Skip to content
StratumStratum Docs

Sign a short-lived SSH user certificate.

POST
/v1/projects/{projectId}/ssh-ca/sign
Code sample: Shell / cURL
curl --request POST \
  --url https://stratum.example.com/v1/projects/example/ssh-ca/sign \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@host", "targetInstanceId": "i-A8c2D4e6F", "validForSeconds": 900, "principals": [ "example" ] }'

Signs the caller-supplied SSH public key into a short-lived user certificate. The cert’s KeyId is the caller’s IAM ARN, its principal defaults to the caller’s IAM username, and it carries a source-address critical option pinned to the caller’s source IP. Validity is clamped to the per-project ceiling; when clamped, the response carries an X-Stratum-Warning header. Signing happens inside OpenBao — the CA key never leaves it. Gates on the compute:SignSSHCert Cedar action on the target instance.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
projectId
required
string
/^p-[a-z0-9-]+$/

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

body for POST /v1/projects/{projectId}/ssh-ca/sign.

object
publicKey
required

The caller’s SSH public key in OpenSSH authorized-key form (e.g. “ssh-ed25519 AAAA…”). The signed certificate certifies this key.

string

Example 

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@host
targetInstanceId

The instance the certificate is intended for. Scopes the Cedar compute:SignSSHCert check to that instance’s ARN. Optional; when omitted the check is project-scoped.

string

Example 

i-A8c2D4e6F
validForSeconds

Requested validity in seconds. Defaults to the per-project default (900). Clamped to the per-project ceiling; when clamped the response carries an X-Stratum-Warning header.

integer

Example 

900
principals

Additional certificate principals. Defaults to the caller’s IAM username. The shared login principal (stratum-ssh) is appended either way, so this widens the certificate rather than narrowing it — ask for stratum to log in as the default user, which carries passwordless sudo. The account must already exist on the instance.

Array<string>

Responses

Section titled “Responses”

200

Section titled “200”

The signed certificate.

Media typeapplication/json

A signed SSH user certificate.

object
cert
required

The signed certificate in OpenSSH authorized-key form.

string
serial
required

The certificate serial (hex).

string
validFrom
string format: date-time
validUntil
required
string format: date-time
principals
required
Array<string>

Example 

{
  "cert": "ssh-ed25519-cert-v01@openssh.com AAAA...",
  "serial": "e00021a9c16e9fbc"
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

403

Section titled “403”

Authenticated but not authorized.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}