Configuration

Setting up the Privilege Manager Webex Approval Bot requires three steps: creating the Webex bot, creating a Privilege Manager API client, and deploying the bot container.

Step 1 — Create the Webex Bot

  1. Go to https://developer.webex.com/my-apps and sign in.

  2. Click Create a New App > Create a Bot.

  3. Fill in the following fields:

    • Bot Name — for example, PrivMan Approvals

    • Bot Username — must be unique; Webex appends @webex.bot automatically

    • Icon — upload any image (required)

    • Description — for example, Approves Privilege Manager requests from Webex

  4. Click Add Bot.

  5. Copy and save the Bot Access Token shown on the confirmation page.

The Bot Access Token is only shown once. If you lose it, regenerate it from the bot's settings page under My Webex Apps.

Step 2 — Create a Privilege Manager API Client

  1. Log into your Privilege Manager instance.

  2. Go to Admin > Users > Create User.

  3. Set the type to API Client.

  4. Give it a name (for example, Webex Bot).

  5. Assign it the Privilege Manager Administrators role.

  6. Copy and save the Client ID and Client Secret.

The Client Secret is only shown once. Save it before navigating away.

Step 3 — Deploy the Bot

Pull the Docker Image

PowerShell (Windows):

docker pull delineaxpm/privman-webex:latest

Bash (Linux / macOS):

docker pull delineaxpm/privman-webex:latest

Run the Container

Replace the placeholder values with your credentials from Steps 1 and 2.

PowerShell (Windows):

docker run -d `

--name privman-webex-bot `

--restart unless-stopped `

-v privman-bot-data:/app/data `

-e USE_LOCAL_STORAGE=true `

-e PRIVMAN_BASE_URL=https://yourinstance.privilegemanagercloud.com/Tms `

-e PRIVMAN_USERNAME=<your-client-id> `

-e PRIVMAN_PASSWORD=<your-client-secret> `

-e WEBEX_BOT_TOKEN=<your-webex-bot-token> `

-e POLL_INTERVAL=30 `

-e ROOM_STORE_PATH=/app/data/rooms.json `

delineaxpm/privman-webex:latest

Bash (Linux / macOS):

docker run -d \

--name privman-webex-bot \

--restart unless-stopped \

-v privman-bot-data:/app/data \

-e USE_LOCAL_STORAGE=true \

-e PRIVMAN_BASE_URL=https://yourinstance.privilegemanagercloud.com/Tms \

-e PRIVMAN_USERNAME=<your-client-id> \

-e PRIVMAN_PASSWORD=<your-client-secret> \

-e WEBEX_BOT_TOKEN=<your-webex-bot-token> \

-e POLL_INTERVAL=30 \

-e ROOM_STORE_PATH=/app/data/rooms.json \

delineaxpm/privman-webex:latest

Important: PRIVMAN_BASE_URL must end with /Tms and have no trailing slash after it. For example: https://company.privilegemanagercloud.com/Tms

Environment Variables Reference

Variable Required Default Description
PRIVMAN_BASE_URL Yes — Privilege Manager instance URL. Must end with /Tms with no trailing slash.
PRIVMAN_USERNAME Yes — Privilege Manager API client ID.
PRIVMAN_PASSWORD Yes — Privilege Manager API client secret.
WEBEX_BOT_TOKEN Yes — Bot Access Token from Step 1. Used to authenticate all Webex REST and websocket calls.
POLL_INTERVAL No 30 Seconds between Privilege Manager polls. Lower values feel more responsive but increase API load.
ROOM_STORE_PATH No rooms.json Path to the JSON file that stores registered Webex space IDs. Relative paths resolve from the working directory.
SSM_SCHEDULE_PARAM No /privman-webex-bot/AUTOAPPROVE_SCHEDULE AWS SSM Parameter Store parameter name used to persist the auto-approve schedule. If the parameter does not exist, the bot logs a warning and runs with auto-approve disabled. See Auto-Approve (Optional).
AWS_ACCESS_KEY_ID No* — AWS access key. Required only for auto-approve when not using an IAM role or AWS CLI profile.
AWS_SECRET_ACCESS_KEY No* — AWS secret key paired with AWS_ACCESS_KEY_ID. Same conditions as above.
AWS_DEFAULT_REGION No* — AWS region containing the SSM parameter (for example, us-east-1). Same conditions as above.

Once the container is running, continue to User Setup to register a Webex space and start receiving approval requests.