1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([["17964"],{23267(e,s,n){n.r(s),n.d(s,{metadata:()=>i,default:()=>o,frontMatter:()=>t,contentTitle:()=>d,toc:()=>c,assets:()=>a});var i=JSON.parse('{"id":"api/secret/ssh","title":"SSH secrets engine (API)","description":"This is the API documentation for the OpenBao SSH secrets engine.","source":"@site/content/docs/api/secret/ssh.mdx","sourceDirName":"api/secret","slug":"/api/secret/ssh","permalink":"/docs/next/api/secret/ssh","draft":false,"unlisted":false,"editUrl":"https://github.com/openbao/openbao/blob/main/website/content/docs/api/secret/ssh.mdx","tags":[],"version":"current","frontMatter":{"sidebar_label":"SSH","description":"This is the API documentation for the OpenBao SSH secrets engine."},"sidebar":"api","previous":{"title":"RabbitMQ","permalink":"/docs/next/api/secret/rabbitmq"},"next":{"title":"TOTP","permalink":"/docs/next/api/secret/totp"}}'),l=n(94686),r=n(44812);let t={sidebar_label:"SSH",description:"This is the API documentation for the OpenBao SSH secrets engine."},d="SSH secrets engine (API)",a={},c=[{value:"Table of contents",id:"table-of-contents",level:2},{value:"Notice About New Multi-Issuer Functionality",id:"notice-about-new-multi-issuer-functionality",level:2},{value:"Managing Authority Information",id:"managing-authority-information",level:2},{value:"List roles",id:"list-roles",level:3},{value:"Parameters",id:"parameters",level:4},{value:"Sample request",id:"sample-request",level:4},{value:"Sample response",id:"sample-response",level:4},{value:"List roles by IP",id:"list-roles-by-ip",level:3},{value:"Parameters",id:"parameters-1",level:4},{value:"Sample payload",id:"sample-payload",level:4},{value:"Sample request",id:"sample-request-1",level:4},{value:"Sample response",id:"sample-response-1",level:4},{value:"Create/Update role",id:"createupdate-role",level:3},{value:"Parameters",id:"parameters-2",level:4},{value:"Sample payload",id:"sample-payload-1",level:4},{value:"Sample request",id:"sample-request-2",level:4},{value:"Read role",id:"read-role",level:3},{value:"Parameters",id:"parameters-3",level:4},{value:"Sample request",id:"sample-request-3",level:4},{value:"Sample response",id:"sample-response-2",level:4},{value:"Delete role",id:"delete-role",level:3},{value:"Parameters",id:"parameters-4",level:4},{value:"Sample request",id:"sample-request-4",level:4},{value:"List Zero-Address roles",id:"list-zero-address-roles",level:3},{value:"Sample request",id:"sample-request-5",level:4},{value:"Sample response",id:"sample-response-3",level:4},{value:"Configure Zero-Address roles",id:"configure-zero-address-roles",level:3},{value:"Parameters",id:"parameters-5",level:4},{value:"Sample payload",id:"sample-payload-2",level:4},{value:"Sample request",id:"sample-request-6",level:4},{value:"Delete Zero-Address roles",id:"delete-zero-address-roles",level:3},{value:"Sample request",id:"sample-request-7",level:4},{value:"Generate SSH credentials",id:"generate-ssh-credentials",level:3},{value:"Parameters",id:"parameters-6",level:4},{value:"Sample payload",id:"sample-payload-3",level:4},{value:"Sample request",id:"sample-request-8",level:4},{value:"Sample response",id:"sample-response-4",level:4},{value:"Read issuers configuration",id:"read-issuers-configuration",level:3},{value:"Sample request",id:"sample-request-9",level:4},{value:"Sample response",id:"sample-response-5",level:4},{value:"Set issuers configuration",id:"set-issuers-configuration",level:3},{value:"Parameters",id:"parameters-7",level:4},{value:"Sample payload",id:"sample-payload-4",level:4},{value:"Sample request",id:"sample-request-10",level:4},{value:"Sample response",id:"sample-response-6",level:4},{value:"Tidy host keys",id:"tidy-host-keys",level:3},{value:"Sample request",id:"sample-request-11",level:4},{value:"Sample response",id:"sample-response-7",level:4},{value:"Managing issuers",id:"managing-issuers",level:2},{value:"List issuers",id:"list-issuers",level:3},{value:"Parameters",id:"parameters-8",level:4},{value:"Sample request",id:"sample-request-12",level:4},{value:"Sample response",id:"sample-response-8",level:4},{value:"Submit CA information",id:"submit-ca-information",level:3},{value:"Parameters",id:"parameters-9",level:4},{value:"Sample payload",id:"sample-payload-5",level:4},{value:"Sample request",id:"sample-request-13",level:4},{value:"Sample response",id:"sample-response-9",level:4},{value:"Submit issuer with optional name",id:"submit-issuer-with-optional-name",level:3},{value:"Parameters",id:"parameters-10",level:4},{value:"Sample payload",id:"sample-payload-6",level:4},{value:"Sample request",id:"sample-request-14",level:4},{value:"Sample response",id:"sample-response-10",level:4},{value:"Read issuer",id:"read-issuer",level:3},{value:"Parameters",id:"parameters-11",level:4},{value:"Sample request",id:"sample-request-15",level:4},{value:"Sample response",id:"sample-response-11",level:4},{value:"Read issuer public key (Unauthenticated)",id:"read-issuer-public-key-unauthenticated",level:3},{value:"Parameters",id:"parameters-12",level:4},{value:"Sample request",id:"sample-request-16",level:4},{value:"Sample response",id:"sample-response-12",level:4},{value:"Read public key (Authenticated)",id:"read-public-key-authenticated",level:3},{value:"Sample request",id:"sample-request-17",level:4},{value:"Sample response",id:"sample-response-13",level:4},{value:"Read public key (Unauthenticated)",id:"read-public-key-unauthenticated",level:3},{value:"Sample request",id:"sample-request-18",level:4},{value:"Sample response",id:"sample-response-14",level:4},{value:"Update issuer",id:"update-issuer",level:3},{value:"Parameters",id:"parameters-13",level:4},{value:"Sample payload",id:"sample-payload-7",level:4},{value:"Sample request",id:"sample-request-19",level:4},{value:"Sample response",id:"sample-response-15",level:4},{value:"Delete CA information",id:"delete-ca-information",level:3},{value:"Sample request",id:"sample-request-20",level:4},{value:"Delete issuer",id:"delete-issuer",level:3},{value:"Parameters",id:"parameters-14",level:4},{value:"Sample request",id:"sample-request-21",level:4},{value:"Issuer operations",id:"issuer-operations",level:2},{value:"Sign SSH key",id:"sign-ssh-key",level:3},{value:"Parameters",id:"parameters-15",level:4},{value:"Sample payload",id:"sample-payload-8",level:4},{value:"Sample request",id:"sample-request-22",level:4},{value:"Sample response",id:"sample-response-16",level:4},{value:"Generate certificate and key",id:"generate-certificate-and-key",level:3},{value:"Parameters",id:"parameters-16",level:4},{value:"Sample payload",id:"sample-payload-9",level:4},{value:"Sample request",id:"sample-request-23",level:4},{value:"Sample response",id:"sample-response-17",level:4},{value:"Verify SSH OTP",id:"verify-ssh-otp",level:2},{value:"Parameters",id:"parameters-17",level:4},{value:"Sample payload",id:"sample-payload-10",level:4},{value:"Sample request",id:"sample-request-24",level:4},{value:"Sample response",id:"sample-response-18",level:4}];function h(e){let s={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(s.header,{children:(0,l.jsx)(s.h1,{id:"ssh-secrets-engine-api",children:"SSH secrets engine (API)"})}),"\n",(0,l.jsxs)(s.p,{children:["This is the API documentation for the OpenBao SSH secrets engine. For general\ninformation about the usage and operation of the SSH secrets engine, please see\nthe ",(0,l.jsx)(s.a,{href:"/docs/next/secrets/ssh/",children:"SSH documentation"}),"."]}),"\n",(0,l.jsxs)(s.p,{children:["This documentation assumes the SSH secrets engine is enabled at the ",(0,l.jsx)(s.code,{children:"/ssh"})," path\nin OpenBao. Since it is possible to enable secrets engines at any location, please\nupdate your API calls accordingly."]