diff --git a/cmd/dkl-local-server/secret-store.go b/cmd/dkl-local-server/secret-store.go
index b1f9733..a5816d2 100644
--- a/cmd/dkl-local-server/secret-store.go
+++ b/cmd/dkl-local-server/secret-store.go
@@ -294,7 +294,7 @@ func (s KVSecrets[T]) Put(key string, v T) (err error) {
 func (s KVSecrets[T]) WsList(resp *restful.Response, prefix string) {
 	keys, err := s.Keys(prefix)
 	if err != nil {
-		httperr.New(http.StatusInternalServerError, err).WriteJSON(resp.ResponseWriter)
+		wsError(resp, err)
 		return
 	}
 
@@ -304,12 +304,12 @@ func (s KVSecrets[T]) WsList(resp *restful.Response, prefix string) {
 func (s KVSecrets[T]) WsGet(resp *restful.Response, key string) {
 	keys, found, err := s.Get(key)
 	if err != nil {
-		httperr.New(http.StatusInternalServerError, err).WriteJSON(resp.ResponseWriter)
+		wsError(resp, err)
 		return
 	}
 
 	if !found {
-		ErrNotFound.WriteJSON(resp.ResponseWriter)
+		wsNotFound(resp)
 		return
 	}
 
@@ -320,13 +320,13 @@ func (s KVSecrets[T]) WsPut(req *restful.Request, resp *restful.Response, key st
 	v := new(T)
 	err := req.ReadEntity(v)
 	if err != nil {
-		httperr.New(http.StatusBadRequest, err).WriteJSON(resp.ResponseWriter)
+		wsBadRequest(resp, err.Error())
 		return
 	}
 
 	err = s.Put(key, *v)
 	if err != nil {
-		httperr.New(http.StatusInternalServerError, err).WriteJSON(resp.ResponseWriter)
+		wsError(resp, err)
 		return
 	}
 }
diff --git a/cmd/dkl-local-server/ws-clusters.go b/cmd/dkl-local-server/ws-clusters.go
index 65bd09f..b218b7a 100644
--- a/cmd/dkl-local-server/ws-clusters.go
+++ b/cmd/dkl-local-server/ws-clusters.go
@@ -12,8 +12,8 @@ import (
 var clusterSecretKVs = []string{}
 
 func newClusterSecretKV[T any](name string) KVSecrets[T] {
-    clusterSecretKVs = append(clusterSecretKVs, name)
-    return KVSecrets[T]{"clusters/"+name}
+	clusterSecretKVs = append(clusterSecretKVs, name)
+	return KVSecrets[T]{"clusters/" + name}
 }
 
 func wsListClusters(req *restful.Request, resp *restful.Response) {
@@ -40,7 +40,7 @@ func wsReadCluster(req *restful.Request, resp *restful.Response) (cluster *local
 
 	cluster = cfg.Cluster(clusterName)
 	if cluster == nil {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
@@ -64,7 +64,7 @@ func wsClusterAddons(req *restful.Request, resp *restful.Response) {
 
 	if len(cluster.Addons) == 0 {
 		log.Printf("cluster %q has no addons defined", cluster.Name)
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
@@ -73,11 +73,11 @@ func wsClusterAddons(req *restful.Request, resp *restful.Response) {
 		return
 	}
 
-    sslCfg, err := sslConfigFromLocalConfig(cfg)
-    if err != nil {
-        wsError(resp, err)
-        return
-    }
+	sslCfg, err := sslConfigFromLocalConfig(cfg)
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
 
 	wsRender(resp, sslCfg, cluster.Addons, cluster)
 }
@@ -85,13 +85,13 @@ func wsClusterAddons(req *restful.Request, resp *restful.Response) {
 func wsClusterCACert(req *restful.Request, resp *restful.Response) {
 	cs := secretData.clusters[req.PathParameter("cluster-name")]
 	if cs == nil {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
 	ca := cs.CAs[req.PathParameter("ca-name")]
 	if ca == nil {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
@@ -101,13 +101,13 @@ func wsClusterCACert(req *restful.Request, resp *restful.Response) {
 func wsClusterSignedCert(req *restful.Request, resp *restful.Response) {
 	cs := secretData.clusters[req.PathParameter("cluster-name")]
 	if cs == nil {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
 	ca := cs.CAs[req.PathParameter("ca-name")]
 	if ca == nil {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
@@ -127,7 +127,7 @@ func wsClusterSignedCert(req *restful.Request, resp *restful.Response) {
 
 	kc := ca.Signed[name]
 	if kc == nil {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
diff --git a/cmd/dkl-local-server/ws-downloads.go b/cmd/dkl-local-server/ws-downloads.go
index 60b333c..67f2242 100644
--- a/cmd/dkl-local-server/ws-downloads.go
+++ b/cmd/dkl-local-server/ws-downloads.go
@@ -58,7 +58,7 @@ func wsDownload(req *restful.Request, resp *restful.Response) {
 	asset := req.PathParameter("asset")
 
 	if token == "" || asset == "" {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
@@ -95,7 +95,7 @@ func wsDownload(req *restful.Request, resp *restful.Response) {
 	})
 
 	if !found {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
@@ -115,7 +115,7 @@ func wsDownload(req *restful.Request, resp *restful.Response) {
 	case "cluster":
 		cluster := cfg.ClusterByName(spec.Name)
 		if cluster == nil {
-			wsNotFound(req, resp)
+			wsNotFound(resp)
 			return
 		}
 
@@ -125,13 +125,13 @@ func wsDownload(req *restful.Request, resp *restful.Response) {
 			resp.Write([]byte(cluster.Addons))
 
 		default:
-			wsNotFound(req, resp)
+			wsNotFound(resp)
 		}
 
 	case "host":
 		host := cfg.Host(spec.Name)
 		if host == nil {
-			wsNotFound(req, resp)
+			wsNotFound(resp)
 			return
 		}
 
@@ -145,6 +145,6 @@ func wsDownload(req *restful.Request, resp *restful.Response) {
 		renderHost(resp.ResponseWriter, req.Request, asset, host, cfg)
 
 	default:
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 	}
 }
diff --git a/cmd/dkl-local-server/ws-host.go b/cmd/dkl-local-server/ws-host.go
index 3a0e147..d23c46a 100644
--- a/cmd/dkl-local-server/ws-host.go
+++ b/cmd/dkl-local-server/ws-host.go
@@ -111,7 +111,7 @@ func (ws *wsHost) host(req *restful.Request, resp *restful.Response) (host *loca
 		return
 	}
 	if hostname == "" {
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 
@@ -124,7 +124,7 @@ func (ws *wsHost) host(req *restful.Request, resp *restful.Response) (host *loca
 	host = cfg.Host(hostname)
 	if host == nil {
 		log.Print("no host named ", hostname)
-		wsNotFound(req, resp)
+		wsNotFound(resp)
 		return
 	}
 	return
diff --git a/cmd/dkl-local-server/ws.go b/cmd/dkl-local-server/ws.go
index 2f2f9d1..e153bbc 100644
--- a/cmd/dkl-local-server/ws.go
+++ b/cmd/dkl-local-server/ws.go
@@ -220,8 +220,8 @@ func wsReadConfig(resp *restful.Response) *localconfig.Config {
 	return cfg
 }
 
-func wsNotFound(req *restful.Request, resp *restful.Response) {
-	http.NotFound(resp.ResponseWriter, req.Request)
+func wsNotFound(resp *restful.Response) {
+	wsError(resp, ErrNotFound)
 }
 
 func wsBadRequest(resp *restful.Response, err string) {