---
title: "Execution template tags"
slug: "executions-template-tags"
updated: 2026-10-14T20:13:53Z
published: 2026-10-14T20:13:53Z
canonical: "docs.senhasegura.io/executions-template-tags"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Execution template tags

Tags are pre-defined variables that can be used in Segura® Platform templates instead of hard-coded information, allowing the use of the same template for operations on multiple devices.

## PAM Core tags

| Tag | Description |
| --- | --- |
| `[#USERNAME#]` | Username of the credential that will have its password changed. |
| `[#NEW_PASSWORD#]` | The new password you want the credential to use. |
| `[#CURRENT_PASSWORD#]` | The password in use for the credential. |
| `[#AUTH_USER#]` | Username of the credential that will be authenticated on the station/system/server to perform the change. |
| `[#AUTH_PASSWORD#]` | Password of the credential that will authenticate itself to run the change. |
| `[#AUTH_DOMAIN#]` | Domain of the credential that will authenticate itself to run the change. |
| `[#ADD_INFO#]` | Additional credential information. |
| `[#IP#]` | The credential's device IP that will have the password changed. |
| `[#HOSTNAME#]` | The credential's device hostname that will have the password changed. |
| `[#DOMAIN#]` | The credential's device domain that will have the password changed. |
| `[#SERVER_PATH#]` | The path of the credential server that will have the password changed. |
| `[#CONNECT_IP#]` | IP used to connect (Can be replaced by [Network Connector](/v4-2/docs/about-network-connector)). |
| `[#CONNECT_PORT#]` | Port used to connect (Can be replaced by [Network Connector](/v4-2/docs/about-network-connector)). |
| `[#TOTP_TOKEN#]` | Credential TOTP Token. |

## DevOps Secret Manager tags

### Application and authorization tags

| Tag | Description |
| --- | --- |
| `[#APP_NAME#]` | Application name. |
| `[#APP_AUTH_UNIQUE_KEY#]` | Authorization unique key. |
| `[#APP_AUTH_TYPE#]` | Authorization authentication type. |
| `[#APP_AUTH_CLIENT_ID#]` | OAuth2 client ID. |
| `[#APP_AUTH_CLIENT_SECRET#]` | OAuth2 client secret. |
| `[#APP_AUTH_CONSUMER_KEY#]` | OAuth1 consumer key. |
| `[#APP_AUTH_CONSUMER_SECRET#]` | OAuth1 consumer secret. |
| `[#APP_AUTH_TOKEN#]` | OAuth1 auth token. |
| `[#APP_AUTH_TOKEN_SECRET#]` | OAuth1 token secret. |

### Secrets tags

| Tag | Description |
| --- | --- |
| `[#SECRET_NAME#]` | Secret name. |
| `[#SECRET_IDENTIFIER#]` | Secret identifier. |
| `[#SECRET_VERSION#]` | Secret version. |
| `[#SECRET_ENGINE#]` | Secret engine name. |
| `[#SECRET_EXPIRATION_DATE#]` | Secret expiration date. |
| `[#SECRET_DATA#]` | All secret data. |

### Secret data tags

| Tag | Description |
| --- | --- |
| `[#ACCESS_KEY_ID#]` | Access key ID. |
| `[#SECRET_ACCESS_KEY#]` | Secret access key. |
| `[#ACCESS_KEY_TTL#]` | Access key TTL. |
| `[#CREDENTIAL_HOSTNAME#]` | Credential hostname. |
| `[#CREDENTIAL_USERNAME#]` | Credential username. |
| `[#CREDENTIAL_PASSWORD#]` | Credential password. |
| `[#CREDENTIAL_ADDITIONAL_INFORMATION#]` | Credential additional information. |
| `[#CREDENTIAL_TTL#]` | Credential TTL. |

## Certificate Manager tags

Certificate Manager tags are only available in the tag legend when the template's **Execution type** is **Certificate publication**. Credential and device tags remain available for every execution type.

| Tag | Description |
| --- | --- |
| `[#CERT_COMMON_NAME#]` | The certificate's common name. |
| `[#CERT_FINGERPRINT#]` | The SHA-256 fingerprint, uppercase hexadecimal, with no separator. |
| `[#CERT_SERIAL#]` | The certificate's serial number. |
| `[#CERT_NOT_AFTER#]` | The certificate's expiration date. |
| `[#CERT_PEM_BASE64#]` | The certificate in PEM format, base64-encoded. |
| `[#CERT_CHAIN_BASE64#]` | The certificate followed by its issuers, base64-encoded. If the certificate has no issuer linked in the inventory, this tag delivers the certificate alone. |
| `[#CERT_PUBLIC_KEY_BASE64#]` | The public key, base64-encoded. |
| `[#CERT_PRIVATE_KEY_BASE64#]` | The private key, base64-encoded. Never appears in the execution log; it is replaced with asterisks. |
| `[#CERT_ADD_INFO#]` | The value of the publishing profile's **Additional information** field. |

More information in [Publish a certificate through a CURL destination](/docs/clm-publish-certificate-curl).