# delineaxpm/delinea-platform architecture

> Architecture diagram of the GitHub repository delineaxpm/delinea-platform, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-05-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/delineaxpm/delinea-platform
- Repository: https://github.com/delineaxpm/delinea-platform

## Overview

1. This repository is a reference catalog for the Delinea Platform ecosystem, not a single application. It bundles example code, operational scripts, SQL reports, templates, and install helpers that engineers use to integrate with Delinea products and connected systems.

2. The repo is organized around three main content planes:
   - Platform API examples for authenticated API access
   - Secret Server integration scripts for discovery, password rotation, and secret modeling
   - SQL-based reports for discovery, migration, and operational analysis

3. `PlatformAPI/` is the clearest “API client” subsystem. It contains a Postman collection plus PowerShell and Python sample programs that obtain an OAuth access token and then call protected Delinea Platform resources. The boundary here is external API consumption: client credentials/config live in per-language config files, and the scripts are examples rather than a service.

4. `Scripts/SecretServer/` is the largest subsystem and is best viewed as an integration library for Secret Server. Most folders follow the same lifecycle pattern: Discovery scripts find accounts or assets in an external system, Remote Password Changer / RPC scripts rotate or validate credentials, and Template XML files define the corresponding Secret Server secret/account objects.

5. That Secret Server area is split by target domain/vendor, which matters architecturally because each target is an integration boundary to a different external system. Examples include SaaS apps like Okta, Jira, Slack, Zoom, Salesforce, ServiceNow, Workday, Box, and GitHub; cloud and infrastructure targets like AWS, Azure Entra ID, AKV, GCP, Snowflake, Oracle, PostgreSQL, MySQL, MongoDB, and Palo Alto/Infoblox; plus Microsoft admin tools and local Windows account scenarios.

6. The data flow in those integration packages is generally: external system credentials or integration keys are stored as Secret Server secrets, discovery scripts enumerate target identities/resources, the results are mapped into secret templates, and RPC/heartbeat scripts later verify or change passwords/tokens to keep the secrets in sync. In a few cases the scripts also generate dependent secrets or linkage metadata, not just direct credential entries.

7. `Scripts/SecretServer/.../Launchers/` and desktop-tool text files are a separate presentation layer. These are not runtime services; they appear to define command-line launchers or external admin tool entry points such as DBeaver, TOAD, SecureCRT, MobaXterm, and Windows management consoles, likely to be used from secret context or operator workflows.

8. `Reports/SecretServer/` is the reporting subsystem. It contains SQL queries grouped by purpose:
   - Discovery reports for finding unmanaged accounts, sites, local accounts, and default admins
   - PlatformMigration reports for inventorying secrets, folders, templates, permissions, scripts, launchers, and policy assignments
   - Secret-focused reports for activity, heartbeat, password rotation, and access analysis
   These queries are meant to run against Secret Server data stores or reporting databases, not against the external systems themselves.

9. The reporting folders also show an operational boundary between “find what exists” and “prepare migration/cleanup.” The PlatformMigration SQL files are specifically about readiness analysis: missing owners, duplicate names, leading/trailing spaces, custom permissions, inactive templates, and other normalization issues that affect moving content into or within Delinea platforms.

10. `DelineaConnector/` appears to be an installation helper for the Delinea Connector, implemented as a PowerShell installer. Architecturally, it supports connectivity between the Delinea platform and remote environments, so it sits in the infrastructure/bootstrap layer rather than the integration-content layer.

11. `Scripts/Platform/` holds adjacent platform-oriented automation outside Secret Server, including Entra ID app setup, Azure Key Vault retrieval, and Microsoft Sentinel ARM template deployment. These scripts are typically “bridge” components: they provision or authenticate against a cloud control plane and then support Delinea integrations.

12. `Scripts/ITDR/` is a smaller infrastructure/security automation area for identity threat detection and response integrations, including GCP and Snowflake setup scripts. Like the platform scripts, these are environment-specific bootstrap artifacts rather than a central runtime.

13. Cross-cutting tooling is intentionally lightweight and heterogeneous: PowerShell is the dominant automation language, Python is used for a few API utilities, SQL is used for reporting and database-backed analysis, XML is used for secret templates, and a small amount of shell/JSON exists for installation or deployment helpers. There is no shared application framework or monorepo build pipeline.

14. The only visible CI/CD element is a GitHub Actions workflow for Slack notifications plus standard repo hygiene files. That workflow supports repository operations, but it does not define product runtime behavior.

15. For an architecture diagram, the key boundaries are: this repo as a content library; external Delinea Platform/Secret Server APIs and databases; and the many third-party SaaS, cloud, database, and Windows administration systems that the scripts discover from or rotate credentials against. The repo’s internal “flow” is mostly documentation-driven reuse of script/template/report bundles per integration target.

