Skip to content
ssoossh

Overview

ssoosshd API 0.1

Section titled “ssoosshd API 0.1”

SSO for SSH. Two audiences share this surface:

  • The client (ssoossh, and pam_ssoossh) creates certificate requests and waits on the result over SSE. These endpoints are unauthenticated: a request’s ID is an unguessable UUID and is itself the capability, and authorization happens at the approval step.
  • The web UI reads and approves. Everything under a session cookie.

Every JSON body this API emits is the {data, error} envelope from .claude/rules/server-api.md — success and error, client-facing and web-UI-facing, including the data of each server-sent event. One decode path, no exceptions to remember.

This file is generated from Go annotations by make openapi. Edit the handlers, not the YAML.

ssoossh documentation

Information

  • License: MIT
  • OpenAPI version: 3.1.0

Operations

Section titled “Operations”
GET
/api/ca
POST
/api/certs/console
POST
/api/certs/pam
GET
/api/certs/requests/{id}/events
POST
/api/certs/service/enroll
POST
/api/certs/service/retrieve
POST
/api/certs/user
GET
/api/certs
GET
/api/certs/{id}
GET
/api/certs/requests/{id}
POST
/api/certs/requests/{id}/approve
POST
/api/certs/requests/{id}/deny
GET
/api/certs/requests/{id}/retrievals
POST
/api/certs/requests/resolve-code
GET
/api/certs/service/enrollments
GET
/api/certs/service/enrollments/{id}/holders
PATCH
/api/certs/service/enrollments/{id}/notification-email
GET
/api/decisions/denied
GET
/api/nss/key-settings
GET
/api/nss/keys
POST
/api/nss/keys
GET
/api/nss/keys/{id}
PATCH
/api/nss/keys/{id}
DELETE
/api/nss/keys/{id}/previous
POST
/api/nss/keys/{id}/revoke
POST
/api/nss/keys/{id}/rotate
GET
/api/nss/keys/{id}/rotation-report
GET
/api/nss/keys/{id}/usage
GET
/api/users/me
PUT
/api/users/me/display
GET
/api/users/me/notifications
PUT
/api/users/me/notifications
POST
/api/identity/echo/redeem
GET
/auth/callback
GET
/auth/login
POST
/auth/logout
GET
/api/nss/group/gid/{gid}
GET
/api/nss/group/name/{name}
GET
/api/nss/user/name/{name}
GET
/api/nss/user/uid/{uid}
GET
/api/admin/audit
GET
/api/admin/certificates/history
GET
/api/admin/config
POST
/api/admin/diagnostics/run
GET
/api/admin/enrollments
GET
/api/admin/enrollments/{id}
PATCH
/api/admin/enrollments/{id}/expire
POST
/api/admin/identity/echo/start
POST
/api/admin/ldap/probe
GET
/api/admin/ldap/status
POST
/api/admin/ldap/sync
GET
/api/admin/nss/collisions
GET
/api/admin/nss/groups
GET
/api/admin/nss/groups/{gid}
POST
/api/admin/nss/groups/{gid}/accept-id-change
GET
/api/admin/nss/groups/{gid}/audit
GET
/api/admin/nss/groups/{gid}/members
DELETE
/api/admin/nss/groups/{gid}/tombstone
GET
/api/admin/nss/keys
GET
/api/admin/nss/pending-id-changes
GET
/api/admin/nss/users
GET
/api/admin/nss/users/{uid}
POST
/api/admin/nss/users/{uid}/accept-id-change
GET
/api/admin/nss/users/{uid}/audit
DELETE
/api/admin/nss/users/{uid}/tombstone
GET
/api/admin/users
GET
/api/admin/users/{id}
GET
/api/admin/users/{id}/audit
PATCH
/api/admin/users/{id}/disable
PATCH
/api/admin/users/{id}/enable
GET
/api/branding
GET
/api/branding/logo
GET
/api/version
PATCH
/api/certs/service/enrollments/{id}/expire
GET
/healthz
GET
/ping

Authentication

Section titled “Authentication”

sessionCookie

Section titled “sessionCookie”

The fleet API key’s secret, shown once when the key is created or rotated. Sent with the id on every NSS lookup; the server removes it from the request before anything is logged.

Security scheme type: apiKey

Header parameter name: X-Ssoossh-Key-Secret