POST | Deactivate SSH key

Description

Deactivate an SSH key in PAM Core. A deactivated key keeps its configuration and stays readable, but it rejects rotation and other write operations.

Deactivation is not deletion. The key still appears in GET | List all SSH keys and still returns 200 on GET | List an SSH key by [id], with ssh_key.active set to false.

Attention

Deactivating a key that an automation depends on breaks that automation. A write operation against an inactive key returns 409 with api.resource.inactive.

Prerequisites

Authorization with read and write permission to PAM Core, granted by the administrator in A2A. For more information, access How to manage authorizations in A2A.
A valid OAuth 2.0 access token. For more information, access How to authenticate an application in A2A.
The SSH key must be active. Deactivating an already inactive key returns 409.

Request

POST /api/v2/pam/ssh-keys/{id}/deactivate

Path parameters

Field	Type	Required	Description
`id`	string	Yes	Unique identification code of the SSH key, assigned by Segura®.

The request has no body.

Example request

POST {{url}}/api/v2/pam/ssh-keys/2267/deactivate

Response

HTTP/1.1 204 No Content

The response has no body. To confirm the new state, retrieve the key with GET | List an SSH key by [id] and check ssh_key.active.

Errors

API v2 returns a structured code in the response body, alongside a human-readable message.

HTTP code	Message	Possible cause	Solution
`401`	`api.auth.token.invalid`	The access token is missing, expired, or invalid.	Request a new access token and resend the request.
`403`	`api.permission.denied`	The authorization does not have write permission to PAM Core resources.	Ask the administrator to check the authorization permissions in A2A, then generate a new token.
`404`	`api.resource.not_found`	The SSH key does not exist, or it is outside the scope of the authorization.	Check the identification code sent in the path.
`409`	`api.resource.conflict.already_inactive`	The SSH key is already inactive.	No action is needed. The key is already in the requested state.
`429`	`rate_limit_exceeded`	The request rate limit was exceeded.	Reduce the request rate and try again.
`500`	`api.internal.error`	Internal server error.	Contact the Segura® support team.

Example error response

409 the key is already inactive:

{
    "code": "api.resource.conflict.already_inactive",
    "message": "SSH key is already inactive.",
    "details": null
}

Info

This action is not idempotent. Repeating it on a key that is already inactive returns 409 rather than 204. Retrieve the current state of the key before retrying a request whose outcome you are unsure of.

For authentication error messages and the 403 versus 404 policy, access API v2 - Conventions and shared behaviors.