}),"\n",(0,l.jsx)(s.h2,{id:"table-of-contents",children:"Table of contents"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#notice-about-new-multi-issuer-functionality",children:"Notice About New Multi-Issuer Functionality"})}),"\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.a,{href:"#managing-authority-information",children:"Managing authority information"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#list-roles",children:"List roles"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#list-roles-by-ip",children:"List roles by IP"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#createupdate-role",children:"Create/Update role"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#read-role",children:"Read role"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#delete-role",children:"Delete role"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#list-zero-address-roles",children:"List Zero-Address roles"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#configure-zero-address-roles",children:"Configure Zero-Address roles"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#delete-zero-address-roles",children:"Delete Zero-Address roles"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#generate-ssh-credentials",children:"Generate SSH credentials"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#read-issuers-configuration",children:"Read issuers configuration"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#set-issuers-configuration",children:"Set issuers configuration"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#tidy-host-keys",children:"Tidy host keys"})}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.a,{href:"#managing-issuers",children:"Managing issuers"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#list-issuers",children:"List issuers"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#submit-ca-information",children:"Submit CA information"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#submit-issuer-with-optional-name",children:"Submit issuer with optional name"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#read-issuer",children:"Read issuer"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#read-issuer-public-key-unauthenticated",children:"Read issuer public key (Unauthenticated)"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#read-public-key-authenticated",children:"Read public key (Authenticated)"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#read-public-key-unauthenticated",children:"Read public key (Unauthenticated)"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#update-issuer",children:"Update issuer"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#delete-ca-information",children:"Delete CA information"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#delete-issuer",children:"Delete issuer"})}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.a,{href:"#issuer-operations",children:"Issuer operations"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#sign-ssh-key",children:"Sign SSH key"})}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#generate-certificate-and-key",children:"Generate certificate and key"})}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.li,{children:(0,l.jsx)(s.a,{href:"#verify-ssh-otp",children:"Verify SSH OTP"})}),"\n"]}),"\n",(0,l.jsx)(s.h2,{id:"notice-about-new-multi-issuer-functionality",children:"Notice About New Multi-Issuer Functionality"}
1),"\n",(0,l.jsx)(s.p,{children:'OpenBao allows a single SSH secrets engine mount to have multiple Certificate\nAuthority (CA) certificates, referred to as "issuers". This feature is designed\nspecifically to facilitate CA rotation. A default issuer must be explicitly created\nand configured for the mount. Once configured, this default issuer will be used for\nall operations where no specific issuer is referenced during role creation. The\ndefault issuer can be changed at any time by either submitting/generating a new\nissuer or updating it through the configuration endpoint.'}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.strong,{children:"Note"}),": Some functionality will not work if a default issuer is not\nconfigured. OpenBao automatically imports the pre-configured issuer\nand sets it as the default on migration from an older OpenBao version."]})}),"\n",(0,l.jsx)(s.h2,{id:"managing-authority-information",children:"Managing Authority Information"}),"\n",(0,l.jsx)(s.h3,{id:"list-roles",children:"List roles"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint returns a list of available roles. Only the role names are\nreturned, not any values."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"LIST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/roles"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"after"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," - Optional entry to begin listing after for\npagination; not required to exist."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"limit"})," ",(0,l.jsx)(s.code,{children:"(int: 0)"})," - Optional number of entries to return; defaults\nto all entries."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request LIST \\\n http://127.0.0.1:8200/v1/ssh/roles\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "auth": null,\n "data": {\n "keys": ["dev", "prod"],\n "ke
1y_info": {\n "dev": {\n "key_type": "ca",\n "issuer_ref": "default"\n }\n }\n },\n "lease_duration": 2764800,\n "lease_id": "",\n "renewable": false\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"list-roles-by-ip",children:"List roles by IP"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint lists all of the roles with which the given IP is associated."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/lookup"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-1",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"ip"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the IP of the remote host."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "ip": "1.2.3.4"\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-1",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/lookup\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-1",children:"Sample response"}),"\n",(0,l.jsx)(s.p,{children:"An array of roles as a secret structure."}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "roles": [\n "fe6f61b7-7e4a-46a6-b2c8-0d530b8513df",\n "6d6411fd-f622-ea0a-7e2c-989a745cbbb2"\n ]\n },\n "warnings": null,\n "auth": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"createupdate-role",children:"Create/Update role"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint creates or updates a named role."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/roles/:name"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-2",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"name"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the name of the role to create. This\nis part of the request URL."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"default_user"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the default username for which a\ncredential will be generated. When the endpoint ",(0,l.jsx)(s.code,{children:"creds/"})," is used without a\nusername, this value will be used as default username. Its recommended to\ncreate individual roles for each username to ensure absolute isolation between\nusernames. This is required for OTP type roles."]}),"\n",(0,l.jsxs)(s.p,{children:["When ",(0,l.jsx)(s.code,{children:"default_user_template"})," is set to ",(0,l.jsx)(s.code,{children:"true"}),", this field can contain an identity\ntemplate with any prefix or suffix, like ",(0,l.jsx)(s.code,{children:"ssh-{{identity.entity.id}}-user"}),"."]}),"\n",(0,l.jsxs)(s.p,{children:["For the CA type, if you wish this to be a valid principal, it must also be\nin ",(0,l.jsx)(s.code,{children:"allowed_users"}),"."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"default_user_template"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," - If set, ",(0,l.jsx)(s.code,{children:"default_users"})," can be specified\nusing identity template values. A non-templated user is also permitted."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"cidr_list"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies a comma separated list of CIDR blocks\nfor which the role is applicable for. It is possible that a same set of CIDR\nblocks are part of multiple roles. This is a required parameter, unless the\nrole is registered under the ",(0,l.jsx)(s.code,{children:"/config/zeroaddress"})," endpoint. Note:\n[Not applicable for CA type]"]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"exclude_cidr_list"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies a comma-separated list of CIDR\nblocks. IP addresses belonging to these blocks are not accepted by the role.\nThis is particularly useful when big CIDR blocks are being used by the role\nand certain parts need to be kept out. Note:\n[Not applicable for CA type]"]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"port"})," ",(0,l.jsx)(s.code,{children:"(int: 22)"})," \u2013 Specifies the port number for SSH connection. Port number\ndoes not play any role in OTP generation. For the ",(0,l.jsx)(s.code,{children:"otp"})," secrets engine type, this is\njust a way to inform the client about the port number to use. The port number\nwill be returned to the client by OpenBao along with the OTP."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_type"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the type of credentials\ngenerated by this role. This can be either ",(0,l.jsx)(s.code,{children:"otp"})," or ",(0,l.jsx)(s.code,{children:"ca"}),"."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allowed_users"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 If this option is not specified, or if it is\n",(0,l.jsx)(s.code,{children:"*"}),", the client can request a credential for any valid user at the remote\nhost, including the admin user. To only allow an explicit list of users, set\nthis parameter using a comma-separated username list to enforce it. When this\nparameter is set, the credentials are created only for ",(0,l.jsx)(s.code,{children:"default_user"})," and\nusernames listed. Setting this option will enable all the users with access\nthis role to fetch credentials for all other usernames in this list.