{"record":{"id":"1485d1f86740b529","repo":"BerriAI/litellm","slug":"cyberark-secret-manager-is-only-available-for-prem","errorCode":null,"errorMessage":"CyberArk secret manager is only available for premium users. {CommonProxyErrors.not_premium_user.value}","messagePattern":"CyberArk secret manager is only available for premium users\\. (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/cyberark_secret_manager.py","lineNumber":56,"sourceCode":"        # Set CYBERARK_SSL_VERIFY=false to disable SSL verification\n        ssl_verify_env: Final = str_to_bool(os.getenv(\"CYBERARK_SSL_VERIFY\"))\n        self.ssl_verify: bool = ssl_verify_env if ssl_verify_env is not None else True\n\n        # Validate environment\n        if not self.conjur_api_key and not (self.tls_cert_path and self.tls_key_path):\n            raise ValueError(\n                \"Missing CyberArk credentials. Please set CYBERARK_API_KEY or both CYBERARK_CLIENT_CERT and CYBERARK_CLIENT_KEY in your environment.\"\n            )\n\n        litellm.secret_manager_client = self\n        litellm._key_management_system = KeyManagementSystem.CYBERARK\n\n        # Tokens expire after ~8 minutes, so we cache for 5 minutes to be safe\n        _refresh_interval: Final = int(os.environ.get(\"CYBERARK_REFRESH_INTERVAL\", \"300\"))\n        self.cache = InMemoryCache(default_ttl=_refresh_interval)\n\n        if premium_user is not True:\n            raise ValueError(\n                f\"CyberArk secret manager is only available for premium users. {CommonProxyErrors.not_premium_user.value}\"\n            )\n\n        if not self.ssl_verify:\n            verbose_logger.warning(\n                \"CyberArk SSL verification is disabled. This is insecure and should only be used for testing with self-signed certificates.\"\n            )\n\n    def _authenticate(self) -> str:\n        \"\"\"\n        Authenticate with CyberArk Conjur and get a session token.\n\n        The token is a JSON object that must be base64-encoded for use in subsequent requests.\n\n        Returns:\n            str: Base64-encoded session token\n        \"\"\"\n        # Check if we have a cached token","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/cyberark_secret_manager.py#L38-L74","documentation":"Licensing gate in the CyberArk secret manager constructor: after credential validation, it detects the deployment is not a premium/enterprise user, and CyberArk support is restricted to premium builds. The CommonProxyErrors.not_premium_user value appends the standard upgrade hint.","triggerScenarios":"Thrown at litellm/secret_managers/cyberark_secret_manager.py:56 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set a valid LITELLM_LICENSE (Enterprise) to enable the CyberArk secret manager.","Otherwise use a secret manager available in the non-premium tier."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}