Instance SSH certificates API

Use this API to manage the SSH certificate authority (CA) public keys that an instance trusts. GitLab stores each CA public key in the database and trusts it instance-wide, so you rotate a CA with an API call instead of a change to sshd_config or the gitlab-sshd configuration file. For the file-based alternatives, see instance-level SSH certificates with gitlab-sshd.

The key attribute contains a CA public key, not a private key or a signed user certificate.

Authentication and availability

All endpoints require an administrator authenticated with the REST API. If Admin Mode is enabled for the instance, the existing Admin Mode requirements apply, including the admin_mode scope for personal access tokens or OAuth tokens.

GitLab checks authentication and administrator access before feature availability. The following errors apply to all endpoints, even when the feature flag is disabled:

List all instance SSH certificates

Lists all instance SSH CA public key records in descending ID order.

GET /admin/ssh_certificates

This endpoint supports standard pagination.

If successful, returns 200 OK and an array of objects with the following response attributes:

Example request:

curl --request GET \
  --header "PRIVATE-TOKEN: <your_access_token>" \
  --url "https://gitlab.example.com/api/v4/admin/ssh_certificates?page=1&per_page=20"

Example response (<ca_public_key> represents the full SSH CA public key):

[
  {
    "id": 2,
    "title": "Engineering CA",
    "key": "<ca_public_key>",
    "fingerprint": "<ca_public_key_fingerprint>",
    "created_at": "2026-09-08T12:39:00.172Z"
  },
  {
    "id": 1,
    "title": "Operations CA",
    "key": "<ca_public_key>",
    "fingerprint": "<ca_public_key_fingerprint>",
    "created_at": "2026-09-08T11:30:00.000Z"
  }
]

An empty result returns [].

Add an instance SSH certificate

Adds an instance SSH CA public key record.

POST /admin/ssh_certificates

If successful, returns 201 Created and the following response attributes:

Example request, with the CA public key in /path/to/ca_key.pub:

curl --request POST \
  --header "PRIVATE-TOKEN: <your_access_token>" \
  --data-urlencode "title=Engineering CA" \
  --data-urlencode "key@/path/to/ca_key.pub" \
  --url "https://gitlab.example.com/api/v4/admin/ssh_certificates"

Example response:

{
  "id": 2,
  "title": "Engineering CA",
  "key": "<ca_public_key>",
  "fingerprint": "<ca_public_key_fingerprint>",
  "created_at": "2026-09-08T12:39:00.172Z"
}

In addition to the shared authentication and availability errors, this endpoint can return:

Delete an instance SSH certificate

Deletes a specified instance SSH CA public key record.

DELETE /admin/ssh_certificates/:id

If successful, returns 204 No Content with an empty response body and no response attributes.

Example request:

curl --request DELETE \
  --header "PRIVATE-TOKEN: <your_access_token>" \
  --url "https://gitlab.example.com/api/v4/admin/ssh_certificates/2"

In addition to the shared authentication and availability errors, this endpoint can return: