> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/custom-tooling.md).

# Custom Tooling

<figure><img src="/files/YaDtwWwVNW0mTRUTlzJf" alt=""><figcaption></figcaption></figure>

**Audience:** Developers and DevOps engineers who need to run a custom executable on KEPM-managed endpoints.

Keeper Endpoint Privilege Manager is not only a policy enforcement platform — it is also an extensible agent that your tools can run on top of. If your team needs to deploy a custom executable on managed endpoints (for example, a secrets scanner, a compliance reporter, or a maintenance utility), the KEPM agent can run it on a schedule, monitor its output, and route its logs through the same pipeline that operators already watch.

This section covers how to build and run that tooling end to end: from authoring the job or plugin JSON that tells the agent what to run, to connecting to the local MQTT broker to publish structured logs, to deploying and registering your binary via the local HTTPS API.

## Tooling Patterns

KEPM supports two ways to run custom tooling. Understanding the distinction up front will save you time.

### Jobs

**Jobs** are the right choice for most custom tools. A job is a JSON document that defines *when* something runs — on a schedule, at agent startup, or on a specific event — and *what* runs: a task that points at your binary. The agent starts the process, tracks its exit code, captures its output, and grants it access to MQTT for structured logging. Job tasks do not require a long-running process and do not require plugin registration. If you are building a scanner, reporter, or any tool that runs and exits, start here.

### Plugins

**Managed plugins** are the right choice when you need a long-running process that is part of the agent's lifecycle — started with the agent, monitored, restarted on failure, and subscribed to MQTT topics as a first-class component. This is a deeper integration pattern typically used for bridges, daemons, or other persistent services.

***

## Guides

The [**Custom Job Guide**](/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-job-guide.md) explains how to build, deploy, and configure a job task binary end to end, including binary layout, job JSON, execution context, code signing, MQTT logging, and the pre-launch checklist.

The [**Custom Plugin Guide**](/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-plugin-guide.md) covers how to register a managed plugin, including plugin JSON fields, lifecycle settings, MQTT subscription, and how plugins differ from job tasks.

The [**HTTP Reference**](/en/keeperpam/endpoint-privilege-manager/custom-tooling/http-reference-guide.md) covers the local HTTPS API endpoints your tooling will call, including creating and deploying jobs via `/api/Jobs`, reading runtime settings via `/api/PluginSettings`, and understanding the Admin vs. Plugin authorization tiers.

If you need Azure workflow automation, see the [**Azure Logic Apps Connector**](/en/keeperpam/secrets-manager/integrations/azure-logic-app-connector.md). It shows how to connect Keeper Secrets Manager to Azure Logic Apps and Power Automate.

***

### Before You Start

You will need a few things from the team that manages the KEPM deployment before you can develop or test your tooling:

* The **agent version** running on target endpoints — validation rules and available features vary by release.
* The **`KeeperApiBaseUrl`** for the local HTTPS API (typically `https://127.0.0.1:6889`, but confirm with your administrator).
* Confirmation of whether **Last Known Good** (`ConfigurationLkg`) is enabled, which affects how you deploy job JSON files to endpoints.
* If your binary needs to publish to MQTT: whether **`AlternativeSignatures`** needs to be updated to trust your code-signing certificate, and whether `AllowedNonAdminExecutables` applies to your use case.
* The **deployment method** your organization uses for pushing job definitions to endpoints: the local HTTPS API, `JobUpdate` policy via the Keeper console, or another supported path.

For most custom tools, the [Custom Job Guide](/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-job-guide.md) is the right starting point. Read the [HTTP Reference](/en/keeperpam/endpoint-privilege-manager/custom-tooling/http-reference-guide.md) alongside it when you are ready to script deployment or call Plugin Settings from your binary at runtime.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/custom-tooling.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.