> ## Documentation Index > Fetch the complete documentation index at: https://docs.ornn.com/llms.txt > Use this file to discover all available pages before exploring further. # Push SSH keys to a machine > Assigns the listed organization keys to the machine's reservation if needed, then queues the reservation's full key set for this machine. Pass the host node ID, which is a Bare Metal node's node_id or a VM's node_id from the reservation VM list (not the VM's own id). Ornn updates that host and the reservation's VMs on it. Use this to re-send keys after a machine was offline or a delivery failed. A 200 response means delivery was queued, not installed; poll the node and wait for the key's fingerprint in authorized_key_fingerprints. Machines in a Kubernetes or Slurm cluster are rejected. CLI equivalent: `ornn ssh-keys assignments sync ` pushes the assigned keys to every machine in the reservation. ## OpenAPI ````yaml openapi.yaml POST /v1/orchestrator/nodes/{node_id}/push-keys openapi: 3.1.0 info: title: Ornn compute API version: 1.0.0 description: >- Customer HTTP API for Ornn GPU capacity. It covers reserved capacity and nodes, VM and Bare Metal access, Kubernetes and Slurm clusters, SSH keys, storage volumes and GitHub repositories, private networks, monitoring, buying and selling capacity (Reserve, Market, Spot, and Relist), and billing. API keys are scoped to one organization and act with their creator's access there; account, team, and API-key management stay in the console. Most operations require an approved organization. See https://docs.ornn.com/api-keys to create a key and https://docs.ornn.com/guides/kubernetes-api for an end-to-end Kubernetes integration. Examples use fictional IDs and credentials. The info.version field identifies the contract revision, not a shared API path version. contact: email: support@ornn.com servers: - url: https://api.ornn.com description: Production security: - OrnnApiKey: [] tags: - name: Authentication - name: Reservations - name: GPU nodes - name: Clusters - name: Workers - name: Virtual machines description: >- Choose a VM disk, launch VM access on a reservation, and read each VM's status, launch progress, and SSH connection details. - name: Bare Metal description: >- Launch Bare Metal access on a reservation, read a host's readiness and SSH connection details, and reboot or hard reset it. - name: SSH keys description: >- Register public keys for your organization, choose which keys a VM or Bare Metal reservation uses, and queue key delivery to machines. Slurm clusters take organization key IDs at launch. Kubernetes API access does not use SSH keys. - name: Reserve description: >- Browse reserved-capacity listings and their terms, and post, cancel, or accept offers. Reserve listings are visible to approved organizations. - name: Market description: >- Browse relisted capacity and buy windows at the asking price, paid up front. Open to every member of your organization. - name: Spot description: >- Hourly order books for VMs with 1, 2, 4, or 8 GPUs on one node: read books, trades, and quotes, place and cancel bids, and follow fills. - name: Relist description: >- Sell whole nodes from a reservation you hold at your asking price, and manage those listings. - name: Storage description: >- Managed volumes, their files, and GitHub repository pulls. Volumes belong to the API key's creator in the key's organization. - name: Networks description: >- Organization private networks and the WireGuard configs you use to reach private machines and clusters. - name: Monitoring description: >- Machine telemetry and console logs for capacity your organization holds. Reads are limited to your reservation window. - name: Billing description: >- Invoices, billing summary, usage cost, Ornn credits, and account statements. Saving a card and paying invoices stay in the console. externalDocs: description: REST integration walkthrough url: >- https://docs.ornn.com/guides/kubernetes-access#provision-and-manage-through-rest paths: /v1/orchestrator/nodes/{node_id}/push-keys: post: tags: - SSH keys summary: Push SSH keys to a machine description: >- Assigns the listed organization keys to the machine's reservation if needed, then queues the reservation's full key set for this machine. Pass the host node ID, which is a Bare Metal node's node_id or a VM's node_id from the reservation VM list (not the VM's own id). Ornn updates that host and the reservation's VMs on it. Use this to re-send keys after a machine was offline or a delivery failed. A 200 response means delivery was queued, not installed; poll the node and wait for the key's fingerprint in authorized_key_fingerprints. Machines in a Kubernetes or Slurm cluster are rejected. operationId: accountPushMachineSshKeys parameters: - name: node_id in: path required: true description: >- The host node ID (a Bare Metal node_id, or a