Getting started

Authenticate the Wazuh server API via command line

To ensure secure access, all Wazuh server API endpoints require authentication. Follow the steps outlined in the POST /security/user/authenticate reference guide to obtain a token necessary for accessing the API endpoints:

1. Run the following command to send a user authentication POST request to the Wazuh server API and store the returned JWT in the TOKEN variable. Replace <WAZUH_API_USER> and <WAZUH_API_PASSWORD> with your credentials.

   # TOKEN=$(curl -u <WAZUH_API_USER>:<WAZUH_API_PASSWORD> -k -X POST "https://localhost:55000/security/user/authenticate?raw=true")
   

   Note

   • If SSL (HTTPS) is enabled in the API and it is using the default self-signed certificates, you need to add the parameter -k to avoid the server connection verification. We recommend using the raw=true query parameter when authenticating via cURL commands, as it simplifies handling by returning the token in plain text, especially useful for long JWTs.

   • The default Wazuh server API credential is wazuh:wazuh, This should be changed after installation to avoid vulnerabilities. But if the Wazuh deployment was performed using the installation script, the Wazuh API user is wazuh and you can extract the password from wazuh-install-files.tar by running the command tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O | grep -P "\'wazuh\'" -A 1.

   • You can reset the password for the wazuh user if you cannot retrieve the password.

2. Verify that the token has been generated:

   # echo $TOKEN
   

   The output should be a lengthy string similar to the following:

   eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzA3ODk4NTEzLCJleHAiOjE3MDc4OTk0MTMsInN1YiI6IndhenVoIiwicnVuX2FzIjpmYWxzZSwicmJhY19yb2xlcyI6WzFdLCJyYmFjX21vZGUiOiJ3aGl0ZSJ9.ACcJ3WdV3SnTOC-PV2oGZGCyH3GpStSOu161UHHT7w6eUm_REOP_g8SqqIJDDW0gCcQNJTEECortIuI4zj7nybNhACRlBrDBZoG4Re4HXEpAchyFQXwq0SsZ3HHSj7eJinBF0pJDG0D8d1_LkcoxaX3FpxpsCZ4xzJ492CpnVZLT8qI4
   

   If the authentication fails, the output will either display an error message or remain blank. In such cases, double-check your user credentials and ensure you have network connectivity to the Wazuh server API.

3. Send an API request to confirm that everything is working as expected:

   # curl -k -X GET "https://localhost:55000/" -H "Authorization: Bearer $TOKEN"
   

   {
      "data": {
         "title": "Wazuh API REST",
         "api_version": "4.14.1",
         "revision": "rc2",
         "license_name": "GPL 2.0",
         "license_url": "https://github.com/wazuh/wazuh/blob/v4.14.1/LICENSE",
         "hostname": "thecotilking-VirtualBox",
         "timestamp": "2026-01-23T13:57:11Z"
      },
      "error": 0
   }
   

Once authenticated, you can access any API endpoint using the below structure. Replace <METHOD> with the desired method and <ENDPOINT> with the string corresponding to the endpoint you wish to access. If you are not using an environment variable, replace $TOKEN with the obtained JWT.

# curl -k -X <METHOD> "https://localhost:55000/<ENDPOINT>" -H  "Authorization: Bearer $TOKEN"

Authenticate the Wazuh server API via scripts

Automating interactions with the Wazuh server API requires obtaining a JWT token programmatically. The examples below show how to authenticate and make authenticated requests using popular scripting languages like Python and Bash.

When you call the authentication endpoint /security/user/authenticate, you can choose how the API returns the token:

• By default (without any special parameter) - the response is a structured JSON object containing the token inside a data field. This format is convenient when your script can easily parse JSON.

• With the query parameter ?raw=true - the API returns only the plain text token (no JSON wrapper). This is much simpler when using tools like cURL in shell scripts, because you can capture the token directly into a variable without extra parsing steps.

These scripts are intended for users looking to enhance their operational efficiency through automation or those seeking to understand how to programmatically access the Wazuh server API for custom integrations.