Skip to content
StratumStratum Docs

Set the project's SSH CA validity / rotation policy.

PUT
/v1/projects/{projectId}/ssh-ca/config
Code sample: Shell / cURL
curl --request PUT \
  --url https://stratum.example.com/v1/projects/example/ssh-ca/config \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "userCertDefaultValiditySeconds": 900, "userCertMaxValiditySeconds": 3600, "hostCertMaxValiditySeconds": 31536000, "rotationGraceWindowSeconds": 86400 }'

Sets the project’s SSH CA validity ceilings + rotation grace window, lazily creating the CA if needed. Omitted fields keep their current value. The sign-rate quota is NOT settable here — it is an operator-only field (PATCH…/ssh-ca/quota,). Backs the stratum_ssh_ca Terraform resource create/update. Gates on the ssh-ca:UpdateConfig Cedar action (project-editor+).

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
projectId
required
string
/^p-[a-z0-9-]+$/

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

body for PUT /v1/projects/{projectId}/ssh-ca/config. Every field is optional; an omitted field keeps its current value.

object
userCertDefaultValiditySeconds

Default user-cert validity (seconds); must be <= the max.

integer
>= 1

Example 

900
userCertMaxValiditySeconds

Maximum user-cert validity ceiling (seconds).

integer
>= 1

Example 

3600
hostCertMaxValiditySeconds

Maximum host-cert validity ceiling (seconds).

integer
>= 1

Example 

31536000
rotationGraceWindowSeconds

How long a rotated-out CA generation stays trusted (seconds).

integer

Example 

86400

Responses

Section titled “Responses”

200

Section titled “200”

The updated SSH CA configuration.

Media typeapplication/json

The project’s SSH CA as a single managed resource (the stratum_ssh_ca Terraform resource). Combines the computed CA public keys + generations with the configurable validity / rotation policy and the (operator-managed) effective sign-rate quota.

object
id
required

Stable resource id (equals projectId — one SSH CA per project).

string
projectId
required
string
userCaPublicKey
required

The active user CA public key (OpenSSH authorized-key form).

string
userCaGeneration
required
integer
hostCaPublicKey
required

The active host CA public key (OpenSSH authorized-key form).

string
hostCaGeneration
required
integer
userCertDefaultValiditySeconds
required
integer
userCertMaxValiditySeconds
required
integer
hostCertMaxValiditySeconds
required
integer
rotationGraceWindowSeconds
required
integer
signRatePerMinute
required
integer

Example 

{
  "userCaGeneration": 1,
  "hostCaGeneration": 1,
  "userCertDefaultValiditySeconds": 900,
  "userCertMaxValiditySeconds": 3600,
  "hostCertMaxValiditySeconds": 31536000,
  "rotationGraceWindowSeconds": 86400,
  "signRatePerMinute": 100
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

403

Section titled “403”

Authenticated but not authorized.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}