configured external credential vault. In this scenario, the API internally triggers a subflow. This subflow makes a REST API call to the external credential vault. You can route this REST API call via MID Server. Or, you can directly establish a connection with the external credential vault. This implementation is dependent on your organizational requirements. The MID Server resides in the customers' environment. For more information about MID Server, see .
After the REST API call fetches the credential from the vault, the credentials are sent to the robot.
Important information
You must configure the external credential settings appropriately, so that the data isn’t stored or logged in the ServiceNow instance.
Verify that the value of the Reporting field is set to Off for the subflow of your external credential vault, for example Demo CyberArk Subflow. This setting verifies that the sensitive data isn’t captured or logged. For more information about configuring this setting, see .
To configure the external credential vault in RPA Hub, see Steps to configure an external credential vault in RPA Hub.
Outbound request logging enables you to understand what third party services your instance accesses and the volume of outbound requests. Additionally, logging can provide valuable information when debugging outbound integrations. For more information about system logging or outbound logging, see Configure outbound logging and Outbound web service logging properties.