Does Vaultamagic send my data anywhere?
No. The page is static HTML/JavaScript with no backend. Your inputs never leave the browser, and
the generated script talks only to your own CyberArk PVWA.
Does it support SAML / SSO?
Not in the generated PowerShell. Interactive SAML with MFA needs a real browser handshake that a
plain script can't perform cleanly, so the script covers CyberArk, LDAP, and RADIUS. If you need SAML, obtain a
session token through your browser and adapt the script to reuse it, or use a Credential Provider integration.
Which PowerShell versions work?
Windows PowerShell 5.1 (built into Windows) and PowerShell 7+. The script sets TLS 1.2 and
handles certificate options for both.
Does it work with Privilege Cloud as well as Self-Hosted?
Yes. Both expose the same REST API — just set your PVWA base URL (for Privilege Cloud, your
tenant's PasswordVault URL).
Where does my password go?
Into the local Get-Credential prompt only, when you run the script. It's never typed
into this website and never stored in the script file.
What exactly gets exported?
CSV files for whatever you select: safes.csv, safe-permissions.csv,
applications.csv, and accounts.csv (or accounts-with-secrets.csv if you
opt in to secret retrieval).
Can it retrieve passwords?
Yes, but only if you explicitly enable it. The script warns you, requires a typed confirmation,
sends your retrieval reason, and is audited by CyberArk. The resulting CSV is plaintext — protect it and delete it
when you're done.
My PVWA uses an internal CA. Will it work?
Yes — tick "Allow self-signed / private CA certificate" and the script will skip certificate
validation for that run. Prefer installing your enterprise CA and leaving validation on where you can.
Is it read-only?
Yes. It issues only GET requests plus CyberArk's read-a-secret call and a logon/logoff. It never
creates, updates, or deletes anything in the vault.
Why CSV and not Excel?
CSV needs no extra modules and opens natively in Excel. (An .xlsx option via the
ImportExcel module may come later.)