Check out my Python script for bulk importing service accounts from CSV.

So you bought into the whole CyberArk PAM suite and now you need to onboard a few hundred service accounts. Of course, the official "solution" involves a lot of clicking or their clunky CLI. Here's what actually works: a Python script that uses the PVWA REST API. It's not fancy, but it gets the job done without another vendor tool.

You'll need a CSV with columns for `name`, `address`, `platform`, `safe`. Save this as `import.py`, adjust the base URL and creds, and run it. It handles the annoying token auth and batches the creates.

```python
import requests
import csv
import time

pvwa_url = "https://pvwa.example.com"
api_user = "admin"
api_pass = "secret"
csv_file = "accounts.csv"

def get_token():
auth_url = f"{pvwa_url}/api/auth/cyberark/logon"
resp = requests.post(auth_url, json={"username": api_user, "password": api_pass}, verify=False)
return resp.json()['CyberArkLogonResult']

def import_accounts(token):
headers = {"Authorization": token}
with open(csv_file, 'r') as f:
reader = csv.DictReader(f)
for row in reader:
payload = {
"name": row['name'],
"address": row['address'],
"platformId": row['platform'],
"safeName": row['safe'],
"secretType": "password",
"secret": "T0pS3cr3t!"
}
create_url = f"{pvwa_url}/api/accounts"
r = requests.post(create_url, json=payload, headers=headers, verify=False)
if r.status_code == 200:
print(f"Added {row['name']}")
else:
print(f"Failed {row['name']}: {r.text}")
time.sleep(0.5) # avoid rate-limiting

if __name__ == "__main__":
token = get_token()
import_accounts(token)
```

Yes, you have to disable SSL verify in the example. Don't @ me. Fix it for prod yourself. This took an afternoon and saved me from a week of vendor "best practices." The API docs are a maze, but once you find the right endpoints, it's just another REST service.