2. Connect Endpoint Manager

One-time setup: enable three ISE APIs, mint an API user, paste Base URL / Username / Password into API Configuration. Every Context goes through this once.

Before the Context can manage anything, it needs to talk to your Cisco ISE. That’s an HTTPS connection from the platform’s egress FQDN to an ISE that has three API families enabled, authenticated as an API user you create specifically for this purpose.

This page is the field reference for the API Configuration tab on the platform side.

Complete Prepare Cisco ISE first — enable ERS, Open API and the API Gateway in Cisco ISE, create the dedicated API admin user, and define the Endpoint Custom Attributes. The rest of this page assumes the ISE side is ready.

The platform uses three Cisco ISE API families in parallel:

• ERS (External RESTful Services) — for reading and creating Endpoint Identity Groups and listing endpoints in bulk.
• Open API — for per-endpoint CRUD and bulk endpoint upserts (used by both admin-side and Self-Service-side operations).
• Monitoring API (MnT) — for reading live session data and issuing Change of Authorization.

All three must be reachable. If any one is down, the Cisco ISE API Status table reports it and the Context refuses to operate until it’s fixed.

The API Configuration tab

Open the Context’s Configuration → API Configuration tab.

Fields

• Cisco ISE Base URL. The HTTPS URL of your ISE admin node, for example https://ise.your-domain.example. The platform talks to the same base URL for all three API families — ERS, Open API and Monitoring paths are all rooted there.
• Username. The API user you created above.
• Password. The API user’s password. Stored encrypted, never shown back. The field is blank when you return to the tab even though the saved password is still in use — enter a new password only if you want to rotate it.

Below the form you’ll see the current API User and API Base URL for reference, and the Cisco ISE API Status table.

Saving

Click Update API Configuration. The platform immediately exercises the credentials against all three API families:

• Lists a page of Endpoint Identity Groups via ERS.
• Fetches a page of endpoints via Open API.
• Pings the Monitoring API for a harmless query.

The Cisco ISE API Status table reports the result per API:

API	What Up means	What Down usually means
Endpoint API	Open API is reachable and the user can read endpoints.	Open API isn’t enabled, or the user lacks endpoint permissions.
Endpoint Groups API	ERS is reachable and the user can read groups.	ERS isn’t enabled, or the user lacks group permissions.
Monitoring API	MnT is reachable and the user can query session data.	MnT isn’t enabled on the deployment or the user isn’t authorised for it.

If any row reads Down, fix the ISE side and click Update API Configuration again. There’s no partial-readiness state — every row must read Up before the Context can manage groups.

Help text

The API Configuration tab carries a Connectivity Troubleshooting Guide link that walks you through the ISE-side enablement step by step if something isn’t working.

When to re-verify

Re-open API Configuration and re-save whenever any of these change on your ISE:

• The API user’s password.
• The API user’s role / permission set.
• The ISE Base URL (for example, a cert renewal that reissues the admin node under a different hostname, or a migration to a new deployment).
• Enablement of any of the three API families.

No admin-dashboard restart is needed — the Context is ready again as soon as the status table reads Up.

Related

Quickstart

Context create → API Configuration → first managed group.

Endpoint Manager Context

What a Context holds and how it talks to ISE.

Managed Attributes

Define Endpoint Custom Attributes once the connection is up.

Troubleshooting

Symptoms and their usual causes.