\nWhen ",(0,l.jsx)(s.code,{children:"allowed_users_template"})," is set to ",(0,l.jsx)(s.code,{children:"true"}),", this field can contain an identity\ntemplate with any prefix or suffix, like ",(0,l.jsx)(s.code,{children:"ssh-{{identity.entity.id}}-user"}),".\nUse with caution. N.B.: if the type is ",(0,l.jsx)(s.code,{children:"ca"}),", an empty list does not allow any user;\ninstead you must use ",(0,l.jsx)(s.code,{children:"*"})," to enable this behavior."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allowed_users_template"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," - If set, ",(0,l.jsx)(s.code,{children:"allowed_users"})," can be specified\nusing identity template policies. Non-templated users are also permitted."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allowed_domains"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 A comma-separated list of domains for which\na client can request a host certificate. If this option is explicitly set to\n",(0,l.jsx)(s.code,{children:'"*"'}),", then credentials can be created for any domain. See also\n",(0,l.jsx)(s.code,{children:"allow_bare_domains"})," and ",(0,l.jsx)(s.code,{children:"allow_subdomains"}),"."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allowed_domains_template"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," - If set, ",(0,l.jsx)(s.code,{children:"allowed_domains"})," can be\nspecified using identity template policies. Non-templated domains are also\npermitted."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"ttl"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the Time To Live value provided as a\n",(0,l.jsx)(s.a,{href:"/docs/next/concepts/duration-format",children:"duration string"}),". If not set, uses the\nsystem default value or the value of ",(0,l.jsx)(s.code,{children:"max_ttl"}),", whichever is shorter."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"max_ttl"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the maximum Time To Live provided as a\n",(0,l.jsx)(s.a,{href:"/docs/next/concepts/duration-format",children:"duration string"}),". If not set, defaults to\nthe system maximum lease TTL."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allowed_critical_options"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies a comma-separated list\nof critical options that certificates can have when signed. To allow any\ncritical options, set this to an empty string. Will default to allowing any\ncritical options."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allowed_extensions"})," ",(0,l.jsx)(s.code,{children:'(string: "")'}
1)," \u2013 Specifies a comma-separated list of\nextensions that certificates can have when signed. To allow a user to specify\nany extension, set this to ",(0,l.jsx)(s.code,{children:'"*"'}),". If not set, users will not be allowed to\nspecify extensions and will get the extensions specified within ",(0,l.jsx)(s.code,{children:"default_extensions"}),".\nFor the list of extensions, take a look at the ",(0,l.jsx)(s.a,{href:"https://man.openbsd.org/sshd#AUTHORIZED_KEYS_FILE_FORMAT",children:"sshd\nmanual's"}),"\n",(0,l.jsx)(s.code,{children:"AUTHORIZED_KEYS FILE FORMAT"})," section. You should add a ",(0,l.jsx)(s.code,{children:"permit-"})," before the\nname of extension to allow it."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"default_critical_options"})," ",(0,l.jsx)(s.code,{children:'(map<string|string>: "")'})," \u2013 Specifies a map of\ncritical options certificates should have if none are provided when signing.\nThis field takes in key value pairs in JSON format. Note that these are not\nrestricted by ",(0,l.jsx)(s.code,{children:"allowed_critical_options"}),". Defaults to none."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"default_extensions"})," ",(0,l.jsx)(s.code,{children:'(map<string|string>: "")'})," \u2013 Specifies a map of\nextensions certificates should have if none are provided when signing. This\nfield takes in key value pairs in JSON format. Note that these are not\nrestricted by ",(0,l.jsx)(s.code,{children:"allowed_extensions"}),". Defaults to none."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"default_extensions_template"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," \u2013 If set, ",(0,l.jsx)(s.code,{children:"default_extensions"}),"\ncan be specified using identity template policies. Non-templated extensions\nare also permitted."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allow_user_certificates"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," \u2013 Specifies if certificates are\nallowed to be signed for use as a 'user'."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allow_host_certificates"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," \u2013 Specifies if certificates are\nallowed to be signed for use as a 'host'."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allow_bare_domains"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," \u2013 Specifies if host certificates that are\nrequested are allowed to use the base domains listed in ",(0,l.jsx)(s.code,{children:"allowed_domains"}),', e.g.\n"example.com". This is a separate option as in some cases this can be\nconsidered a security threat.']}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allow_subdomains"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," \u2013 Specifies if host certificates that are\nrequested are allowed to be subdomains of those listed in ",(0,l.jsx)(s.code,{children:"allowed_domains"}),',\ne.g. if "example.com" is part of ',(0,l.jsx)(s.code,{children:"allowed_domains"}),', this allows\n"foo.example.com".']}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allow_user_key_ids"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"}),' \u2013 Specifies if users can override the key\nID for a signed certificate with the "key_id" field. When false, the key ID\nwill always be the token display name. The key ID is logged by the SSH server\nand can be useful for auditing.']}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_id_format"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 When supplied, this value specifies a custom\nformat for the key id of a signed certificate. The following variables are\navailable for use: '{{token_display_name}}' - The display name of the token used\nto make the request. '{{role_name}}' - The name of the role signing the request.\n'{{public_key_hash}}' - A SHA-256 digest of the public key that is being signed.\ne.g. \"custom-keyid-{{token_display_name}}\""]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allowed_user_key_lengths"})," ",(0,l.jsx)(s.code,{children:'(map<string|(int|[]int|string)>: "")'})," \u2013 Specifies a\nmap of ssh key types and their expected sizes which are allowed to be signed by\nthe CA type. To specify multiple sizes, either use a comma-separated list or an\narray of allowed key widths. We support both OpenSSH-style key identifiers and\nshort names (",(0,l.jsx)(s.code,{children:"rsa"}),", ",(0,l.jsx)(s.code,{children:"ecdsa"}),", ",(0,l.jsx)(s.code,{children:"dsa"}),", or ",(0,l.jsx)(s.code,{children:"ed25519"}),") as keys. For example, a valid\npolicy to allow common RSA and ECDSA key lengths might be:"]}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{children:'{\n "rsa": [2048, 3072, 4096],\n "ec": 256,\n "e
1cdsa-sha2-nistp521": 0\n}\n'})}),"\n",(0,l.jsxs)(s.p,{children:["Note that when an algorithm identifier uniquely specifies a key length (such as\nwith ",(0,l.jsx)(s.code,{children:"ecdsa-sha2-nistp256"})," or ",(0,l.jsx)(s.code,{children:"ed25519"}),"), the value of the length is ignored (and\ncan be zero)."]}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.strong,{children:"Note"}),": In FIPS 140-2 mode, the following algorithms are not certified and\nthus should not be used: ",(0,l.jsx)(s.code,{children:"ed25519"}),"."]})}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"algorithm_signer"})," ",(0,l.jsx)(s.code,{children:'(string: "default")'})," - Algorithm to sign keys with. Valid\nvalues are ",(0,l.jsx)(s.code,{children:"ssh-rsa"}),", ",(0,l.jsx)(s.code,{children:"rsa-sha2-256"}),", ",(0,l.jsx)(s.code,{children:"rsa-sha2-512"}),", or ",(0,l.jsx)(s.code,{children:"default"}),". This\nvalue may also be left blank to use the signer's default algorithm, and must\nbe left blank or have value ",(0,l.jsx)(s.code,{children:"default"})," for CA key types other than RSA."]}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.strong,{children:"Note"}),": The value of ",(0,l.jsx)(s.code,{children:"default"})," may change over time as vulnerabilities in\nalgorithms are discovered. The present value for RSA keys is equivalent to\n",(0,l.jsx)(s.code,{children:"rsa-sha2-256"}),"."]