diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/amazon_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/amazon_credential.rb
index 1f5b7ce22d6..f1ccf7c297a 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/amazon_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/amazon_credential.rb
@@ -48,7 +48,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
     attrs[:auth_key] = attrs.delete(:security_token) if attrs.key?(:security_token)
     attrs
   end
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/azure_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/azure_credential.rb
index 81568f43538..eab93411240 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/azure_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/azure_credential.rb
@@ -69,7 +69,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs            = params.dup
+    attrs            = super
     attrs[:auth_key] = attrs.delete(:secret) if attrs.key?(:secret)
 
     if %i[client tenant subscription].any? {|opt| attrs.has_key? opt }
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/google_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/google_credential.rb
index 8fc45ba5b04..f7e55982f5f 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/google_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/google_credential.rb
@@ -49,7 +49,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
 
     attrs[:auth_key] = attrs.delete(:ssh_key_data)            if attrs.key?(:ssh_key_data)
     attrs[:options]  = { :project => attrs.delete(:project) } if attrs[:project]
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/machine_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/machine_credential.rb
index e83499c9d3f..3d48ed04f9e 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/machine_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/machine_credential.rb
@@ -98,7 +98,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
 
     attrs[:auth_key]          = attrs.delete(:ssh_key_data)   if attrs.key?(:ssh_key_data)
     attrs[:auth_key_password] = attrs.delete(:ssh_key_unlock) if attrs.key?(:ssh_key_unlock)
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/network_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/network_credential.rb
index 7078e6b6138..3a84741b761 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/network_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/network_credential.rb
@@ -77,7 +77,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
 
     attrs[:auth_key]          = attrs.delete(:ssh_key_data)       if attrs.key?(:ssh_key_data)
     attrs[:auth_key_password] = attrs.delete(:ssh_key_unlock)     if attrs.key?(:ssh_key_unlock)
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/openstack_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/openstack_credential.rb
index 2ce18e518fb..aa7fabf1f7a 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/openstack_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/openstack_credential.rb
@@ -65,7 +65,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
 
     if %i[host domain project].any? {|opt| attrs.has_key? opt }
       attrs[:options]         ||= {}
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/rhv_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/rhv_credential.rb
index 6d413ee321a..d81df7ba521 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/rhv_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/rhv_credential.rb
@@ -43,7 +43,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
     attrs[:options] = { :host => attrs.delete(:host) } if attrs[:host]
     attrs
   end
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/vault_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/vault_credential.rb
index c7e9dc921fc..35ec969bc68 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/vault_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/vault_credential.rb
@@ -28,7 +28,7 @@ def self.display_name(number = 1)
   alias vault_password password
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
     attrs[:password] = attrs.delete(:vault_password) if attrs.key?(:vault_password)
     attrs
   end
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/vmware_credential.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/vmware_credential.rb
index 08aa6bd2d8a..a3e6a39cc80 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/vmware_credential.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/vmware_credential.rb
@@ -47,7 +47,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
     attrs[:options] = { :host => attrs.delete(:host) } if attrs[:host]
     attrs
   end
diff --git a/app/models/manageiq/providers/embedded_automation_manager/authentication.rb b/app/models/manageiq/providers/embedded_automation_manager/authentication.rb
index 94b9f7222a3..f7a4e0dd960 100644
--- a/app/models/manageiq/providers/embedded_automation_manager/authentication.rb
+++ b/app/models/manageiq/providers/embedded_automation_manager/authentication.rb
@@ -20,8 +20,12 @@ def self.display_name(number = 1)
 
   include ManageIQ::Providers::EmbeddedAutomationManager::CrudCommon
 
-  def self.params_to_attributes(_params)
-    raise NotImplementedError, "must be implemented in a subclass"
+  def self.params_to_attributes(params)
+    allowed_params     = API_ATTRIBUTES.pluck(:id)
+    unpermitted_params = params.keys - allowed_params
+    raise ArgumentError, _("Invalid parameters: %{params}" % {:params => unpermitted_params.join(", ")}) if unpermitted_params.any?
+
+    params
   end
 
   def self.raw_create_in_provider(manager, params)
diff --git a/app/models/manageiq/providers/embedded_automation_manager/scm_credential.rb b/app/models/manageiq/providers/embedded_automation_manager/scm_credential.rb
index db9cf2a2b0f..4905c8a7bbc 100644
--- a/app/models/manageiq/providers/embedded_automation_manager/scm_credential.rb
+++ b/app/models/manageiq/providers/embedded_automation_manager/scm_credential.rb
@@ -56,7 +56,7 @@ def self.display_name(number = 1)
   end
 
   def self.params_to_attributes(params)
-    attrs = params.dup
+    attrs = super
 
     attrs[:auth_key]          = attrs.delete(:ssh_key_data)    if attrs.key?(:ssh_key_data)
     attrs[:auth_key_password] = attrs.delete(:ssh_key_unlock)  if attrs.key?(:ssh_key_unlock)