VM's node_id) on a reservation your organization holds. A VM's own id returns 404 node_not_found. schema: type: string format: uuid example: 33333333-3333-4333-8333-333333333333 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AccountPushSshKeys' example: ssh_key_ids: - 77777777-7777-4777-8777-777777777777 responses: '200': description: Key delivery is queued for the machine. content: application/json: schema: $ref: '#/components/schemas/AccountPushSshKeysResult' example: id: 33333333-3333-4333-8333-333333333333 node_id: 33333333-3333-4333-8333-333333333333 reservation_id: 11111111-1111-4111-8111-111111111111 packet_id: 88888888-8888-4888-8888-888888888888 packet_ids: - 88888888-8888-4888-8888-888888888888 ssh_key_ids: - 77777777-7777-4777-8777-777777777777 '400': description: ssh_key_ids is empty or repeats a key. content: application/json: schema: $ref: '#/components/schemas/Error' example: detail: code: ssh_key_ids_invalid message: Choose at least one SSH key, each only once. '401': $ref: '#/components/responses/Unauthorized' '403': description: >- The organization is not approved, or a listed key is not an active key in your organization. content: application/json: schema: $ref: '#/components/schemas/Error' example: detail: code: ssh_key_not_owned message: That SSH key belongs to another account. '404': description: >- The machine does not exist or is not in a reservation your organization holds. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- The machine is a Kubernetes or Slurm cluster worker, the VM is not running yet, or the reservation cannot accept changes. content: application/json: schema: $ref: '#/components/schemas/Error' example: detail: code: cluster_worker_keys_blocked message: >- SSH keys cannot be pushed while this node is in a Kubernetes or Slurm cluster. Tear the cluster down first. '429': $ref: '#/components/responses/AccountRateLimited' default: $ref: '#/components/responses/Error' components: schemas: AccountPushSshKeys: type: object required: - ssh_key_ids properties: ssh_key_ids: type: array minItems: 1 uniqueItems: true items: type: string format: uuid description: >- Active organization keys to assign to the machine's reservation before delivery. request_id: type: string description: >- Optional delivery ID for your own correlation. Omit it to let Ornn generate one. If you send it, use a new value for every push; reusing a value for the same machine returns the earlier delivery instead of queuing the current key set. additionalProperties: false AccountPushSshKeysResult: type: object required: - id - node_id - reservation_id - packet_ids - ssh_key_ids properties: id: type: string format: uuid description: The machine ID from the request path. node_id: type: string format: uuid description: The physical node that hosts the machine. reservation_id: type: string format: uuid packet_id: type: - string - 'null' format: uuid description: The first queued delivery ID, or null when nothing was queued. packet_ids: type: array items: type: string format: uuid description: One queued delivery ID per updated VM or host. ssh_key_ids: type: array items: type: string format: uuid description: The reservation's full key set that was queued. Error: type: object properties: code: type: string detail: oneOf: - type: string - type: object required: - code - message properties: code: type: string message: type: string AccountRateLimitError: type: object properties: error: type: string enum: - rate_limited retry_after: type: integer description: Seconds to wait before retrying. detail: type: string responses: Unauthorized: description: >- The credential is missing, invalid, revoked, or no longer belongs to a current organization member. Check the HTTP status before parsing the body. content: application/json: schema: $ref: '#/components/schemas/Error' AccountRateLimited: description: >- Too many requests. Wait for the number of seconds in Retry-After, or at least 60 seconds when the header is absent, then retry with jitter. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/AccountRateLimitError' example: error: rate_limited retry_after: 42 detail: Too many requests. Try again in 42 seconds. Error: description: >- Unsuccessful request. Check HTTP status first. Errors may have detail.code/detail.message, a string detail and optional top-level code, or an empty/non-JSON body. 401: invalid credential; 403: access or approval required; 404: not visible or credentials not ready; 409: lifecycle conflict; 429: back off; 5xx: service failure. Inspect current state before retrying mutations. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: OrnnApiKey: type: http scheme: bearer bearerFormat: ornn_sk_... description: >- Create an organization API key in Account Settings > Developer. Do not send this key to the Kubernetes API server. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.