The Wazuh API is a RESTful service that runs on the manager (port 55000 by default) and is the same API the dashboard uses. It supports JWT authentication and RBAC, so you can build scripts, integrations and CI/CD checks.
1. Get a JWT token
TOKEN=$(curl -k -u wazuh-wui:wazuh-wui -X POST "https://localhost:55000/security/user/authenticate?raw=true")
echo $TOKEN2. Rotate the default password
curl -k -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
"https://localhost:55000/security/users/1" \
-d '{"password":"NewStrongP@ssw0rd!"}'3. List agents
curl -k -H "Authorization: Bearer $TOKEN" "https://localhost:55000/agents?pretty=true&limit=5"4. Restart an agent remotely
curl -k -X PUT -H "Authorization: Bearer $TOKEN" "https://localhost:55000/agents/001/restart"Note: JWT tokens expire after 900 seconds by default. Re-authenticate or extend the lifetime in /var/ossec/api/configuration/api.yaml.
We integrate Wazuh API with Jira, ServiceNow and Slack for ticketing and notifications, contact us.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
Wazuh APIAutomationREST