Skip to main content
Before the Context can manage anything, it needs to talk to your Cisco ISE. That’s an HTTPS connection from the platform’s egress FQDN to an ISE that has three API families enabled, authenticated as an API user you create specifically for this purpose. This page is the field reference for the API Configuration tab and the one-time work that has to happen on the ISE side first.

​
Prerequisites on Cisco ISE

You need three things on the ISE deployment before you touch the admin dashboard:

​
1. Enable the three API families

Endpoint Manager uses three of Cisco ISE’s API families in parallel:
  • ERS (External RESTful Services) — for reading and creating Endpoint Identity Groups and listing endpoints in bulk.
  • Open API — for per-endpoint CRUD and bulk endpoint upserts (used by both admin-side and Self-Service-side operations).
  • Monitoring API (MnT) — for reading live session data and issuing Change of Authorization.
All three must be enabled on the ISE deployment. If any one is off, the Cisco ISE API Status table will report it as Down and the Context will refuse to operate.

​
2. Create a dedicated API user

Mint an ISE admin user specifically for Endpoint Manager. The user needs permission to:
  • Read Endpoint Identity Groups.
  • Create Endpoint Identity Groups (only if you’ll create groups from the platform rather than only connecting existing ones).
  • Read, create, update and delete endpoints.
  • Read endpoint session data from the Monitoring API.
  • Issue Change of Authorization requests.
Assign a strong, unique password. Don’t reuse a human administrator’s credentials.

​
3. Allow the platform’s egress FQDN

Cisco ISE must accept inbound HTTPS connections from the platform’s egress FQDN. The exact FQDN is shown in the admin’s API Configuration card — it looks like pn.sr1.c0.example.net. Add it to whatever firewall, proxy or ACL sits in front of the ISE admin node.
ISE can be on-premises or cloud-hosted — Endpoint Manager only cares that it’s reachable over HTTPS from that FQDN. Deployment topology makes no difference to the platform.

​
The API Configuration tab

Open the Context’s Configuration → API Configuration tab.

​
Fields

  • Cisco ISE Base URL. The HTTPS URL of your ISE admin node, for example https://ise.your-domain.example. The platform talks to the same base URL for all three API families — ERS, Open API and Monitoring paths are all rooted there.
  • Username. The API user you created above.
  • Password. The API user’s password. Stored encrypted, never shown back. The field is blank when you return to the tab even though the saved password is still in use — enter a new password only if you want to rotate it.
Below the form you’ll see the current API User and API Base URL for reference, and the Cisco ISE API Status table.
API Configuration tab with Cisco ISE Base URL, Username filled in, Password field blank, and Update API Configuration button

​
Saving

Click Update API Configuration. The platform immediately exercises the credentials against all three API families:
  • Lists a page of Endpoint Identity Groups via ERS.
  • Fetches a page of endpoints via Open API.
  • Pings the Monitoring API for a harmless query.
The Cisco ISE API Status table reports the result per API:
APIWhat Up meansWhat Down usually means
Endpoint APIOpen API is reachable and the user can read endpoints.Open API isn’t enabled, or the user lacks endpoint permissions.
Endpoint Groups APIERS is reachable and the user can read groups.ERS isn’t enabled, or the user lacks group permissions.
Monitoring APIMnT is reachable and the user can query session data.MnT isn’t enabled on the deployment or the user isn’t authorised for it.
If any row reads Down, fix the ISE side and click Update API Configuration again. There’s no partial-readiness state — every row must read Up before the Context can manage groups.
Cisco ISE API Status table with Endpoint API, Endpoint Groups API and Monitoring API each reporting Up

​
Help text

The API Configuration tab carries a Connectivity Troubleshooting Guide link that walks you through the ISE-side enablement step by step if something isn’t working.

​
When to re-verify

Re-open API Configuration and re-save whenever any of these change on your ISE:
  • The API user’s password.
  • The API user’s role / permission set.
  • The ISE Base URL (for example, a cert renewal that reissues the admin node under a different hostname, or a migration to a new deployment).
  • Enablement of any of the three API families.
No admin-dashboard restart is needed — the Context is ready again as soon as the status table reads Up.

Quickstart

Context create → API Configuration → first managed group.

Endpoint Manager Context

What a Context holds and how it talks to ISE.

Managed Attributes

Define Endpoint Custom Attributes once the connection is up.

Troubleshooting

Symptoms and their usual causes.