Team Password Manager

Connect AI agents to a self-hosted Team Password Manager instance. Agents create and update stored passwords, generate replacements, archive or lock entries, organize them into projects, and manage the users and groups that can reach them.

43 actions Custom auth available

Team Password Manager website ↗ Platform Documentation ↗ Capability data verified 2026-08-05

A scheduled rotation window opens, because this connector has no triggers and nothing is pushed from the vault

Search Passwords with a vendor operator such as tag:prod returns the entries due for a new secret

Get Password Security lists every user and group holding read, edit data, or manage on each entry

Get Password confirms the entry is not locked and reads the custom fields naming the systems that consume it

Generate Password produces a candidate secret using the installation's own server side generator settings

The credential owner receives the consumer list, the systems named on the entry, and the proposed window

Owner confirms the window and the consumers, and only then does the agent call Update Password

What This Integration Enables

In most systems, reading is the safe operation and writing is the dangerous one. A password vault inverts that, and Team Password Manager is designed around the inversion. Get Password returns the decrypted secret and the custom fields alongside it. A Locked entry will not return at all until an unlock reason is supplied, which is the vendor deliberately putting a speed bump and an audit line in the read path. The API runs with the permissions of the user who owns the keys, so an agent here is not an abstract integration, it is a named vault user whose every retrieval is attributable to that person. Design accordingly: give the agent its own account, scope it with Update Password Security to exactly the projects it needs, and treat every action it takes as something a person will one day have to explain.

The surface is wide. Passwords support the full lifecycle, including Move Password between projects, Set Password Archived, Set Password Locked, and a permanent Delete Password. Get Password Security and Update Password Security expose the per user and per group permission model, where the codes are 0 for no access, 10 for read, 20 for edit data, and 30 for manage. Projects, users, and groups are fully manageable, and a separate My Passwords area covers each user's personal entries. One thing worth stating plainly: there is no single action that rotates a credential. Rotation is composed, Generate Password to produce a value under the installation's own generator settings and Update Password to write it into the entry. Change User Password is a different thing entirely, setting a login password for a Team Password Manager user, not a stored secret. Because the installation is self hosted, all of this runs against your own host, and the private key is used only to sign requests locally and is never transmitted. There are no triggers here. Anything reactive is a scheduled flow calling Search Passwords or List Users and comparing against the previous run.

Without FlowRunner

Rotation deferred indefinitely Nobody rotates a shared credential because nobody is certain what still uses it

Consumers discovered by breakage The list of systems holding the old secret gets assembled from the incident channel afterwards

Vault reads unexplained An automated read of a secret shows up in the log with no record of what asked for it or why

With FlowRunner

Rotation with the blast radius attached Every user and group with access is enumerated before a new secret is written

Consumers named up front The systems recorded on the entry are read out alongside the proposed change window

Reads carry their purpose An unlock reason and a flow name accompany every automated retrieval

Use Case Scenarios

Quarterly rotation that names its consumers first

The security owner wants the production database credentials rotated every quarter, and the reason it keeps slipping is that nobody can say with confidence which jobs still authenticate with them. A scheduled flow calls Search Passwords for the entries tagged prod, then Get Password Security on each one, which returns every user and group with a permission level and who manages the entry. That is the honest blast radius. The agent assembles it, reads the custom fields that record which systems consume the secret, calls Generate Password for a candidate, and posts the whole package to the credential owner in Slack with the proposed window. It writes nothing until the owner answers. What changed is not that rotation became automatic. It is that the reason for deferring it stopped existing.

Onboarding and offboarding that finish

A new engineer joins. The agent calls Create User with their role, Add User To Group for the groups their team belongs to, and Update Password Security to grant read on the specific entries their onboarding checklist names, using permission code 10 rather than a blanket manage. When someone leaves, the flow runs backwards and it runs first: Set User Active with Active false, which stops the login immediately, then Remove User From Group for each group, then Get Password Security across the projects they could reach so the security owner gets a list of every secret that person could have read while they had access. The agent proposes which of those entries should be rotated. Delete User is never called by the flow, because deleting the user also deletes the record of what they had.

A vault inventory that finds the entries nobody owns

A monthly flow walks List Projects, then Get Project Passwords for each project and Get Project Subprojects to descend the hierarchy, building a full picture 20 items per page. For every entry it calls Get Password Security to read who manages it. Entries whose manager is a deactivated user, entries in archived projects that are still unarchived themselves, and entries with manage granted to a group rather than a person all land in a report written to Google Sheets. The agent does not call Get Password anywhere in this flow, because the inventory question does not need the secret and reading one you do not need is the exact behavior a vault log exists to catch.

Human-in-Loop Highlight

Update Password writing a new secret into a shared entry is the single most disruptive call in this connector, and its damage is invisible at the moment it lands. The write succeeds instantly, the vault now holds the new value, and nothing else in the world has changed. Every service account, cron job, deployment pipeline, and colleague still authenticating with the old value is now holding a credential that no longer works, and they will find out one at a time, at whatever hour their next run happens. There is no undo, because the previous secret is not retained anywhere once it is overwritten. Get Password Security is the action that makes this decidable: it returns every user and group with read, edit data, or manage on the entry, plus who manages it. So the agent gathers rather than acts. It posts the enumerated access list, the consuming systems recorded in the entry's custom fields, and the candidate value's existence (never the value itself) to the credential owner: "Ready to rotate the prod Postgres credential. 4 users and 2 groups hold read or higher, and the entry names three consumers: the nightly ETL, the reporting replica, and the backup job. Confirm the window and I will call Update Password, or tell me which consumers to update first." The owner decides. That pause is human-in-the-loop at its most literal: the agent has done every piece of work that can be done without consequence, and it has stopped exactly at the one keystroke that locks people out.

