> ## Documentation Index > Fetch the complete documentation index at: https://docs.ornn.com/llms.txt > Use this file to discover all available pages before exploring further. # Assign an SSH key to a reservation > Assigns one key to a VM or Bare Metal reservation and queues the reservation's key set for its active machines. Send either the ID of an active organization key or a new public key; a new key is registered to your organization first. The first assignment replaces the default of every organization key, so afterwards only assigned keys are delivered. Queued is not installed; wait until the key's fingerprint appears in authorized_key_fingerprints on each node before connecting. You can assign keys before launch; they are used when machines start. This endpoint does not take an `Idempotency-Key`. Assigning a key that is already assigned leaves the assignment in place and queues delivery again. CLI equivalent: `ornn ssh-keys assignments assign --key `. ## OpenAPI ````yaml openapi.yaml POST /v1/orchestrator/nodes/reservations/{reservation_id}/ssh-keys openapi: 3.1.0 info: title: Ornn compute API version: 1.0.0 description: >- Customer HTTP API for Ornn GPU capacity. It covers reserved capacity and nodes, VM and Bare Metal access, Kubernetes and Slurm clusters, SSH keys, storage volumes and GitHub repositories, private networks, monitoring, buying and selling capacity (Reserve, Market, Spot, and Relist), and billing. API keys are scoped to one organization and act with their creator's access there; account, team, and API-key management stay in the console. Most operations require an approved organization. See https://docs.ornn.com/api-keys to create a key and https://docs.ornn.com/guides/kubernetes-api for an end-to-end Kubernetes integration. Examples use fictional IDs and credentials. The info.version field identifies the contract revision, not a shared API path version. contact: email: support@ornn.com servers: - url: https://api.ornn.com description: Production security: - OrnnApiKey: [] tags: - name: Authentication - name: Reservations - name: GPU nodes - name: Clusters - name: Workers - name: Virtual machines description: >- Choose a VM disk, launch VM access on a reservation, and read each VM's status, launch progress, and SSH connection details. - name: Bare Metal description: >- Launch Bare Metal access on a reservation, read a host's readiness and SSH connection details, and reboot or hard reset it. - name: SSH keys description: >- Register public keys for your organization, choose which keys a VM or Bare Metal reservation uses, and queue key delivery to machines. Slurm clusters take organization key IDs at launch. Kubernetes API access does not use SSH keys. - name: Reserve description: >- Browse reserved-capacity listings and their terms, and post, cancel, or accept offers. Reserve listings are visible to approved organizations. - name: Market description: >- Browse relisted capacity and buy windows at the asking price, paid up front. Open to every member of your organization. - name: Spot description: >- Hourly order books for VMs with 1, 2, 4, or 8 GPUs on one node: read books, trades, and quotes, place and cancel bids, and follow fills. - name: Relist description: >- Sell whole nodes from a reservation you hold at your asking price, and manage those listings. - name: Storage description: >- Managed volumes, their files, and GitHub repository pulls. Volumes belong to the API key's creator in the key's organization. - name: Networks description: >- Organization private networks and the WireGuard configs you use to reach private machines and clusters. - name: Monitoring description: >- Machine telemetry and console logs for capacity your organization holds. Reads are limited to your reservation window. - name: Billing description: >- Invoices, billing summary, usage cost, Ornn credits, and account statements. Saving a card and paying invoices stay in the console. externalDocs: description: REST integration walkthrough url: >- https://docs.ornn.com/guides/kubernetes-access#provision-and-manage-through-rest paths: /v1/orchestrator/nodes/reservations/{reservation_id}/ssh-keys: post: tags: - SSH keys summary: Assign an SSH key to a reservation description: >- Assigns one key to a VM or Bare Metal reservation and queues the reservation's key set for its active machines. Send either the ID of an active organization key or a new public key; a new key is registered to your organization first. The first assignment replaces the default of every organization key, so afterwards only assigned keys are delivered. Queued is not installed; wait until the key's fingerprint appears in authorized_key_fingerprints on each node before connecting. You can assign keys before launch; they are used when machines start. operationId: accountAssignReservationSshKey parameters: - $ref: '#/components/parameters/AccountReservationId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AccountAssignReservationSshKey' examples: existing: summary: Assign an existing organization key value: ssh_key_id: 77777777-7777-4777-8777-777777777777 new: summary: Register and assign a new public key value: public_key: >- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKeyMaterialForDocsOnly0000000000 dev@example.com