})}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.strong,{children:"Warning"}),": The ",(0,l.jsx)(s.code,{children:"algorithm_signer"})," value ",(0,l.jsx)(s.code,{children:"ssh-rsa"})," uses the SHA-1 hash\nalgorithm. This algorithm is now considered insecure and is not supported by\ncurrent OpenSSH versions. As a result, OpenBao has made the new default\n",(0,l.jsx)(s.code,{children:"rsa-sha2-256"})," for RSA CA keys. It is strongly encouraged for all users to\nmigrate to ",(0,l.jsx)(s.code,{children:"rsa-sha2-256"})," or ",(0,l.jsx)(s.code,{children:"default"})," if the role was created with an\nexplicit ",(0,l.jsx)(s.code,{children:"algorithm_signer=rsa-sha"})," parameter or has been migrated to such."]})}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"not_before_duration"})," ",(0,l.jsx)(s.code,{children:'(duration: "30s")'})," \u2013 Specifies the duration by which to\nbackdate the ",(0,l.jsx)(s.code,{children:"ValidAfter"})," property. Uses ",(0,l.jsx)(s.a,{href:"/docs/next/concepts/duration-format",children:"duration format strings"}),"."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allow_empty_principals"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," \u2013 If true, host and user\ncertificates can be issued without any valid principals. For host\ncertificates, this means that any domain a host claims to be will be trusted\nby the connecting client. For user certificates, when a CA certificate is\nplaced in a user's AuthorizedKeys file, any principal on that certificate\nwill be allowed to connect. When ",(0,l.jsx)(s.code,{children:"allowed_users"})," or ",(0,l.jsx)(s.code,{children:"allowed_domains"})," is set\nto ",(0,l.jsx)(s.code,{children:"*"})," (corresponding to the role/certificate type),\n",(0,l.jsx)(s.code,{children:"allow_empty_principals=false"})," still permits issuance."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"issuer_ref"})," ",(0,l.jsx)(s.code,{children:'(string: "default")'})," \u2013 Specifies the issuer reference to\nuse for signing requests. If not set, the default issuer will be used.\nThis field is only applicable for CA type roles."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"allow_commas_in_identity_templates"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," - If set and templating\nis enabled, the values substituted in for ",(0,l.jsx)(s.code,{children:"allowed_users"})," and\n",(0,l.jsx)(s.code,{children:"allowed_domains"})," template expressions might contain a comma (','). As these\nvalues are comma separated lists, this can enable injection attacks. Only use\nthis, if the data used by the templates is trusted. Defaults to false."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-1",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "key_type": "otp"\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-2",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/roles/my-role\n'})}),"\n",(0,l.jsx)(s.h3,{id:"read-role",children:"Read role"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint queries a named role."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"GET"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/roles/:name"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-3",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"name"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the name of the role to read. This\nis part of the request URL."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-3",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n http://127.0.0.1:8200/v1/ssh/roles/my-role\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-2",children:"Sample response"}),"\n",(0,l.jsx)(s.p,{children:"For an OTP role:"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "cidr_list": "x.x.x.x/y",\n "default_user": "username",\n "key_type": "otp",\n "port": 22\n}\n'})}),"\n",(0,l.jsx)(s.p,{children:"For a CA role:"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "allow_bare_domains": false,\n "allow_host_certificates": true,\n "allow_subdomains": false,\n "allow_user_key_ids": false,\n "allow_user_certificates": true,\n "allow_commas_in_identity_templates": false,\n "allowed_critical_options": "",\n "allowed_extensions": "",\n "default_critical_options": {},\n "default_extensions": {},\n "issuer_ref": "default",\n "max_ttl": "768h",\n "ttl": "4h"\
1n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"delete-role",children:"Delete role"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint deletes a named role."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"DELETE"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/roles/:name"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-4",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"name"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the name of the role to delete. This\nis part of the request URL."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-4",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request DELETE \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/roles/my-role\n'})}),"\n",(0,l.jsx)(s.h3,{id:"list-zero-address-roles",children:"List Zero-Address roles"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint returns the list of configured zero-address roles."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"GET"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/config/zeroaddress"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-5",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n http://127.0.0.1:8200/v1/ssh/config/zeroaddress\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-3",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "roles": ["otp_key_role"]\n },\n "warnings": null,\n "auth": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"configure-zero-address-roles",children:"Configure Zero-Address roles"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint configures zero-address roles."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/config/zeroaddress"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-5",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"roles"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies a string containing comma separated\nlist of role names which allows credentials to be requested for any IP\naddress. CIDR blocks previously registered under these roles will be ignored."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-2",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "roles": ["otp_key_role"]\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-6",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/config/zeroaddress\n'})}),"\n",(0,l.jsx)(s.h3,{id:"delete-zero-address-roles",children:"Delete Zero-Address roles"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint deletes the zero-address roles configuration."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"DELETE"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/config/zeroaddress"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-7",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request DELETE \\\n http://127.0.0.1:8200/v1/ssh/config/zeroaddress\n'})}),"\n",(0,l.jsx)(s.h3,{id:"generate-ssh-credentials",children:"Generate SSH credentials"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint creates credentials for a specific username and IP with the\nparameters defined in the given role."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/creds/:name"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-6",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"name"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the name of the role to create\ncredentials against. This is part of the request URL."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"username"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the username on the remote host."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"ip"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the IP of the remote host."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-3",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "ip": "1.2.3.4"\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-8",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/creds/my-role\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-4",children:"Sample response"}),"\n",(0,l.jsx)(s.p,{children:"For an OTP role:"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "sshs/creds/c3c2e60c-5a48-415a-9d5a-a41e0e6cdec5/3ee6ad28-383f-d482-2427-70498eba4d96",\n "renewable": false,\n "lease_duration": 2764800,\n "data": {\n "ip": "127.0.0.1",\n "ke
