List every fleet API key (auditor and above, or fleet key admin)

GET

/api/admin/nss/keys

const url = 'https://example.com/api/admin/nss/keys?limit=25&q=10.0.4.0%2F24&status=all&expiring_within=7';
const options = {method: 'GET', headers: {'X-Ssoossh-Key-Secret': '<X-Ssoossh-Key-Secret>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://example.com/api/admin/nss/keys?limit=25&q=10.0.4.0%2F24&status=all&expiring_within=7' \
  --header 'X-Ssoossh-Key-Secret: <X-Ssoossh-Key-Secret>'

One page of every fleet key, whoever manages it and whether or not it has a group, by name then id. q matches a case-insensitive substring of the key’s name or group or the creator’s username or email, or the start of the key’s id (nss_5vqsreyx, or a prefix of it, in any case). A q that reads as an IP address (IPv4 or IPv6, an IPv4-mapped one read as IPv4) or a CIDR range searches the usage instead: the keys hosts used from that address or range within nss.usage_retention, each with up to 5 of the matching addresses (newest first) and how many matched; address_search then says how q was read. A q shaped like an address or a range that is not a valid one is a 400 naming the problem, never a text search. status, expiring_within (7, 30 or 90 days, active keys only), unused (no lookup in 30 days, never used included) and alerts (a miss rate or key source alert in 7 days) narrow it; an unknown value is dropped. Each key carries its creator, its distinct source addresses in 7 days and its last lookup. Never a secret or a secret’s hash. Read only: a key’s own page, /api/nss/keys/{id}, keeps every action. Uses cursor-based pagination (not offset).

Authorizations

sessionCookie

Parameters

Query Parameters

after

string

Key id to start after (cursor): the previous page’s next_cursor

limit

integer

Page size (default 25, max 100)

Example

string

Text matched against name, group, creator username and email, or the start of the key id; or an IP address or CIDR range

Example

10.0.4.0/24

status

string

Allowed values: all active expired revoked

Status filter; omitted or all returns every status

expiring_within

integer

Allowed values: 7 30 90

Only active keys expiring within this many days

unused

boolean

Only keys with no lookup in the last 30 days

alerts

boolean

Only keys with a miss rate or key source alert in the last 7 days

Responses

200

One page of keys

application/json

object

data

required

object

address_search

AddressSearch is q as the server read it when it is an address or a range, normalised (“10.0.4.7/24” is “10.0.4.0/24”, an IPv4-mapped address is written as IPv4); absent for a text search.

string

keys

required

Array<object>

object

created_at

required

string

creator

required

object

email

required

string

exists

required

boolean

user_id

required

string

username

required

string

current_generation

required

integer

expires_at

ExpiresAt is absent for a key that never expires.

string

group_name

required

string

hosts_7d

required

Hosts7d counts the distinct source addresses that used the key in the last 7 days.

integer

required

string

key_source_alert_at

string

last_seen_at

LastSeenAt is the last lookup any host made with the key, from the retained usage; absent for a key no host has used.

string

matched

Matched is, for an address search only, the addresses in the search the key was used from.

object

addresses

required

Array<object>

object

generation

required

integer

last_seen

required

LastSeen is the key’s last lookup from the address in the window.

string

secret

required

Secret is which of the key’s secrets that lookup presented.

string

Allowed values: current previous older

source_ip

required

string

total

required

integer

miss_rate_alert_at

MissRateAlertAt and KeySourceAlertAt are when those alerts last fired for the key, absent unless within the last 7 days.

string

name

required

string

previous_expires_at

PreviousExpiresAt is when the previous secret stops being accepted, absent when there is none.

string

revoked_at

RevokedAt is absent while the key is live.

string

status

required

Status is derived from the revocation and expiry.

string

Allowed values: active expired revoked

next_cursor

NextCursor is the after for the following page, absent on the last.

string

total

required

Total counts every key matching the filters, across all pages.

integer

usage_retention_seconds

required

UsageRetentionSeconds is nss.usage_retention: how far back an address search reaches, since older usage is not kept. 0 keeps every row.

integer

error

string

Example

{
  "data": {
    "keys": [
      {
        "matched": {
          "addresses": [
            {
              "secret": "current"
            }
          ]
        },
        "status": "active"
      }
    ]
  }
}

400

A q shaped like an address or range that is not one, invalid paging parameters, an after that names no key, or offset

application/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}

401

Not authenticated

application/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}

403

Neither an auditor (or above) nor a fleet key admin

application/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}

404

Nss_disabled: nss.enabled is false

application/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}