delineaxpm/delinea-platform

1. This repository is a reference catalog for the Delinea Platform ecosystem, not a single application. It bundles example code, operational scripts, SQL reports, templates, and install helpers that engineers use to integrate with Delinea products and connected systems.

2. The repo is organized around three main content planes:

- Platform API examples for authenticated API access

- Secret Server integration scripts for discovery, password rotation, and secret modeling

- SQL-based reports for discovery, migration, and operational analysis

3. PlatformAPI/ is the clearest “API client” subsystem. It contains a Postman collection plus PowerShell and Python sample programs that obtain an OAuth access token and then call protected Delinea Platform resources. The boundary here is external API consumption: client credentials/config live in per-language config files, and the scripts are examples rather than a service.

4. Scripts/SecretServer/ is the largest subsystem and is best viewed as an integration library for Secret Server. Most folders follow the same lifecycle pattern: Discovery scripts find accounts or assets in an external system, Remote Password Changer / RPC scripts rotate or validate credentials, and Template XML files define the corresponding Secret Server secret/account objects.

5. That Secret Server area is split by target domain/vendor, which matters architecturally because each target is an integration boundary to a different external system. Examples include SaaS apps like Okta, Jira, Slack, Zoom, Salesforce, ServiceNow, Workday, Box, and GitHub; cloud and infrastructure targets like AWS, Azure Entra ID, AKV, GCP, Snowflake, Oracle, PostgreSQL, MySQL, MongoDB, and Palo Alto/Infoblox; plus Microsoft admin tools and local Windows account scenarios.

6. The data flow in those integration packages is generally: external system credentials or integration keys are stored as Secret Server secrets, discovery scripts enumerate target identities/resources, the results are mapped into secret templates, and RPC/heartbeat scripts later verify or change passwords/tokens to keep the secrets in sync. In a few cases the scripts also generate dependent secrets or linkage metadata, not just direct credential entries.

7. Scripts/SecretServer/.../Launchers/ and desktop-tool text files are a separate presentation layer. These are not runtime services; they appear to define command-line launchers or external admin tool entry points such as DBeaver, TOAD, SecureCRT, MobaXterm, and Windows management consoles, likely to be used from secret context or operator workflows.

8. Reports/SecretServer/ is the reporting subsystem. It contains SQL queries grouped by purpose:

- Discovery reports for finding unmanaged accounts, sites, local accounts, and default admins

- PlatformMigration reports for inventorying secrets, folders, templates, permissions, scripts, launchers, and policy assignments

- Secret-focused reports for activity, heartbeat, password rotation, and access analysis

These queries are meant to run against Secret Server data stores or reporting databases, not against the external systems themselves.

9. The reporting folders also show an operational boundary between “find what exists” and “prepare migration/cleanup.” The PlatformMigration SQL files are specifically about readiness analysis: missing owners, duplicate names, leading/trailing spaces, custom permissions, inactive templates, and other normalization issues that affect moving content into or within Delinea platforms.

10. DelineaConnector/ appears to be an installation helper for the Delinea Connector, implemented as a PowerShell installer. Architecturally, it supports connectivity between the Delinea platform and remote environments, so it sits in the infrastructure/bootstrap layer rather than the integration-content layer.

11. Scripts/Platform/ holds adjacent platform-oriented automation outside Secret Server, including Entra ID app setup, Azure Key Vault retrieval, and Microsoft Sentinel ARM template deployment. These scripts are typically “bridge” components: they provision or authenticate against a cloud control plane and then support Delinea integrations.

12. Scripts/ITDR/ is a smaller infrastructure/security automation area for identity threat detection and response integrations, including GCP and Snowflake setup scripts. Like the platform scripts, these are environment-specific bootstrap artifacts rather than a central runtime.

13. Cross-cutting tooling is intentionally lightweight and heterogeneous: PowerShell is the dominant automation language, Python is used for a few API utilities, SQL is used for reporting and database-backed analysis, XML is used for secret templates, and a small amount of shell/JSON exists for installation or deployment helpers. There is no shared application framework or monorepo build pipeline.

14. The only visible CI/CD element is a GitHub Actions workflow for Slack notifications plus standard repo hygiene files. That workflow supports repository operations, but it does not define product runtime behavior.

15. For an architecture diagram, the key boundaries are: this repo as a content library; external Delinea Platform/Secret Server APIs and databases; and the many third-party SaaS, cloud, database, and Windows administration systems that the scripts discover from or rotate credentials against. The repo’s internal “flow” is mostly documentation-driven reuse of script/template/report bundles per integration target.