Main entry points: [`Scripts/SecretServer`](https://github.com/delineaxpm/delinea-platform/tree/main/Scripts/SecretServer) (Secret Server), [`PlatformAPI`](https://github.com/delineaxpm/delinea-platform/tree/main/PlatformAPI) (Platform API), [`Reports/SecretServer`](https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer) (Secret Server reports), [`Scripts/Platform`](https://github.com/delineaxpm/delinea-platform/tree/main/Scripts/Platform) (Platform bootstrap)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_repo["Reference catalog"]
  node_root["Delinea Platform<br/>repo catalog"]
end

subgraph group_api["Platform API"]
  node_platform_api["Platform API<br/>api examples"]
  node_platform_postman["Postman collection<br/>API collection"]
  node_platform_ps["PowerShell sample<br/>token client<br/>[main.ps1]"]
  node_platform_py["Python sample<br/>token client<br/>[main.py]"]
end

subgraph group_secretserver["Secret Server integrations"]
  node_secretserver_root["Secret Server<br/>integration library"]
  node_saas_targets["SaaS targets<br/>discovery/rpc bundles"]
  node_cloud_targets["Cloud & data<br/>discovery/rpc bundles"]
  node_microsoft_targets["Microsoft admin<br/>windows tooling"]
  node_launchers["Launchers<br/>operator entrypoints"]
  node_secretserver_template["Templates<br/>secret models"]
  node_secretserver_discovery["Discovery<br/>enumeration scripts"]
  node_secretserver_rpc["RPC / heartbeat<br/>rotation scripts"]
  node_secretserver_special["Special cases<br/>dependency scripts"]
end

subgraph group_reports["Secret Server reports"]
  node_reports_root[("Secret Server reports<br/>sql reports")]
  node_reports_discovery["Discovery reports<br/>sql analysis"]
  node_reports_migration["Migration reports<br/>sql readiness"]
  node_reports_secrets["Secret reports<br/>sql ops"]
end

subgraph group_infra["Bootstrap and tooling"]
  node_delinea_connector["Connector installer<br/>powerShell install"]
  node_platform_bootstrap["Platform bootstrap<br/>cloud setup"]
  node_itdr_bootstrap["ITDR setup<br/>security bootstrap"]
  node_github_actions["GitHub Actions<br/>repo automation<br/>[notify-slack.yml]"]
end

node_root -->|"contains"| node_platform_api
node_root -->|"contains"| node_secretserver_root
node_root -->|"contains"| node_reports_root
node_root -->|"contains"| node_delinea_connector
node_root -->|"contains"| node_platform_bootstrap
node_root -->|"contains"| node_itdr_bootstrap
node_root -->|"contains"| node_github_actions
node_platform_api -->|"example"| node_platform_postman
node_platform_api -->|"example"| node_platform_ps
node_platform_api -->|"example"| node_platform_py
node_secretserver_root -->|"targets"| node_saas_targets
node_secretserver_root -->|"targets"| node_cloud_targets
node_secretserver_root -->|"targets"| node_microsoft_targets
node_secretserver_root -->|"includes"| node_launchers
node_secretserver_root -->|"includes"| node_secretserver_template
node_secretserver_root -->|"includes"| node_secretserver_discovery
node_secretserver_root -->|"includes"| node_secretserver_rpc
node_secretserver_root -->|"includes"| node_secretserver_special
node_secretserver_discovery -.->|"maps to"| node_secretserver_template
node_secretserver_discovery -.->|"feeds"| node_secretserver_rpc
node_reports_root -->|"contains"| node_reports_discovery
node_reports_root -->|"contains"| node_reports_migration
node_reports_root -->|"contains"| node_reports_secrets
node_reports_discovery -.->|"analyzes"| node_secretserver_root
node_reports_migration -.->|"analyzes"| node_secretserver_root
node_reports_secrets -.->|"analyzes"| node_secretserver_root
node_platform_bootstrap -.->|"supports"| node_secretserver_root
node_itdr_bootstrap -.->|"supports"| node_secretserver_root
node_delinea_connector -.->|"enables"| node_platform_bootstrap