1y": "6d6411fd-f622-ea0a-7e2c-989a745cbbb2",\n "key_type": "otp",\n "port": 22,\n "username": "rajanadar"\n },\n "warnings": null,\n "auth": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"read-issuers-configuration",children:"Read issuers configuration"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint allows getting the default issuer's unique identifier."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"GET"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/config/issuers"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-9",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n http://127.0.0.1:8200/v1/ssh/config/issuers\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-5",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "default": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n },\n "warnings": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"set-issuers-configuration",children:"Set issuers configuration"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint updates the ",(0,l.jsx)(s.code,{children:"default"})," reference to the specified issuer.\nOnly one issuer can be the default and, if there's one set, it will be overridden."]}),"\n",(0,l.jsxs)(s.p,{children:["Other endpoints, ",(0,l.jsx)(s.a,{href:"#submit-ca-information",children:"Submit CA Information"})," and ",(0,l.jsx)(s.a,{href:"#submit-issuer-with-optional-name",children:"Submit Issuer with Optional Name"}),",\ncan also be used to update the ",(0,l.jsx)(s.code,{children:"default"})," issuer reference but only if the issuer is submitted/generated."]}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/config/issuers"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-7",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"default"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the issuer reference to set as the default."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-4",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "default": "issuer-1"\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-10",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/config/issuers\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-6",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "default": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n },\n "warnings": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"tidy-host-keys",children:"Tidy host keys"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint removes all existing host keys from OpenBao, if any are present.\nThese keys were used with the Dynamic Keys functionality, which were removed\nfrom this engine."}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsx)(s.p,{children:"Note: This does not clean up any pending dynamic key leases and will not\nremove these keys from systems with authorized hosts entries created by\nOpenBao. That must be done manually by an operator, potentially before the\nremoval of these host keys if they are necessary to access these\nsystems."})}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"DELETE"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/tidy/dynamic-keys"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-11",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request DELETE \\\n http://127.0.0.1:8200/v1/ssh/issue/my-role\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-7",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "request_id": "",\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "message": "Removed 15 of 15 host keys."\n },\n "wrap_info": null,\n "warnings": null,\n "auth": null\n}\n'})}),"\n",(0,l.jsx)(s.h2,{id:"managing-issuers",children:"Managing issuers"}),"\n",(0,l.jsx)(s.h3,{id:"list-issuers",children:"List issuers"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint returns a list of the issuers currently provisioned in this mount.\nThe response includes both the issuer's identifier, optional name chosen by the operator,\nwhether the issuer is the default and its public key. Either identifier or name\ncan be used to refer to the issuer later."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"LIST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/issuers"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-8",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"after"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," - Optional entry to begin listing after for\npagination; not required to exist."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"limit"})," ",(0,l.jsx)(s.code,{children:"(int: 0)"})," - Optional number of entries to return; defaults\nto all entries."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-12",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:"$ curl \\\n --request LIST \\\n http://127.0.0.1:8200/v1/ssh/issuers\n"})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-8",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "data": {\n "ke
1y_info": {\n "1ae8ce9d-2f70-0761-a465-8c9840a247a2": {\n "issuer_name": "issuer-1"\n "is_default": false,\n "public_key": "ssh-rsa AAAAHHNzaC1y...\\n"\n },\n "3dc79a5a-7a6c-70e2-1123-94b88557ba12": {\n "issuer_name": "issuer-2"\n "is_default": false,\n "public_key": "ssh-rsa AAAAHHNzaC1y...\\n"\n }\n },\n "keys": [\n "1ae8ce9d-2f70-0761-a465-8c9840a247a2",\n "3dc79a5a-7a6c-70e2-1123-94b88557ba12"\n ]\n }\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"submit-ca-information",children:"Submit CA information"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint allows submitting the CA information to create an issuer that is\nassigned the ",(0,l.jsx)(s.code,{children:"default"})," issuer reference. _If a key pair is already set as default,\nit will be overridden with the new CA information and any reference to it updated."]}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"}),(0,l.jsx)(s.th,{children:"Content-Type"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/config/ca"})}),(0,l.jsx)(s.td,{children:(0,l.jsx)(s.code,{children:"200 application/json"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-9",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"private_key"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the private key part the SSH CA key\npair; required if ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," is false."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"public_key"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the public key part of the SSH CA key\npair; required if ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," is false."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"generate_signing_key"})," ",(0,l.jsx)(s.code,{children:"(bool: true)"})," \u2013 Specifies if OpenBao should generate\nthe signing key pair internally. If ",(0,l.jsx)(s.code,{children:"true"}),", an RSA key pair is generated, and\nthe generated public key is returned so you can add it to your configuration.\nIf ",(0,l.jsx)(s.code,{children:"false"}),", then you must provide ",(0,l.jsx)(s.code,{children:"private_key"})," and ",(0,l.jsx)(s.code,{children:"public_key"}),", but these\ncan be of any valid signing key type."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_type"})," ",(0,l.jsx)(s.code,{children:"(string: ssh-rsa)"})," - Specifies the desired key type for the\ngenerated SSH CA key when ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," is set to ",(0,l.jsx)(s.code,{children:"true"}),". Valid\nvalues are OpenSSH key type identifiers (",(0,l.jsx)(s.code,{children:"ssh-rsa"}),", ",(0,l.jsx)(s.code,{children:"ecdsa-sha2-nistp256"}),",\n",(0,l.jsx)(s.code,{children:"ecdsa-sha2-nistp384"}),", ",(0,l.jsx)(s.code,{children:"ecdsa-sha2-nistp521"}),", or ",(0,l.jsx)(s.code,{children:"ssh-ed25519"}),") or an\nalgorithm (",(0,l.jsx)(s.code,{children:"rsa"}),", ",(0,l.jsx)(s.code,{children:"ec"}),", or ",(0,l.jsx)(s.code,{children:"ed25519"}),")."]}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.strong,{children:"Note"}),": In FIPS 140-2 mode, the following algorithms are not certified and\nthus should not be used: ",(0,l.jsx)(s.code,{children:"ed25519"}),"."]})}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_bits"})," ",(0,l.jsx)(s.code,{children:"(int: 0)"})," - Specifies the desired key bits for the generated SSH\nCA key when ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," is set to ",(0,l.jsx)(s.code,{children:"true"}),". This is only used for\nvariable length keys (such as ",(0,l.jsx)(s.code,{children:"ssh-rsa"}),", where the value of ",(0,l.jsx)(s.code,{children:"key_bits"}),"\nspecifies the size of the RSA key pair to generate; with the default ",(0,l.jsx)(s.code,{children:"0"}),"\nvalue resulting in a 4096-bit key) or when the ",(0,l.jsx)(s.code,{children:"ec"})," algorithm is specified\nin ",(0,l.jsx)(s.code,{children:"key_type"})," (where the value of ",(0,l.jsx)(s.code,{children:"key_bits"})," identifies which NIST P-curve\nto use; ",(0,l.jsx)(s.code,{children:"256"}),", ",(0,l.jsx)(s.code,{children:"384"}),", or ",(0,l.jsx)(s.code,{children:"521"}),", with the default ",(0,l.jsx)(s.code,{children:"0"})," value resulting in a\nNIST P-256 key)."