Getting started

Authenticate the Wazuh manager API from the command line

To ensure secure access, all Wazuh manager API endpoints require authentication. Follow the steps outlined in the POST /security/user/authenticate reference guide to obtain a token necessary for accessing the API endpoints:

1. Run the following command to authenticate with the Wazuh manager API and store the returned JWT in the TOKEN variable, replacing <WAZUH_API_USER> and <WAZUH_API_PASSWORD> with your credentials.

   # TOKEN=$(curl -u <WAZUH_API_USER>:<WAZUH_API_PASSWORD> -k -X POST "https://<WAZUH_MANAGER_IP_ADDRESS>:55000/security/user/authenticate?raw=true")
   

   Note

   • The Wazuh manager certificate authority (CA) issues the Wazuh manager API certificate. Add -k to skip certificate verification, or use --cacert with a copy of /etc/wazuh-manager/export/ca.pem to verify the certificate. We recommend the raw=true query parameter when you authenticate with cURL. It returns the token in plain text, which simplifies handling long JWTs.

   • The wazuh and wazuh-internal-client Wazuh manager API users have no default password. The installation generates a password for each user and stores it in /etc/wazuh-manager/export/credentials.env on the Wazuh manager, readable only by root. In a distributed deployment, the passwords are also in wazuh-install-files/credentials.env inside the wazuh-install-files.tar file. Both credentials.env files hold the wazuh password as WAZUH_MANAGER_API_PASSWORD and the wazuh-internal-client password as WAZUH_MANAGER_WUI_PASSWORD. The Wazuh dashboard uses wazuh-internal-client, so use wazuh for your own requests. To print the wazuh password, run sed -n 's/^WAZUH_MANAGER_API_PASSWORD=//p' /etc/wazuh-manager/export/credentials.env as root on the Wazuh manager.

   • You can reset the password for the wazuh user if you can't retrieve it. The /etc/wazuh-manager/export/credentials.env file holds the password set at installation. If you change the wazuh password later, the file no longer holds the current password.

2. Verify that the token has been generated:

   # echo $TOKEN
   

   The command output looks similar to this:

   eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzkxOTg2NjIzLCJuYmZfbXMiOjE3OTE5ODY2MjM4ODUsImV4cCI6MTc5MTk4NzUyMywic3ViIjoid2F6dWgiLCJydW5fYXMiOmZhbHNlLCJyYmFjX3JvbGVzIjpbMV0sInJiYWNfbW9kZSI6IndoaXRlIn0.AeKHOdYaBEW4U-kZiHMXlYwVzSAHOdOQdPdDJ874450WdligB3PWxc2Jrz2WuUVWHOUBHDn05iyi42UQwWZN0IRPAa0OG7arhv0w2psqOWwHU8OnDs-RH7QAnwpFe47_tGeH0rweikwRmT-nS09u-x3uh3SaTNfydQnnqOa5VUyryDQ0
   

   If the authentication fails, the output either displays an error message or remains blank. In such cases, double-check your user credentials and make sure you have network connectivity to the Wazuh manager API.

   After you authenticate, you can access any API endpoint using the following structure. Replace <METHOD> with the desired method and <ENDPOINT> with the string corresponding to the endpoint you wish to access. If you are not using an environment variable, replace $TOKEN with the obtained JWT.

   # curl -k -X <METHOD> "https://<WAZUH_MANAGER_IP_ADDRESS>:55000/<ENDPOINT>" -H "Authorization: Bearer $TOKEN"
   

3. Send an API request to return basic API info about the Wazuh manager:

   # curl -k -s -X GET "https://<WAZUH_MANAGER_IP_ADDRESS>:55000/?pretty=true" -H "Authorization: Bearer $TOKEN"
   

   Replace <WAZUH_MANAGER_IP_ADDRESS> with the IP address of your Wazuh manager.

   The command output looks similar to this:

   {
      "data": {
         "title": "Wazuh API REST",
         "api_version": "5.0.0",
         "revision": "rc2",
         "license_name": "GPL 2.0",
         "license_url": "https://github.com/wazuh/wazuh/blob/v5.0.0-rc2/LICENSE",
         "hostname": "ubuntu-QEMU-Virtual-Machine",
         "timestamp": "2026-09-23T07:30:59Z"
      },
      "error": 0
   }
   

It sends an authenticated GET request to the root endpoint of the Wazuh manager API. The API returns basic API info (title, version, revision, hostname, timestamp) in a human-readable (pretty-printed) format.

To end a session, send DELETE /security/user/authenticate with the token. The request invalidates every token of the current user. For a token from POST /security/user/authenticate/run_as, the request invalidates only the tokens granted for the same authorization context.

A token expires after 900 seconds by default. Request a new token when it expires. To change the lifetime, use PUT /security/config. This change revokes all existing tokens. After 50 failed login attempts from an IP address, the Wazuh manager API rejects login requests from that address with HTTP 403 and error 6000 until 300 seconds have passed since its first failed attempt.

Authenticate the Wazuh manager API with scripts

A script that interacts with the Wazuh manager API must obtain a JWT programmatically. The examples below show how to authenticate and make authenticated requests using popular scripting languages like Python and Bash.

When you call the authentication endpoint /security/user/authenticate, you can choose how the API returns the token:

• By default (without any special parameter), the response is a structured JSON object containing the token inside a data field. This format is convenient when your script can easily parse JSON.

• With the raw=true query parameter, the Wazuh manager API returns only the plain text token (no JSON wrapper). A plain token suits cURL in shell scripts, because you can capture the token directly into a variable without extra parsing steps.

Use these scripts to automate tasks, or to learn how to access the Wazuh manager API programmatically for custom integrations.