click node_platform_api "https://github.com/delineaxpm/delinea-platform/tree/main/PlatformAPI"
click node_platform_postman "https://github.com/delineaxpm/delinea-platform/blob/main/PlatformAPI/APICollections/AccessProtectedPlatformResourcesUsingHeadlessClientsViaOAuth.postman_collection.json"
click node_platform_ps "https://github.com/delineaxpm/delinea-platform/blob/main/PlatformAPI/PowerShell/platform-api-access-token-powershell-script/main.ps1"
click node_platform_py "https://github.com/delineaxpm/delinea-platform/blob/main/PlatformAPI/Python/platform-api-access-token-python-script/main.py"
click node_secretserver_root "https://github.com/delineaxpm/delinea-platform/tree/main/Scripts/SecretServer"
click node_reports_root "https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer"
click node_reports_discovery "https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer/Discovery"
click node_reports_migration "https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer/PlatformMigration"
click node_reports_secrets "https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer/Secrets"
click node_delinea_connector "https://github.com/delineaxpm/delinea-platform/blob/main/DelineaConnector/delinea-connector-install.ps1"
click node_platform_bootstrap "https://github.com/delineaxpm/delinea-platform/tree/main/Scripts/Platform"
click node_itdr_bootstrap "https://github.com/delineaxpm/delinea-platform/tree/main/Scripts/ITDR"
click node_github_actions "https://github.com/delineaxpm/delinea-platform/blob/main/.github/workflows/notify-slack.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_root toneBlue
class node_platform_api,node_platform_postman,node_platform_ps,node_platform_py toneAmber
class node_secretserver_root,node_saas_targets,node_cloud_targets,node_microsoft_targets,node_launchers,node_secretserver_template,node_secretserver_discovery,node_secretserver_rpc,node_secretserver_special toneMint
class node_reports_root,node_reports_discovery,node_reports_migration,node_reports_secrets toneRose
class node_delinea_connector,node_platform_bootstrap,node_itdr_bootstrap,node_github_actions toneIndigo
```

## Components

### Reference catalog

Top-level repository content organized as reusable Delinea examples, reports, and helpers.

- **Delinea Platform**: repo catalog · Reference repository of Delinea integration examples, reports, templates, and install helpers.

### Platform API

Client examples for authenticated Delinea Platform API access.

- [Platform API](https://github.com/delineaxpm/delinea-platform/tree/main/PlatformAPI): api examples · OAuth-based sample clients for calling protected Delinea Platform resources. · `PlatformAPI`
- [Postman collection](https://github.com/delineaxpm/delinea-platform/blob/main/PlatformAPI/APICollections/AccessProtectedPlatformResourcesUsingHeadlessClientsViaOAuth.postman_collection.json): API collection · Headless client example for platform resource access. · `PlatformAPI/APICollections/AccessProtectedPlatformResourcesUsingHeadlessClientsViaOAuth.postman_collection.json`
- [PowerShell sample](https://github.com/delineaxpm/delinea-platform/blob/main/PlatformAPI/PowerShell/platform-api-access-token-powershell-script/main.ps1): token client · PowerShell example that acquires an access token and calls Platform APIs. · `PlatformAPI/PowerShell/platform-api-access-token-powershell-script/main.ps1`
- [Python sample](https://github.com/delineaxpm/delinea-platform/blob/main/PlatformAPI/Python/platform-api-access-token-python-script/main.py): token client · Python example that acquires an access token and calls Platform APIs. · `PlatformAPI/Python/platform-api-access-token-python-script/main.py`

### Secret Server integrations

Discovery, password rotation, secret modeling, and launcher bundles for Secret Server targets.

- [Secret Server](https://github.com/delineaxpm/delinea-platform/tree/main/Scripts/SecretServer): integration library · Target-specific scripts, templates, and launchers for Secret Server integrations. · `Scripts/SecretServer`
- **SaaS targets**: discovery/rpc bundles · Integration packages for SaaS identity and business apps such as Okta, Jira, Slack, Zoom, Salesforce, ServiceNow, Workday, Box, GitHub, and others.
- **Cloud & data**: discovery/rpc bundles · Integration packages for cloud, database, and security platforms such as AWS, Azure Entra ID, AKV, GCP, Snowflake, Oracle, PostgreSQL, MySQL, MongoDB, Palo Alto, and Infoblox.
- **Microsoft admin**: windows tooling · Windows and Microsoft administration scenarios including local accounts, SQL Server, autologon, and management consoles.
- **Launchers**: operator entrypoints · Text-based launcher definitions for admin tools and consoles used from secret context workflows.
- **Templates**: secret models · XML secret/account templates that define Secret Server objects for discovery and rotation workflows.
- **Discovery**: enumeration scripts · Scripts that discover accounts, identities, or dependent resources in external systems.
- **RPC / heartbeat**: rotation scripts · Remote password changer and heartbeat scripts that verify or change credentials and keep secrets synchronized.
