The REST API plugin binds its web endpoints to the embedded webserver that is used for the Openfire administrative console. For authentication and access control, it is prefered to use a dedicated embedded webserver for the REST API plugin.