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-5",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "generate_signing_key": true\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-13",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/config/ca\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-9",children:"Sample response"}),"\n",(0,l.jsxs)(s.p,{children:["Whether the key material is generated, with ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," as ",(0,l.jsx)(s.code,{children:"true"}),", or submitted,\na successful response will have the status ",(0,l.jsx)(s.code,{children:"200"})," and a body format such as the following:"]}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "issuer_id": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n "issuer_name": "issuer-1",\n "public_key": "ssh-rsa AAAAHHNzaC1y...\\n"\n },\n "warnings": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"submit-issuer-with-optional-name",children:"Submit issuer with optional name"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint allows submitting the CA information to create a new issuer with the an\noptional explicit name. If a name is provided, it can be used to refer to the issuer later.\nIf not, it can be set later via the ",(0,l.jsx)(s.a,{href:"#update-issuer",children:"Update Issuer"})," endpoint."]}),"\n",(0,l.jsxs)(s.p,{children:["By setting the ",(0,l.jsx)(s.code,{children:"set_default"})," parameter to ",(0,l.jsx)(s.code,{children:"true"}),", the ",(0,l.jsx)(s.code,{children:"default"})," reference will\nbe updated to the new issuer overriding any previous default issuer configuration.\nOn the submission of the first issuer, the ",(0,l.jsx)(s.code,{children:"default"})," reference will be set to it independently\nof this parameter."]}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"}),(0,l.jsx)(s.th,{children:"Content-Type"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/issuers/import/:issuer_name"})}),(0,l.jsx)(s.td,{children:(0,l.jsx)(s.code,{children:"200 application/json"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-10",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"issuer_name"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," - Specifies an explicit name to the issuer. This\nname can later by used to refer to the issuer. The name must be unique across\nall issuers and not be the reserved value ",(0,l.jsx)(s.code,{children:"default"}),"This is part of the request URL."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"private_key"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the private key part the SSH CA key\npair; required if ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," is set to ",(0,l.jsx)(s.code,{children:"false"}),"."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"public_key"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the public key part of the SSH CA key\npair; required if ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," is set to ",(0,l.jsx)(s.code,{children:"false"}),"."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"generate_signing_key"})," ",(0,l.jsx)(s.code,{children:"(bool: true)"})," \u2013 Specifies if OpenBao should generate\nthe signing key pair internally. If ",(0,l.jsx)(s.code,{children:"true"}),", an RSA key pair is generated, and\nthe generated public key is returned so you can add it to your configuration.\nIf ",(0,l.jsx)(s.code,{children:"false"}),", then you must provide ",(0,l.jsx)(s.code,{children:"private_key"})," and ",(0,l.jsx)(s.code,{children:"public_key"}),", but these\ncan be of any valid signing key type."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_type"})," ",(0,l.jsx)(s.code,{children:"(string: ssh-rsa)"})," - Specifies the desired key type for the\ngenerated SSH CA key when ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," is set to ",(0,l.jsx)(s.code,{children:"true"}),". Valid\nvalues are OpenSSH key type identifiers (",(0,l.jsx)(s.code,{children:"ssh-rsa"}),", ",(0,l.jsx)(s.code,{children:"ecdsa-sha2-nistp256"}),",\n",(0,l.jsx)(s.code,{children:"ecdsa-sha2-nistp384"}),", ",(0,l.jsx)(s.code,{children:"ecdsa-sha2-nistp521"}),", or ",(0,l.jsx)(s.code,{children:"ssh-ed25519"}),") or an\nalgorithm (",(0,l.jsx)(s.code,{children:"rsa"}),", ",(0,l.jsx)(s.code,{children:"ec"}),", or ",(0,l.jsx)(s.code,{children:"ed25519"}),")."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"set_default"})," ",(0,l.jsx)(s.code,{children:"(bool: false)"})," - Specifies whether the submitted or generated CA\ninformation should be as the default issuer. If ",(0,l.jsx)(s.code,{children:"true"}),", it will be set as the\ndefault issuer for performing operations by any role referencing it. Only one\nissuer can be the default and, if there's one set, it will be overridden."]}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.strong,{children:"Note"}),": In FIPS 140-2 mode, the following algorithms are not certified and\nthus should not be used: ",(0,l.jsx)(s.code,{children:"ed25519"}),"."]})}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_bits"})," ",(0,l.jsx)(s.code,{children:"(int: 0)"})," - Specifies the desired key bits for the generated SSH\nCA key when ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," is set to ",(0,l.jsx)(s.code,{children:"true"}),". This is only used for\nvariable length keys (such as ",(0,l.jsx)(s.code,{children:"ssh-rsa"}),", where the value of ",(0,l.jsx)(s.code,{children:"key_bits"}),"\nspecifies the size of the RSA key pair to generate; with the default ",(0,l.jsx)(s.code,{children:"0"}),"\nvalue resulting in a 4096-bit key) or when the ",(0,l.jsx)(s.code,{children:"ec"})," algorithm is specified\nin ",(0,l.jsx)(s.code,{children:"key_type"})," (where the value of ",(0,l.jsx)(s.code,{children:"key_bits"})," identifies which NIST P-curve\nto use; ",(0,l.jsx)(s.code,{children:"256"}),", ",(0,l.jsx)(s.code,{children:"384"}),", or ",(0,l.jsx)(s.code,{children:"521"}),", with the default ",(0,l.jsx)(s.code,{children:"0"})," value resulting in a\nNIST P-256 key)."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-6",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "generate_signing_key": true\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-14",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/issuers/import\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-10",children:"Sample response"}),"\n",(0,l.jsxs)(s.p,{children:["Whether the key material is generated, with ",(0,l.jsx)(s.code,{children:"generate_signing_key"})," as ",(0,l.jsx)(s.code,{children:"true"}),", or submitted,\na successful response will have the status ",(0,l.jsx)(s.code,{children:"200"})," and a body format such as the following:"]}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "issuer_id": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n "issuer_name": "issuer-1",\n "public_key": "ssh-rsa AAAAHHNzaC1y...\\n"\n },\n "warnings": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"read-issuer",children:"Read issuer"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint allows an operator to fetch a single issuer by its reference,\nincluding internal information not exposed on the\n",(0,l.jsxs)(s.a,{href:"#read-issuer-public-key-unauthenticated",children:["unauthenticated ",(0,l.jsx)(s.code,{children:"ssh/issuer/:issuer_ref/public_key"})]})," endpoint.\nThis information includes the issuer's identifier, optional name, and whether the issuer\nis currently set as the ",(0,l.jsx)(s.code,{children:"default"}),"."]}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"GET"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/issuer/:issuer_ref"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-11",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"issuer_ref"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," - Reference to an existing issuer,\neither by OpenBao-generated identifier, the literal string ",(0,l.jsx)(s.code,{children:"default"})," to\nrefer to the currently configured default issuer, or the name assigned\nto an issuer. This parameter is part of the request URL."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-15",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n http://127.0.0.1:8200/v1/ssh/issuer/default\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-11",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "issuer_id": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n "issuer_name": "issuer-1",\n "public_key": "ssh-rsa AAAAHHNzaC1y...\\n"\n },\n "warnings": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"read-issuer-public-key-unauthenticated",children:"Read issuer public key (Unauthenticated)"}),"\n",(0,l.jsx)(s.p,{children:"This endpoints returns a specific issuer's public key. This in an unauthenticated endpoint."}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:["Note: this is a raw response endpoint without JSON encoding; use\n",(0,l.jsx)(s.code,{children:"bao read -format=raw"})," or an external tool (e.g., ",(0,l.jsx)(s.code,{children:"curl"}),") to fetch this\nvalue."]})}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:
