{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":20481,"path":"integrate-applications/config-ext-cred-rpa.md","title":"Steps to configure an external credential vault in RPA Hub","bundle":null,"doc_type":null,"release":"australia","body":"\n# Steps to configure an external credential vault in RPA Hub\n\nUse this list of steps to guide you through all the tasks of configuring an external credential vault in RPA Hub.\n\nComplete all the tasks for a step before moving on to the next step.\n\nDo the steps in the order that they’re presented.\n\n<table id=\"table_ar4_w1b_5vb\"><thead><tr><th>\n\nTask\n\n</th><th>\n\nReference\n\n</th></tr></thead><tbody><tr><td>\n\n1. Create a subflow to integrate your external credential vault. For more information, see [Create a subflow in Workflow Studio](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/build-workflows/create-subflow.md).\n\n</td><td>\n\nFor reference, see the sample **Demo CyberArk Subflow** in your ServiceNow instance.\n\n</td></tr><tr><td>\n\n1.A. Verify that the subflow that you’re creating to integrate with the External Credential Vault, must have an input type as JSON. This input takes the value from the **Subflow Input** field of the Robot Credential, Application Credential, or Time-based One-time Password \\(TOTP\\) Authenticator.\n\nFor example, the robot credential or application credential or TOTP authenticators that are using the **Demo CyberArk** external credential vault, must align with the following JSON format:\n\n```\n{ \n\"appID\" : \"\",\n\"query\" : \"\"\n}\n```\n\nPopulate values for **appID** and **query**.\n\n</td><td>\n\n \n\n</td></tr><tr><td>\n\n1.B. You can use the REST Step in the subflow to connect with the external credential vault. You can also use other integration steps such as SOAP. For more information, see .\n\n</td><td>\n\n \n\n</td></tr><tr><td>\n\n1.C. Verify that the output of your subflow must be aligned with the following JSON schema.```\n{\n    \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n    \"type\": \"object\",\n    \"properties\": {\n        \"result\": {\n            \"type\": \"object\",\n            \"properties\": {\n                \"status\": {\n                    \"type\": \"string\",\n                    \"enum\": [\"success\", \"failure\"]\n                },\n                \"data\": {\n                    \"type\": \"object\",\n                    \"properties\": {\n                        \"username\": {\n                            \"type\": \"string\"\n                        },\n                        \"sensitiveValue\": {\n                            \"type\": \"string\"\n                        },\n                        \"additionalData\": {\n                            \"type\": \"object\"\n                        }\n                    },\n                    \"required\": [\"sensitiveValue\"]\n                },\n                \"error\": {\n                    \"type\": \"object\",\n                    \"properties\": {\n                        \"errorType\": {\n                            \"type\": \"string\"\n                        },\n                        \"errorMessage\": {\n                            \"type\": \"string\"\n                        },\n                        \"additionalErrorData\": {\n                            \"type\": \"object\"\n                        }\n                    },\n                    \"required\": [\"errorMessage\"]\n                }\n            },\n            \"required\": [\"status\"]\n        }\n    },\n    \"required\": [\"result\"]\n};\n```\n\n</td><td>\n\nThis schema is used by the Robotic Process Automation \\(RPA\\) GraphQL APIs to validate the subflow output. If the output isn’t aligned with this schema, an error is encountered. Error Message: `The JSON received from the subflow deviates from the expected JSON schema. Rectify the JSON structure by aligning it with the specified schema in the documentation.`\n\n</td></tr><tr><td>\n\n1.D. You can align with the expected JSON schema \\(mentioned in 1.C\\) by defining a JSON output with the name 'result' for the Subflow. For success status, this result output must be assigned with a JSON object of the following structure. Populate values for the keys defined in the JSON. The **status** and **sensitiveValue** keys are required.```\n{\n  \"status\": \"success\", //Mandatory\n  \"data\": {\n    \"username\": \"\",\n    \"sensitiveValue\": \"\" //Mandatory\n    \"additionalData\": {}\n  }\n}\n```\n\nFor failure status, this result output must be assigned with a JSON object of the following structure. Populate values for the keys defined in the JSON. The **status** and **errorMessage** keys are required.\n\n```\n{\n  \"status\": \"failure\", //Mandatory\n  \"error\": {\n    \"errorType\": \"\",\n    \"errorMessage\": \"\", //Mandatory\n     \"additionalErrorData\": {}\n  }\n}\n```\n\n</td><td>\n\n \n\n</td></tr><tr><td>\n\n2. Create an external credential vault record. For more information, see [Create an external credential vault record in RPA Hub](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/create-ext-cred-rpa.md).\n\n</td><td>\n\nFor reference, see the sample **Demo CyberArk** external credential vault in your ServiceNow instance.\n\n</td></tr><tr><td>\n\n3. Establish a connection with an external credential vault by using the ServiceNow Connections and Credentials. For more information about creating an active connection, see [Create an HTTP\\(s\\) connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-https-connection.md). While configuring the connection record, verify to align with your organizational security requirements.\n\n</td><td>\n\nFor reference, see the sample **Demo CyberArk Subflow** that uses **RPA CyberArk** connection and credential alias. Create a connection record in this connection and credential alias to establish connection with your CyberArk external vault.\n\n</td></tr><tr><td>\n\n4. To use the external credential vault record, that you created in step 2, navigate to either robot credential, application credential, or TOTP authenticator and select the **External Credential** check box. Also, select a record in the **External Credential Vault** field and populate the **Subflow Input** field with a valid JSON object. The JSON must contain the necessary information for retrieving credentials from the external credential vault.\n\n</td><td>\n\nFor more information about configuring these fields, see [Create a robot credential in RPA Hub](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/create-credential-set-botprocess.md), [Create an application credential in RPA Hub](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/create-application-credential.md), and [Create a TOTP authenticator in RPA Hub](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/map-totp-credential-set-rpa.md).\n\n</td></tr></tbody>\n</table>"}}