How to replace hardcoded database passwords in applications/scripts using Netwrix Privilege Secure?

I have a customer use case and would like to understand the best approach using Netwrix Privilege Secure (NPS).
Background
The customer currently has several applications and scheduled scripts that contain hardcoded database passwords in plaintext. They would like to eliminate this risk by having NPS manage these credentials, so that applications can retrieve passwords dynamically at runtime instead of storing them in code.
Questions

Is this a supported use case for NPS? Can an application or script call the NPS REST API at runtime to retrieve a managed credential (e.g., a database account password)?
What is the recommended account type for this scenario — Application User, Local User, or an AD service account? And what authentication method is recommended for non-interactive/automated use (API Key, certificate, or other)?

Thank you in advance for any guidance!