1"left"},children:"Path"}),(0,l.jsx)(s.th,{children:"Content-Type"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"GET"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/issuer/:issuer_ref/public_key"})}),(0,l.jsx)(s.td,{children:(0,l.jsx)(s.code,{children:"200 text/plain"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-12",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"issuer_ref"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," - Reference to an existing issuer,\neither by OpenBao-generated identifier, the literal string ",(0,l.jsx)(s.code,{children:"default"})," to\nrefer to the currently configured default issuer, or the name assigned\nto an issuer. This parameter is part of the request URL."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-16",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:"$ curl http://127.0.0.1:8200/v1/ssh/issuer/issuer-1/public_key\n"})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-12",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-text",children:"ssh-rsa AAAAHHNzaC1y...\n"})}),"\n",(0,l.jsx)(s.h3,{id:"read-public-key-authenticated",children:"Read public key (Authenticated)"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint reads the configured/generated public key for the ",(0,l.jsx)(s.code,{children:"default"})," CA issuer."]}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"GET"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/config/ca"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-17",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n http://127.0.0.1:8200/v1/ssh/config/ca\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-13",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "issuer_id": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n "issuer_name": "issuer-name",\n "public_key": "ssh-rsa AAAAHHNzaC1y...\\n"\n },\n "warnings": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"read-public-key-unauthenticated",children:"Read public key (Unauthenticated)"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint returns the configured/generated public key for the ",(0,l.jsx)(s.code,{children:"default"})," CA issuer.\nThis is an unauthenticated endpoint."]}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:["Note: this is a raw response endpoint without JSON encoding; use\n",(0,l.jsx)(s.code,{children:"bao read -format=raw"})," or an external tool (e.g., ",(0,l.jsx)(s.code,{children:"curl"}),") to fetch this\nvalue."]})}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"}),(0,l.jsx)(s.th,{children:"Content-Type"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"GET"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/public_key"})}),(0,l.jsx)(s.td,{children:(0,l.jsx)(s.code,{children:"200 text/plain"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-18",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:"$ curl http://127.0.0.1:8200/v1/ssh/public_key\n"})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-14",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-text",children:"ssh-rsa AAAAHHNzaC1y...\n"})}),"\n",(0,l.jsx)(s.h3,{id:"update-issuer",children:"Update issuer"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint updates the specified issuer's name."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsxs)(s.td,{style:{textAlign:"left"},children:[(0,l.jsx)(s.code,{children:"POST"}),"/",(0,l.jsx)(s.code,{children:"PATCH"})]}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/issuer/:issuer_ref"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-13",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"issuer_ref"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," - Reference to an existing issuer,\neither by OpenBao-generated identifier, the literal string ",(0,l.jsx)(s.code,{children:"default"})," to\nrefer to the currently configured default issuer, or the name assigned\nto an issuer. This parameter is part of the request URL."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"issuer_name"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," - Provides a name to the specified issuer.\nThe name must be unique across all issuers and not be the reserved value ",(0,l.jsx)(s.code,{children:"default"}),"."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-7",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "issuer_name": "issuer-2"\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-19",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/issuer/default\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-15",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "issuer_id": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n "issuer_name": "issuer-1",\n "public_key": "ssh-rsa AAAAHHNzaC1y...\\n"\n },\n "warnings": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"delete-ca-information",children:"Delete CA information"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint deletes all pre-submitted or generated issuers, including the one set as ",(0,l.jsx)(s.code,{children:"default"}),"."]}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"DELETE"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/config/ca"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-20",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request DELETE \\\n http://127.0.0.1:8200/v1/ssh/config/ca\n'})}),"\n",(0,l.jsx)(s.h3,{id:"delete-issuer",children:"Delete issuer"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint deletes the specified issuer, even if is set as the ",(0,l.jsx)(s.code,{children:"default"}),".\nOperations without an explicit issuer will not work until a new default is configured."]}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"DELETE"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/issuer/:issuer_ref"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-14",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"issuer_ref"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," - Reference to an existing issuer,\neither by OpenBao-generated identifier, the literal string ",(0,l.jsx)(s.code,{children:"default"})," to\nrefer to the currently configured default issuer, or the name assigned\nto an issuer. This parameter is part of the request URL."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-21",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request DELETE \\\n http://127.0.0.1:8200/v1/ssh/issuer/issuer-1\n'})}),"\n",(0,l.jsx)(s.h2,{id:"issuer-operations",children:"Issuer operations"}),"\n",(0,l.jsx)(s.h3,{id:"sign-ssh-key",children:"Sign SSH key"}),"\n",(0,l.jsxs)(s.p,{children:["This endpoint signs an SSH public key based on the supplied parameters and\nsubject to the restrictions of the role named in the path. Both ",(0,l.jsx)(s.code,{children:"create"})," and\n",(0,l.jsx)(s.code,{children:"update"})," policy capabilities are needed to sign and update SSH keys. If only\n",(0,l.jsx)(s.code,{children:"create"})," capability is granted, and a SSH key does not exist, it will be created\nusing the default parameters already configured. If only ",(0,l.jsx)(s.code,{children:"update"})," capability is\navailable and a SSH key does not exist, an error will be returned and
1SSH keys\nmust exist already before may be updated."]}),"\n",(0,l.jsxs)(s.p,{children:["It is similar to the endpoint ",(0,l.jsx)(s.code,{children:"/ssh/issue/:name"}),". Instead of issuing new\nSSH credentials, this returns a certificate for the given SSH public key."]}),"\n",(0,l.jsx)(s.p,{children:"The issued certificate uses the defaults specified in the role named in\nthis endpoint. Where not restricted by the parameters of this role, the\nparameters of the issued certificate can be further customized in this API call."}),"\n",(0,l.jsx)(s.p,{children:"The key material used to sign the public key is the default issuer's key\nunless a different issuer is specified in the role. If no default issuer\nis configured or the reference provided, unique identifier or name, does\nnot exist, the request will fail."}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.strong,{children:"Note"}),": The issued certificate is returned but ",(0,l.jsx)(s.em,{children:"not"})," stored by OpenBao.\nIf you do not save it from the response, request it again by repeating\nthis request."]})}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/sign/:name"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-15",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"name"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the name of the role to sign. This\nis part of the request URL."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"public_key"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the SSH public key that should\nbe signed."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"ttl"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the Requested Time To Live. Cannot be greater\nthan the role's ",(0,l.jsx)(s.code,{children:"max_ttl"})," value. If not provided, the role's ",(0,l.jsx)(s.code,{children:"ttl"})," value will\nbe used. Note that the role values default to system values if not explicitly\nset."