- **Special cases**: dependency scripts · Linked-secret, dependency, and file-discovery workflows that extend the standard discovery/rotation pattern.

### Secret Server reports

SQL reporting for discovery, migration readiness, and operational analysis.

- [Secret Server reports](https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer): sql reports · SQL reporting packages for discovery, migration readiness, and secrets operations. · `Reports/SecretServer`
- [Discovery reports](https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer/Discovery): sql analysis · Reports for unmanaged accounts, sites, local accounts, and default admins. · `Reports/SecretServer/Discovery`
- [Migration reports](https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer/PlatformMigration): sql readiness · Inventory and normalization reports for folders, templates, permissions, scripts, launchers, and policy assignments. · `Reports/SecretServer/PlatformMigration`
- [Secret reports](https://github.com/delineaxpm/delinea-platform/tree/main/Reports/SecretServer/Secrets): sql ops · Activity, heartbeat, rotation, and access reports for Secret Server secrets. · `Reports/SecretServer/Secrets`

### Bootstrap and tooling

Installation helpers, platform bootstrap scripts, and lightweight automation utilities.

- [Connector installer](https://github.com/delineaxpm/delinea-platform/blob/main/DelineaConnector/delinea-connector-install.ps1): powerShell install · PowerShell installer for the Delinea Connector used to bridge remote environments. · `DelineaConnector/delinea-connector-install.ps1`
- [Platform bootstrap](https://github.com/delineaxpm/delinea-platform/tree/main/Scripts/Platform): cloud setup · Scripts that provision or authenticate against cloud control planes for Delinea integrations. · `Scripts/Platform`
- [ITDR setup](https://github.com/delineaxpm/delinea-platform/tree/main/Scripts/ITDR): security bootstrap · Infrastructure scripts for identity threat detection and response integrations. · `Scripts/ITDR`
- [GitHub Actions](https://github.com/delineaxpm/delinea-platform/blob/main/.github/workflows/notify-slack.yml): repo automation · Lightweight workflow support for repository operations such as Slack notifications. · `.github/workflows/notify-slack.yml`

## Connections

- Delinea Platform → Platform API: contains · Repository bundles platform API examples.
- Delinea Platform → Secret Server: contains · Repository bundles Secret Server integration content.
- Delinea Platform → Secret Server reports: contains · Repository bundles SQL reporting content.
- Delinea Platform → Connector installer: contains · Repository includes a connector installer helper.
- Delinea Platform → Platform bootstrap: contains · Repository includes adjacent platform automation.
- Delinea Platform → ITDR setup: contains · Repository includes identity security bootstrap scripts.
- Delinea Platform → GitHub Actions: contains · Repository includes a small CI workflow.
- Platform API → Postman collection: example · Postman collection demonstrates OAuth access to protected resources.
- Platform API → PowerShell sample: example · PowerShell sample obtains tokens and calls APIs.
- Platform API → Python sample: example · Python sample obtains tokens and calls APIs.
- Secret Server → SaaS targets: targets · SaaS integration bundles are organized per external vendor.
- Secret Server → Cloud & data: targets · Cloud and data platform bundles are organized per external target.
- Secret Server → Microsoft admin: targets · Microsoft and Windows scenarios form a separate integration family.
- Secret Server → Launchers: includes · Some bundles define operator launchers for desktop tools and consoles.
- Secret Server → Templates: includes · Bundles include XML templates for Secret Server objects.
- Secret Server → Discovery: includes · Bundles include discovery scripts that enumerate external identities or resources.
- Secret Server → RPC / heartbeat: includes · Bundles include heartbeat and remote password changer scripts.
- Secret Server → Special cases: includes · Specialized workflows extend the standard integration pattern.
- Discovery → Templates: maps to · Discovery output is shaped into secret templates.
- Discovery → RPC / heartbeat: feeds · Discovered accounts are later rotated or validated by RPC/heartbeat scripts.
- Secret Server reports → Discovery reports: contains · Discovery-focused SQL reports.
- Secret Server reports → Migration reports: contains · Migration-readiness SQL reports.
- Secret Server reports → Secret reports: contains · Secrets operations SQL reports.
- Discovery reports → Secret Server: analyzes · Reports query Secret Server data for unmanaged accounts and assets.
- Migration reports → Secret Server: analyzes · Reports assess Secret Server content for migration and cleanup.
- Secret reports → Secret Server: analyzes · Reports measure activity, heartbeat, rotation, and access.
- Platform bootstrap → Secret Server: supports · Cloud setup scripts support integrations built for Secret Server and the platform.
- ITDR setup → Secret Server: supports · ITDR setup scripts support identity/security integration use cases.
- Connector installer → Platform bootstrap: enables · Connector installation supports bridging remote environments used by platform automation.