ETP Glossary

ETP — Endpoint Takeover Prevention adds an independent authorization check for selected high-impact actions. Administrators sign protected actions and configurations using their Action1 Keys. Before a protected action can execute, the Action1 agent verifies the signature against trusted public keys and checks that the signed content has not been altered. See also: Endpoint Takeover Prevention.

Installation token — A token that associates an Action1 agent with an Action1 organization during installation. Each organization has one current installation token, used for all agents in that organization. The token is created during agent setup and is displayed only when created. To authorize token creation or recreation, provide your Action1 Key. Recreating the token invalidates the previous token for new installations; already installed agents continue to work. Update deployment tools, scripts, and scheduled installation tasks to use the new token.

Action1 Key — A customer-owned private authorization key used to sign protected actions and configurations. It is generated locally in the administrator’s browser and is stored encrypted in Cloud Storage or Local Storage. Action1 does not receive the unencrypted Action1 Key.

Trusted public key — A public key trusted by the Action1 agent and used to verify signatures created with an Action1 Key. It is distinct from the private Action1 Key used for signing.

Action1 Key file — A file containing an encrypted Action1 Key for Local Storage. The Action1 Key file uses the PEM format. When prompted to sign, select the Action1 Key file and enter its Key passphrase.

Action1 Key status — The current state of an administrator’s Action1 Key:

• Not created — The administrator has not created an Action1 Key.
• Waiting for approval — The Action1 Key has been created but still requires approval by another Enterprise Admin with an Active Action1 Key.
• Active — The Action1 Key can be used to sign protected actions and configurations. The first Action1 Key created during initial ETP setup becomes Active without another administrator’s approval. Additional administrators’ Action1 Keys become Active after approval.

Key passphrase — A secret generated automatically in the browser to protect access to an Action1 Key. Copy and store the generated Key passphrase securely; Action1 cannot recover it. For Local Storage, keep the Key passphrase separately from the Action1 Key file.

Confirmation code — A credential generated for an Action1 Key approval request and shared securely with the approving administrator. The Confirmation code is distinct from the Key passphrase and is not used to decrypt the Action1 Key.

Protected action — A runtime operation that requires signature verification by the Action1 agent before execution. See Explore Endpoint Takeover Prevention for the categories of protected actions and configurations.

Configuration — Saved content that is signed to authorize its use, such as an automation configuration, script, Data Source, or Software Repository package version. A signed automation configuration authorizes the corresponding protected actions at runtime.

Cloud Storage — The default storage mode, in which an encrypted copy of the Action1 Key is stored in Action1 Vault. In the Action1 web console, the browser retrieves and decrypts the Action1 Key locally using the Key passphrase, then signs protected actions and configurations. Action1 Vault does not receive the Key passphrase or decrypt the Action1 Key.

Local Storage — A storage mode in which the administrator retains the encrypted Action1 Key file. When prompted to sign in the Action1 web console, the administrator selects the Action1 Key file and enters the Key passphrase.