# Local Endpoints

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FRJSWYpPUnTQFFNFTvoPB%2FReference%20-%20Local%20Endpoints.png?alt=media&#x26;token=30457458-fddb-4956-8135-4cf2dfafebda" alt=""><figcaption></figcaption></figure>

**Audience:** IT admins who run management tasks against the agent (health checks, plugin control, jobs, settings) from scripts or tools.

***

### Overview

Keeper Privilege Manager exposes an **HTTP/HTTPS API** on **localhost only** (default ports 6888 HTTP, 6889 HTTPS). Use it for health checks, plugin start/stop/restart, job listing and trigger, settings and plugin settings, registration, and other management operations. All endpoints are **local** to the machine; they are not intended to be exposed to the network.

**Base URLs:**

* **HTTP:** `http://127.0.0.1:6888`
  * `HTTP: automatically redirects to HTTPS:`
* **HTTPS:** `https://127.0.0.1:6889`
  * Because this communication occurs entirely on the local machine, KEPM automatically manages the certificate lifecycle and validation. The certificate is kept in memory (not written to disk), is rotated internally, and a new certificate is generated each time the service starts.

**Authorization levels:**

* **Public** — No auth (health, root, system status).
* **Plugin** — Caller must be a process launched by Keeper Privilege Manager with valid certificate (e.g. plugins, jobs).
* **Elevated Admin** — Caller must have admin privileges (or be a trusted system process) and valid certificate.

Many management operations require **Plugin** or **Admin**. Scripts run manually often use **Admin** (e.g. from an elevated PowerShell or as root). For certificate-based calls, the product may provide a client certificate for script use; see your deployment docs.

***

### Public Endpoints (no auth)

Use these for monitoring and basic checks.

| Method | Path                 | Description                                                      |
| ------ | -------------------- | ---------------------------------------------------------------- |
| GET    | `/health`            | Health check. Returns status (e.g. healthy), timestamp, version. |
| GET    | `/`                  | Root; service name, status, version.                             |
| GET    | `/api/system/status` | System status: running, plugin count, job count (total/enabled). |

**Examples:**

```
curl -k https://localhost:6889/health
curl -k https://localhost:6889/
curl -k https://localhost:6889/api/system/status
```

***

### Plugin Management

| Method | Path                          | Auth   | Description                                                    |
| ------ | ----------------------------- | ------ | -------------------------------------------------------------- |
| GET    | `/api/plugins`                | Plugin | List all plugins (id, name, status, processId, lastStartTime). |
| POST   | `/api/plugins/{name}/start`   | Admin  | Start a plugin.                                                |
| POST   | `/api/plugins/{name}/stop`    | Admin  | Stop a plugin.                                                 |
| POST   | `/api/plugins/{name}/restart` | Admin  | Restart a plugin.                                              |

Replace `{name}` with the plugin id (e.g. KeeperPolicy, KeeperAPI). Use these to recover from a stuck plugin or after changing plugin config.

***

### Job Management

| Method | Path                        | Auth   | Description                                                       |
| ------ | --------------------------- | ------ | ----------------------------------------------------------------- |
| GET    | `/api/Jobs`                 | Plugin | List all registered jobs (id, name, enabled, schedule, last run). |
| GET    | `/api/Jobs/{jobId}`         | Plugin | Get one job by id.                                                |
| POST   | `/api/Jobs`                 | Admin  | Create a job (JSON body).                                         |
| PUT    | `/api/Jobs/{jobId}`         | Admin  | Update a job.                                                     |
| DELETE | `/api/Jobs/{jobId}`         | Admin  | Delete a job.                                                     |
| POST   | `/api/Jobs/{jobId}/run`     | Admin  | Run job immediately.                                              |
| POST   | `/api/Jobs/{jobId}/trigger` | Admin  | Trigger job with event context (JSON body).                       |
| POST   | `/api/Jobs/validate`        | Admin  | Validate job JSON (POST body = job JSON).                         |

Use **run** or **trigger** for on-demand execution; use **validate** before creating or updating jobs.

***

### Settings

<table><thead><tr><th width="111.38671875">Method</th><th>Path</th><th width="102.8671875">Auth</th><th>Description</th></tr></thead><tbody><tr><td>GET</td><td><code>/api/Settings</code></td><td>Plugin</td><td>Get all app settings (sensitive values may be masked).</td></tr><tr><td>GET</td><td><code>/api/Settings/{key}</code></td><td>Plugin</td><td>Get one setting by key (e.g. Settings:KestrelHttpsPort).</td></tr><tr><td>PUT</td><td><code>/api/Settings/{key}</code></td><td>Admin</td><td>Update a setting (body = value).</td></tr><tr><td>POST</td><td><code>/api/Settings/revert</code></td><td>Admin</td><td>Revert settings to defaults (optional body: list of keys).</td></tr></tbody></table>

***

### Plugin Settings

<table><thead><tr><th width="101.37109375">Method</th><th width="307.875">Path</th><th width="86.625">Auth</th><th>Description</th></tr></thead><tbody><tr><td>GET</td><td><code>/api/PluginSettings/{pluginName}</code></td><td>Plugin</td><td>Get all settings for a plugin.</td></tr><tr><td>GET</td><td><code>/api/PluginSettings/{pluginName}/{settingName}</code></td><td>Plugin</td><td>Get one plugin setting.</td></tr><tr><td>PUT</td><td><code>/api/PluginSettings/{pluginName}/{settingName}</code></td><td>Admin</td><td>Update one plugin setting (body = value).</td></tr><tr><td>POST</td><td><code>/api/PluginSettings/revert-all</code></td><td>Admin</td><td>Re-import all plugin settings from their JSON files on disk.</td></tr><tr><td>POST</td><td><code>/api/PluginSettings/{pluginName}/revert</code></td><td>Admin</td><td>Re-import one plugin’s settings from its JSON file.</td></tr></tbody></table>

Use **revert** or **revert-all** after editing plugin JSON files or after pushing config via policy so the in-memory settings match disk.

***

### Keeper Registration

<table><thead><tr><th width="107.69140625">Method</th><th>Path</th><th>Auth</th><th>Description</th></tr></thead><tbody><tr><td>GET</td><td><code>/api/Keeper/registration</code></td><td>Plugin</td><td>Get agent registration status (AgentUID, IsRegistered, Hostname, etc.).</td></tr><tr><td>POST</td><td><code>/api/Keeper/register</code></td><td>Admin (or public in some deployments)</td><td>Register agent; query param <code>token=...</code> (and optional <code>force=true</code>).</td></tr><tr><td>POST</td><td><code>/api/Keeper/unregister</code></td><td>Admin</td><td>Unregister agent.</td></tr></tbody></table>

**Example (register):**

```
curl -X POST "https://localhost:6889/api/Keeper/register?token=YOUR_TOKEN" -k
```

***

### Other Endpoint Groups

The API also includes endpoints for:

* **Audit** — GET/POST audit events.
* **Notifications** — Send notifications.
* **File access** — Request, grant, revoke file access; history.
* **User session** — Launch process in user session, validate launch.
* **Ephemeral** — Launch ephemeral account, list/delete accounts, cleanup.
* **Controls** — Control requests, approvals, launch approved request.
* **Credentials** — Risk assessment credentials (store/get/delete).
* **Path variables** — Create/update/delete custom path variables (if enabled).

Exact paths and request/response shapes follow the product’s API; the tables above cover the most common **management** tasks. For scripting, use **HTTPS**, handle **403** (auth) and **404** (not found), and use Admin or the appropriate certificate where required.