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"valid_principals"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies valid principals, either\nusernames or hostnames, that the certificate should be signed for."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"cert_type"})," ",(0,l.jsx)(s.code,{children:'(string: "user")'}),' \u2013 Specifies the type of certificate to be\ncreated; either "user" or "host".']}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_id"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the key id that the created certificate\nshould have. If not specified, the display name of the token will be used."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"critical_options"})," ",(0,l.jsx)(s.code,{children:'(map<string|string>: "")'})," \u2013 Specifies a map of the\ncritical options that the certificate should be signed for. Defaults to none."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"extensions"})," ",(0,l.jsx)(s.code,{children:'(map<string|string>: "")'})," \u2013 Specifies a map of the extensions\nthat the certificate should be signed for. Defaults to none."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-8",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "public_key": "ssh-rsa ..."\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-22",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/sign/my-key\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-16",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "ssh/sign/example/097bf207-96dd-0041-0e83-b23bd1923993",\n "renewable": false,\n "lease_duration": 21600,\n "data": {\n "issuer_id": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n "serial_number": "f65ed2fd21443d5c",\n "signed_key": "[email protected] AAAAHHNzaC1y...\\n"\n },\n "auth": null\n}\n'})}),"\n",(0,l.jsx)(s.h3,{id:"generate-certificate-and-key",children:"Generate certificate and key"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint issues a new set of SSH credentials (private key and certificate)."}),"\n",(0,l.jsxs)(s.p,{children:["It is similar to the endpoint ",(0,l.jsx)(s.code,{children:"/ssh/sign/:name"}),": Instead of signing an existing\nSSH public key, it generates and issues new SSH credentials (key and certificate)."]}),"\n",(0,l.jsx)(s.p,{children:"The issued certificate uses the defaults specified in the role named in\nthis endpoint. Where not restricted by the parameters of this role, the\nparameters of the issued certificate can be further customized in this API call."}),"\n",(0,l.jsx)(s.p,{children:"The key material used to sign the generated public key is the default\nissuer's key unless a different issuer is specified in the role. If no\ndefault issuer is configured or the reference provided, unique identifier\nor name, does not exist, the request will fail."}),"\n",(0,l.jsx)(s.admonition,{type:"warning",children:(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.strong,{children:"Note"}),": The issued credentials are returned but ",(0,l.jsx)(s.em,{children:"not"})," stored by OpenBao.\nIf you do not save them from the response, issue new credentials by using\nthis request again."]})}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/issue/:name"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-16",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"name"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the name of the role to create the\ncertificate against. This is part of the request URL."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_type"})," ",(0,l.jsx)(s.code,{children:'(string: "rsa")'})," \u2013 Specifies the desired key type; must be ",(0,l.jsx)(s.code,{children:"rsa"}),", ",(0,l.jsx)(s.code,{children:"ed25519"}),"\nor ",(0,l.jsx)(s.code,{children:"ec"}),"."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_bits"})," ",(0,l.jsx)(s.code,{children:"(int: 0)"})," \u2013 Specifies the number of bits to use for the\ngenerated keys. Allowed values are 0 (universal default); with\n",(0,l.jsx)(s.code,{children:"key_type=rsa"}),", allowed values are: 2048 (default), 3072, or\n4096; with ",(0,l.jsx)(s.code,{children:"key_type=ec"}),", allowed values are: 256 (default), 384,\nor 521; ignored with ",(0,l.jsx)(s.code,{children:"key_type=ed25519"}),"."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"ttl"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the Requested Time To Live. Cannot be greater\nthan the role's ",(0,l.jsx)(s.code,{children:"max_ttl"})," value. If not provided, the role's ",(0,l.jsx)(s.code,{children:"ttl"})," value will\nbe used. Note that the role values default to system values if not explicitly\nset."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"val
1id_principals"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies valid principals, either\nusernames or hostnames, that the certificate should be signed for."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"cert_type"})," ",(0,l.jsx)(s.code,{children:'(string: "user")'}),' \u2013 Specifies the type of certificate to be\ncreated; either "user" or "host".']}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"key_id"})," ",(0,l.jsx)(s.code,{children:'(string: "")'})," \u2013 Specifies the key id that the created certificate\nshould have. If not specified, the display name of the token will be used."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"critical_options"})," ",(0,l.jsx)(s.code,{children:'(map<string|string>: "")'})," \u2013 Specifies a map of the\ncritical options that the certificate should be signed for. Defaults to none."]}),"\n"]}),"\n",(0,l.jsxs)(s.li,{children:["\n",(0,l.jsxs)(s.p,{children:[(0,l.jsx)(s.code,{children:"extensions"})," ",(0,l.jsx)(s.code,{children:'(map<string|string>: "")'})," \u2013 Specifies a map of the extensions\nthat the certificate should be signed for. Defaults to none."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-9",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "key_type": "rsa",\n "key_bits": 2048\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-23",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/issue/my-role\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-17",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "request_id": "94fd1102-08a1-c207-0e3e-657e8f80c09e",\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "issuer_id": "a38751e4-6cd1-f1b4-10ac-61eb2fcd3caf",\n "serial_number": "1e965817eb12a511",\n "signed_key": "[email protected] AAAAHHN...\\n",\n "private_key": "-----BEGIN RSA PRIVATE KEY-----\\nMIIEpQIBAAKCAQEAwer03vkQrPV+wWpbisJJv2CKqHmMz+Ej0ctLbhpOmR2CY9S9\\n...\\nQN351pgTphi6nlCkGPzkDuwvtxSxiCWXQcaxrHAL7MiJpPzkIBq1\\n-----END RSA PRIVATE KEY-----\\n",\n "private_key_type": "rsa"\n },\n "wrap_info": null,\n "warnings": null,\n "auth": null\n}\n'})}),"\n",(0,l.jsx)(s.h2,{id:"verify-ssh-otp",children:"Verify SSH OTP"}),"\n",(0,l.jsx)(s.p,{children:"This endpoint verifies if the given OTP is valid. This is an unauthenticated endpoint."}),"\n",(0,l.jsxs)(s.table,{children:[(0,l.jsx)(s.thead,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Method"}),(0,l.jsx)(s.th,{style:{textAlign:"left"},children:"Path"})]})}),(0,l.jsx)(s.tbody,{children:(0,l.jsxs)(s.tr,{children:[(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"POST"})}),(0,l.jsx)(s.td,{style:{textAlign:"left"},children:(0,l.jsx)(s.code,{children:"/ssh/verify"})})]})})]}),"\n",(0,l.jsx)(s.h4,{id:"parameters-17",children:"Parameters"}),"\n",(0,l.jsxs)(s.ul,{children:["\n",(0,l.jsxs)(s.li,{children:[(0,l.jsx)(s.code,{children:"otp"})," ",(0,l.jsx)(s.code,{children:"(string: <required>)"})," \u2013 Specifies the One-Time-Key that needs to be\nvalidated."]}),"\n"]}),"\n",(0,l.jsx)(s.h4,{id:"sample-payload-10",children:"Sample payload"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "otp": "bad2b3-..."\n}\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-request-24",children:"Sample request"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-shell-session",children:'$ curl \\\n --header "X-Vault-Token: ..." \\\n --request POST \\\n --data @payload.json \\\n http://127.0.0.1:8200/v1/ssh/verify\n'})}),"\n",(0,l.jsx)(s.h4,{id:"sample-response-18",children:"Sample response"}),"\n",(0,l.jsx)(s.pre,{children:(0,l.jsx)(s.code,{className:"language-json",children:'{\n "lease_id": "",\n "renewable": false,\n "lease_duration": 0,\n "data": {\n "ip": "127.0.0.1",\n "username": "rajanadar"\n },\n "warnings": null,\n "auth": null\n}\n'})})]})}function o(e={}){let{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,l.jsx)(s,{...e,children:(0,l.jsx)(h,{...e})}):h(e)}},44812(e,s,n){n.d(s,{R:()=>t,x:()=>d});var i=n(92990);let l={},r=i.createContext(l);function t(e){let s=i.useContext(r);return i.useMemo(function(){return"function"==typeof e?e(s):{...s,...e}},[s,e])}function d(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(l):e.components||l:t(e.components),i.createElement(r.Provider,{value:s},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.