Agent processes routinely

Detects exception requiring judgment

Clear match Continues automatically

Ambiguous Routes to human via preferred channel

Human decides

Agent resumes with decision

Agent Capabilities

43 actions

Passwords

List Passwords Lists passwords the authenticated user can access, up to 20 per page. Choose which set to return: active, all including archived, archived only, or favorites. Paginate with the page number.
Search Passwords Searches passwords by query string against name, tags, and other fields, supporting the vendor search operators such as tag:prod or name:server. The action that turns "the production credentials" into an actual working set.
Get Password Retrieves the full data of a single password including the decrypted secret and custom fields, provided the user has access. A Locked password requires an unlock reason to be supplied, which is recorded. Call it only when the flow genuinely needs the secret.
Create Password Creates a password in a project. Name and project are required, everything else optional, with custom fields supplied as an object keyed custom_data1 through custom_data10. Returns the new ID.
Update Password Updates fields of an existing password, changing only what is provided. The project cannot be changed here; use Move Password. This is the action that writes a rotated secret, and it is the one to gate.
Move Password Moves a password to a different project, which also changes who can reach it, since access follows project structure.
Set Password Archived Archives or unarchives a password. Archiving is the reversible alternative to deleting an entry that may still matter.
Set Password Locked Locks or unlocks a password. Locking restricts access so that viewing requires an unlock reason, and unlocking removes that restriction. Locking a high value entry is how you make every future read explain itself.
Delete Password Permanently deletes a password by ID. There is no archive to fall back to afterwards.
Get Password Security Returns the users and groups with access to a password, their permission level (read, edit data, or manage), and who manages the entry. The blast radius query.
Update Password Security Sets who manages a password and the per user and per group permissions, supplied as arrays of [id, permission_code] pairs where the code is 0 for no access, 10 for read, 20 for edit data, or 30 for manage.

Personal Passwords

List My Passwords Lists the authenticated user's personal passwords from the My Passwords area, which is not tied to a project. Choose active, archived, or favorite, up to 20 per page.
Get My Password Retrieves the full data of one personal password by ID, including the secret and custom fields.
Create My Password Creates a personal password in the authenticated user's own area. Only the name is required, with custom fields keyed custom_data1 through custom_data10.
Update My Password Updates one of the authenticated user's personal passwords, changing only the fields provided.
Delete My Password Permanently deletes one of the authenticated user's personal passwords by ID.

Projects

List Projects Lists projects the authenticated user can access, returning active, all including archived, archived only, or favorites, up to 20 per page.
Search Projects Searches projects by query string against name, tags, and notes, up to 20 results per page.
Get Project Retrieves the full data of a single project including its parent, tags, notes, and counts.
Get Project Passwords Returns the passwords contained in a project, up to 20 per page. The building block for a vault inventory.
Get Project Subprojects Returns the immediate subprojects of a project, which is how a flow descends a hierarchy without guessing at its shape.
Create Project Creates a project. Name and parent are required; use parent ID 0 for a root level project. Returns the new ID.
Update Project Updates a project's name, tags, or notes, changing only what is provided. Use Change Project Parent to move it.
Change Project Parent Moves a project to a new parent in the hierarchy, with parent ID 0 making it root level. Moving a project moves everything under it, including who can reach it.
Set Project Archived Archives or unarchives a project. Archiving a project is the reversible way to retire a client or an environment.
Delete Project Permanently deletes a project by ID.

Users

List Users Lists all users in the installation, up to 20 per page. Requires the caller to hold permission to view users.
Get User Retrieves a single user by ID, including username, email, role, and active status.
Get Current User Retrieves the profile of the user whose API keys authenticate the request. Worth calling once in any flow that needs to state, in its own audit line, which vault identity it is acting as.
Create User Creates a normal non-LDAP and non-SAML user. Username, email, name, role, and password are required. Returns the new user ID.
Update User Updates a user's profile fields including username, email, name, role, and root project permission, changing only what is provided. Use Change User Password to set a new login password.
Change User Password Sets a new login password for a normal user. This is a Team Password Manager login credential, not a stored secret, and the distinction matters in any flow that touches both.
Set User Active Activates or deactivates a user. Deactivated users cannot log in, which makes this the fastest correct move in an offboarding flow.
Delete User Permanently deletes a user by ID, along with the record of who they were.

Groups

List Groups Lists all groups in the installation including their members. The cheapest way to see how access is actually shaped.
Get Group Retrieves a single group by ID including its members.
Create Group Creates a group. The name is the only field. Returns the new group ID.
Update Group Renames a group. The name is the only field that can be updated.
Add User To Group Adds a user to a group, which grants them everything that group can reach.
Remove User From Group Removes a user from a group. The first correct step in most offboarding sequences, after deactivation.
Delete Group Permanently deletes a group by ID, along with the permission grants that pointed at it.

Utilities

Generate Password Generates a strong random password using the installation's own server side generator settings, so a generated secret matches whatever policy the organization already configured rather than a policy the flow invented.
Get Version Returns the Team Password Manager software version, its release date, and the API version handling the request. Useful as a precondition check in a flow that depends on a capability added in a specific release.

Frequently Asked Questions

What can FlowRunner do with Team Password Manager?

FlowRunner agents can run List Passwords, Search Passwords, and Get Password in Team Password Manager, plus 40 more actions.

Does connecting Team Password Manager to FlowRunner require OAuth?

Team Password Manager uses a custom authentication method to connect to FlowRunner.

Can Team Password Manager trigger a FlowRunner workflow automatically?

Team Password Manager doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.

Start building with Team Password Manager

$100 in credits. No card required. Connect in minutes.

Start Building Free Talk to us