# IssueSSHCert signs a caller-held public key for sandbox SSH access.


[API catalog](/reference/api/) · [Docker Sandboxes overview](/reference/api/sandboxes/latest/) · [Product manual](https://docs.docker.com/ai/sandboxes-api/) · [OpenAPI specification](/reference/api/sandboxes/api.yaml)

API version: v1


> This API is experimental. Features, interfaces,
> and behavior may change.




`POST /v1/sandboxes/{sandbox}/ssh-certificates`

IssueSSHCert signs a caller-held public key for sandbox SSH access.
A create: each call mints one certificate under the sandbox's certificate collection.

Returns unimplemented when this operation is unavailable. Support does not grant permission.

## Connection and access

[API connection and authentication guidance](/reference/api/sandboxes/latest/#authentication)


Server: `https://connect.docker.com/sandboxes`

Effective security: alternatives are OR; schemes within an alternative are AND. An empty array declares no HTTP authentication requirement.

```json
[
  {
    "bearer": []
  }
]
```

## Example request

Replace placeholders and provide the required credentials or request body.

```console
curl \
  --request POST \
  --header "Authorization: Bearer ${TOKEN}" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data-binary @request-body \
  'https://connect.docker.com/sandboxes/v1/sandboxes/<SANDBOX>/ssh-certificates'
```


Prepare request-body using the selected media type and schema.


## Parameters

### sandbox

Location: path. Required: yes.

The sandbox id.

```json
{
  "description": "The sandbox id.",
  "in": "path",
  "name": "sandbox",
  "pointer": "/paths/~1v1~1sandboxes~1{sandbox}~1ssh-certificates/post/parameters/0",
  "required": true,
  "schema": {
    "type": "string"
  }
}
```

## Request and responses

### Request  application/json




Schema:

```json
{
  "additionalProperties": false,
  "description": "IssueSSHCertRequest asks the backend to sign a caller-held public key.",
  "properties": {
    "publicKey": {
      "description": "public_key is the caller-held SSH public key.",
      "minLength": 1,
      "type": "string"
    },
    "ttl": {
      "$ref": "#/components/schemas/Duration",
      "description": "ttl is the requested certificate lifetime."
    }
  },
  "required": [
    "publicKey"
  ],
  "title": "IssueSSHCertRequest",
  "type": "object"
}
```










### Response 201 application/json

Success


Schema:

```json
{
  "$ref": "#/components/schemas/IssueSSHCertResponse"
}
```



Headers:

```json
{
  "Cache-Control": {
    "required": true,
    "schema": {
      "const": "no-store",
      "type": "string"
    }
  }
}
```








### Response 409 application/json

Creation conflicts with an existing resource (ALREADY_EXISTS).


Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```



Headers:

```json
{
  "Cache-Control": {
    "required": true,
    "schema": {
      "enum": [
        "no-store"
      ],
      "type": "string"
    }
  }
}
```







Schema example:
```json
{
  "code": "notFound",
  "details": [],
  "message": "sandbox not found"
}
```


### Response 501 application/json

This operation is not available on this service.


Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```



Headers:

```json
{
  "Cache-Control": {
    "required": true,
    "schema": {
      "enum": [
        "no-store"
      ],
      "type": "string"
    }
  }
}
```







unimplemented:
```json
{
  "code": "unimplemented",
  "message": "This operation is not available on this service."
}
```


### Response default application/json

The structured Error body identifies the failure with a stable code and optional typed details.


Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```



Headers:

```json
{
  "Cache-Control": {
    "required": true,
    "schema": {
      "enum": [
        "no-store"
      ],
      "type": "string"
    }
  }
}
```







Schema example:
```json
{
  "code": "notFound",
  "details": [],
  "message": "sandbox not found"
}
```


## Complete operation contract

```json
{
  "description": "IssueSSHCert signs a caller-held public key for sandbox SSH access.\nA create: each call mints one certificate under the sandbox's certificate collection.\n\nReturns unimplemented when this operation is unavailable. Support does not grant permission.",
  "operationId": "issueSSHCert",
  "parameters": [
    {
      "description": "The sandbox id.",
      "in": "path",
      "name": "sandbox",
      "required": true,
      "schema": {
        "type": "string"
      }
    }
  ],
  "requestBody": {
    "content": {
      "application/json": {
        "schema": {
          "additionalProperties": false,
          "description": "IssueSSHCertRequest asks the backend to sign a caller-held public key.",
          "properties": {
            "publicKey": {
              "description": "public_key is the caller-held SSH public key.",
              "minLength": 1,
              "type": "string"
            },
            "ttl": {
              "$ref": "#/components/schemas/Duration",
              "description": "ttl is the requested certificate lifetime."
            }
          },
          "required": [
            "publicKey"
          ],
          "title": "IssueSSHCertRequest",
          "type": "object"
        }
      }
    },
    "required": true
  },
  "responses": {
    "201": {
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/IssueSSHCertResponse"
          }
        }
      },
      "description": "Success",
      "headers": {
        "Cache-Control": {
          "required": true,
          "schema": {
            "const": "no-store",
            "type": "string"
          }
        }
      }
    },
    "409": {
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      },
      "description": "Creation conflicts with an existing resource (ALREADY_EXISTS).",
      "headers": {
        "Cache-Control": {
          "required": true,
          "schema": {
            "enum": [
              "no-store"
            ],
            "type": "string"
          }
        }
      }
    },
    "501": {
      "content": {
        "application/json": {
          "examples": {
            "unimplemented": {
              "summary": "This operation is not available on this service.",
              "value": {
                "code": "unimplemented",
                "message": "This operation is not available on this service."
              }
            }
          },
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      },
      "description": "This operation is not available on this service.",
      "headers": {
        "Cache-Control": {
          "required": true,
          "schema": {
            "enum": [
              "no-store"
            ],
            "type": "string"
          }
        }
      }
    },
    "default": {
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      },
      "description": "The structured Error body identifies the failure with a stable code and optional typed details.",
      "headers": {
        "Cache-Control": {
          "required": true,
          "schema": {
            "enum": [
              "no-store"
            ],
            "type": "string"
          }
        }
      }
    }
  },
  "security": [
    {
      "bearer": []
    }
  ],
  "summary": "IssueSSHCert signs a caller-held public key for sandbox SSH access.",
  "tags": [
    "Sandboxes"
  ],
  "x-sbx-authenticated-only": false,
  "x-sbx-conditional-permissions": [],
  "x-sbx-error-responses": [
    {
      "code": "UNIMPLEMENTED",
      "description": "This operation is not available on this service."
    }
  ],
  "x-sbx-plane": "control",
  "x-sbx-required-permissions": [
    "sandboxesSsh"
  ],
  "x-sbx-serving-surface": "management"
}
```

## Referenced schemas

- [#/components/schemas/Duration](/reference/api/sandboxes/latest/schemas/Duration/)

- [#/components/schemas/Error](/reference/api/sandboxes/latest/schemas/Error/)

- [#/components/schemas/IssueSSHCertResponse](/reference/api/sandboxes/latest/schemas/IssueSSHCertResponse/)