---
title: "POST | Deactivate SSH key"
slug: "api-v2-post-deactivate-ssh-key"
updated: 2026-11-03T14:47:51Z
published: 2026-11-03T14:47:51Z
canonical: "docs.senhasegura.io/api-v2-post-deactivate-ssh-key"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# POST | Deactivate SSH key

## Description

Deactivate an SSH key in PAM Core. A deactivated key keeps its configuration and stays readable, but it rejects rotation and other write operations.

Deactivation is not deletion. The key still appears in [GET | List all SSH keys](/v4-2/docs/api-v2-get-list-all-ssh-keys) and still returns `200` on [GET | List an SSH key by [id]](/v4-2/docs/api-v2-get-list-an-ssh-key), with `ssh_key.active` set to `false`.

Attention

Deactivating a key that an automation depends on breaks that automation. A write operation against an inactive key returns `409` with `api.resource.inactive`.

---

## Prerequisites

- Authorization with **read and write** permission to PAM Core, granted by the administrator in A2A. For more information, access [How to manage authorizations in A2A](/v4-2/docs/api-v2-how-to-manage-authorizations-in-a2a).
- A valid OAuth 2.0 access token. For more information, access [How to authenticate an application in A2A](/v4-2/docs/how-to-authenticate-an-application-in-a2a).
- The SSH key must be active. Deactivating an already inactive key returns `409`.

---

## Request

`POST` `/api/v2/pam/ssh-keys/{id}/deactivate`

### Path parameters

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | Unique identification code of the SSH key, assigned by Segura™. |

The request has no body.

---

### Example request

`POST` `{{url}}/api/v2/pam/ssh-keys/2267/deactivate`

---

## Response

```
HTTP/1.1 204 No Content
```

The response has no body. To confirm the new state, retrieve the key with [GET | List an SSH key by [id]](/v4-2/docs/api-v2-get-list-an-ssh-key) and check `ssh_key.active`.

---

## Errors

API v2 returns a structured `code` in the response body, alongside a human-readable `message`.

| HTTP code | Message | Possible cause | Solution |
| --- | --- | --- | --- |
| `401` | `api.auth.token.invalid` | The access token is missing, expired, or invalid. | Request a new access token and resend the request. |
| `403` | `api.permission.denied` | The authorization does not have write permission to PAM Core resources. | Ask the administrator to check the authorization permissions in A2A, then generate a new token. |
| `404` | `api.resource.not_found` | The SSH key does not exist, or it is outside the scope of the authorization. | Check the identification code sent in the path. |
| `409` | `api.resource.conflict.already_inactive` | The SSH key is already inactive. | No action is needed. The key is already in the requested state. |
| `429` | `rate_limit_exceeded` | The request rate limit was exceeded. | Reduce the request rate and try again. |
| `500` | `api.internal.error` | Internal server error. | Contact the Segura™ support team. |

### Example error response

`409` the key is already inactive:

```
{
    "code": "api.resource.conflict.already_inactive",
    "message": "SSH key is already inactive.",
    "details": null
}
```

Info

This action is not idempotent. Repeating it on a key that is already inactive returns `409` rather than `204`. Retrieve the current state of the key before retrying a request whose outcome you are unsure of.

For authentication error messages and the `403` versus `404` policy, access [API v2 - Conventions and shared behaviors](/v4-2/docs/api-v2-conventions-and-shared-behaviors).

---

## Related documents

- [POST | Activate SSH key](/v4-2/docs/api-v2-post-activate-ssh-key)
- [GET | List an SSH key by [id]](/v4-2/docs/api-v2-get-list-an-ssh-key)
- [API v2 - Conventions and shared behaviors](/v4-2/docs/api-v2-conventions-and-shared-behaviors)