label: laptop responses: '201': description: >- The key is assigned and delivery is queued for active machines. A request with a new public key also returns outcome. content: application/json: schema: $ref: '#/components/schemas/AccountAssignedSshKey' example: id: 77777777-7777-4777-8777-777777777777 organization_id: 22222222-2222-4222-8222-222222222222 tenant_id: 22222222-2222-4222-8222-222222222222 public_key: >- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKeyMaterialForDocsOnly0000000000 dev@example.com fingerprint: SHA256:ExampleFingerprintForDocumentationOnly000000 label: laptop status: active created_at: '2026-10-14T12:00:00Z' revoked_at: null '401': $ref: '#/components/responses/Unauthorized' '403': description: >- The organization is not approved, or ssh_key_id is not an active key in your organization. content: application/json: schema: $ref: '#/components/schemas/Error' example: detail: code: ssh_key_not_owned message: That SSH key belongs to another account. '404': $ref: '#/components/responses/AccountReservationNotFound' '409': $ref: '#/components/responses/AccountReservationNotLaunchable' '422': description: >- The body is neither an ssh_key_id nor a public_key with an optional label. content: application/json: schema: $ref: '#/components/schemas/Error' '429': $ref: '#/components/responses/AccountRateLimited' default: $ref: '#/components/responses/Error' components: parameters: AccountReservationId: name: reservation_id in: path required: true description: >- A reservation your organization holds. Keys are delivered to its VM and Bare Metal machines. schema: type: string format: uuid example: 11111111-1111-4111-8111-111111111111 schemas: AccountAssignReservationSshKey: oneOf: - type: object title: Existing key required: - ssh_key_id properties: ssh_key_id: type: string format: uuid description: An active organization SSH key. additionalProperties: false - type: object title: New public key required: - public_key properties: public_key: type: string description: One-line OpenSSH public key to register and assign. label: type: - string - 'null' additionalProperties: false AccountAssignedSshKey: allOf: - $ref: '#/components/schemas/AccountSshKey' - type: object properties: outcome: type: string enum: - created - already_registered - reactivated description: Present when the request sent a new public key. Error: type: object properties: code: type: string detail: oneOf: - type: string - type: object required: - code - message properties: code: type: string message: type: string AccountSshKey: type: object required: - id - organization_id - public_key - fingerprint - status - created_at properties: id: type: string format: uuid organization_id: type: string format: uuid description: Your organization. tenant_id: type: string format: uuid deprecated: true description: Same value as organization_id. Use organization_id. public_key: type: string description: The OpenSSH public key as registered, including any comment. fingerprint: type: string description: SHA-256 fingerprint in OpenSSH format, such as SHA256:... label: type: - string - 'null' description: Your name for the key. status: type: string enum: - active - revoked created_at: type: string format: date-time revoked_at: type: - string - 'null' format: date-time AccountRateLimitError: type: object properties: error: type: string enum: - rate_limited retry_after: type: integer description: Seconds to wait before retrying. detail: type: string responses: Unauthorized: description: >- The credential is missing, invalid, revoked, or no longer belongs to a current organization member. Check the HTTP status before parsing the body. content: application/json: schema: $ref: '#/components/schemas/Error' AccountReservationNotFound: description: The reservation does not exist or is not held by your organization. content: application/json: schema: $ref: '#/components/schemas/Error' AccountReservationNotLaunchable: description: >- The reservation has ended, was cancelled, or has a pending change, so its keys cannot change. content: application/json: schema: $ref: '#/components/schemas/Error' example: detail: code: reservation_not_launchable message: This reservation cannot launch in its current state. AccountRateLimited: description: >- Too many requests. Wait for the number of seconds in Retry-After, or at least 60 seconds when the header is absent, then retry with jitter. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/AccountRateLimitError' example: error: rate_limited retry_after: 42 detail: Too many requests. Try again in 42 seconds. Error: description: >- Unsuccessful request. Check HTTP status first. Errors may have detail.code/detail.message, a string detail and optional top-level code, or an empty/non-JSON body. 401: invalid credential; 403: access or approval required; 404: not visible or credentials not ready; 409: lifecycle conflict; 429: back off; 5xx: service failure. Inspect current state before retrying mutations. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: OrnnApiKey: type: http scheme: bearer bearerFormat: ornn_sk_... description: >- Create an organization API key in Account Settings > Developer. Do not send this key to the Kubernetes API server. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.