@celigo/api-specs 0.2.201 → 0.2.203

package/dist/fileserver.yml

@@ -10,8 +10,7 @@ info:
       (`/v1/mft/fileserver/accounts`), each chrooted to a Celigo Storage folder. Requires a
       full-access API token — folder-path-scoped and other restricted tokens answer 403
       FILESERVER_FULL_ACCESS_TOKEN_REQUIRED on every route, and so does every personal access
-      token, whatever its creator's role. Only the account owner and administrators may manage
-      the server.
+      token, whatever its creator's role.
 servers:
   - url: https://api.integrator.io
     description: Production (US / default region)
@@ -26,11 +25,11 @@ security:
 tags:
   - name: File Server
     description: |-
-      Each environment can run a Celigo-hosted SFTP file server. Enabling it claims a permanent `identifier` that becomes part of every partner login (`<username>@<identifier>`) and exposes the shared endpoint and host-key fingerprints partners need to connect. Partner accounts are created under the server, each with its own password and a Celigo Storage folder that becomes the account's root, so files a partner uploads appear in that folder and files placed there are what the partner can download. The account's license must include the file server add-on (`fileserver.enabled`), and every call needs a full-access API token: scoped tokens and personal access tokens are refused, and so are manage, monitor and integration-level users.
+      Each environment can run a Celigo-hosted SFTP file server. Enabling it claims a permanent `identifier` that becomes part of every partner login (`<username>@<identifier>`) and exposes the shared endpoint and host-key fingerprints partners need to connect. Partner accounts are created under the server, each with its own credentials — a password, SSH public keys, or both — and a Celigo Storage folder that becomes the account's root, so files a partner uploads appear in that folder and files placed there are what the partner can download. Per-account `permissions` narrow what the partner may do inside that folder, down to a write-only drop box or a read-only pickup folder. The account's license must include the file server add-on (`fileserver.enabled`), and every call needs a full-access API token: scoped tokens and personal access tokens are refused.
 
-      ## File server and account schemas
+      ## File server, account and key schemas
 
-      {% openapi-schemas spec="fileserver" schemas="FileServer,FileServerAccount" grouped="true" %}
+      {% openapi-schemas spec="fileserver" schemas="FileServer,FileServerAccount,FileServerAccountPermissions,FileServerSshKey" grouped="true" %}
 paths:
   /v1/mft/fileserver:
     get:
@@ -91,9 +90,8 @@ paths:
         '403':
           description: |-
             The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`). A
-            personal access token is refused the same way as a scoped token, and a manage, monitor
-            or integration-level user gets `access_restricted`: only the owner and administrators
-            manage the file server.
+            personal access token is refused the same way as a scoped token, and a monitor user gets
+            `access_restricted`.
           content:
             application/json:
               schema:
@@ -105,7 +103,7 @@ paths:
                       - code: FILESERVER_FULL_ACCESS_TOKEN_REQUIRED
                         message: The file server management APIs require an API token with full access
                 notAdministrator:
-                  summary: A manage, monitor or integration-level user
+                  summary: A monitor user
                   value:
                     errors:
                       - code: access_restricted
@@ -324,11 +322,10 @@ paths:
       description: |-
         Returns the environment's partner accounts oldest first, wrapped in an
         `accounts` array, with `overCap` computed for each against the current
-        `limits.maxAccounts`. Paging is cursor-based through the `Link` header, which
-        lists bare absolute URLs separated by `, ` rather than RFC 8288 `<url>; rel=`
-        pairs: a URL carrying `after` (listed first) is present when more accounts
-        follow the page, and a URL carrying `before` is present when accounts precede
-        it — so the first page offers only `after`, the last page only `before`. The
+        `limits.maxAccounts`. Paging is cursor-based through the RFC 8288 `Link`
+        header: a `rel="next"` URL carrying an `after` cursor is present when more
+        accounts follow the page, and a `rel="prev"` URL carrying a `before` cursor is
+        present when accounts precede it — so the first page offers only `next`. The
         header is absent when every account fits in one page. Cursors are opaque —
         pass them back exactly as received; anything else answers 400
         `FILESERVER_INVALID_CURSOR`. Accounts stay listable after the add-on is removed
@@ -349,13 +346,13 @@ paths:
         - name: after
           in: query
           required: false
-          description: Opaque cursor copied from the `after` URL in the previous page's `Link` header. Returns the accounts created after it.
+          description: Opaque cursor copied from the `rel="next"` URL in the previous page's `Link` header. Returns the accounts created after it.
           schema:
             type: string
         - name: before
           in: query
           required: false
-          description: Opaque cursor copied from the `before` URL in a page's `Link` header. Returns the accounts created before it. Ignored when `after` is also sent.
+          description: Opaque cursor copied from the `rel="prev"` URL in a page's `Link` header. Returns the accounts created before it. Ignored when `after` is also sent.
           schema:
             type: string
       responses:
@@ -364,15 +361,13 @@ paths:
           headers:
             Link:
               description: |-
-                Pagination links as bare absolute URLs separated by `, ` — not the RFC 8288
-                `<url>; rel=` form. The URL carrying `after` (listed first) is present when
-                more accounts follow this page; the URL carrying `before` is present when
-                accounts precede it. Both repeat the request's `pageSize`. Absent when the
-                whole list fits in one page.
+                RFC 8288 links separated by `, `: `rel="next"` (listed first) when more
+                accounts follow this page, `rel="prev"` when accounts precede it. Both URLs
+                repeat the request's `pageSize`. Absent when the whole list fits in one page.
               schema:
                 type: string
                 examples:
-                  - https://api.integrator.io/v1/mft/fileserver/accounts?after=WyIyMDI2LTEwLTA3VDA2OjE5OjQzLjg4NloiLCI2YWM1ZTQ3ZjRhNzRiMzMzNDQxNzZkOTEiXQ&pageSize=100, https://api.integrator.io/v1/mft/fileserver/accounts?before=WyIyMDI2LTEwLTA3VDA2OjE5OjQzLjg4NloiLCI2YWM1ZTQ3ZjRhNzRiMzMzNDQxNzZkOTEiXQ&pageSize=100
+                  - <https://api.integrator.io/v1/mft/fileserver/accounts?after=WyIyMDI2LTEwLTA3VDA2OjE5OjQzLjg4NloiLCI2YWM1ZTQ3ZjRhNzRiMzMzNDQxNzZkOTEiXQ&pageSize=100>; rel="next", <https://api.integrator.io/v1/mft/fileserver/accounts?before=WyIyMDI2LTEwLTA3VDA2OjE5OjQzLjg4NloiLCI2YWM1ZTQ3ZjRhNzRiMzMzNDQxNzZkOTEiXQ&pageSize=100>; rel="prev"
           content:
             application/json:
               schema:
@@ -395,10 +390,32 @@ paths:
                         homeFolderPath: /Partners/Northwind/Inbound
                         enabled: true
                         passwordSet: true
+                        permissions:
+                          read: true
+                          create: true
+                          modify: false
+                          delete: false
+                        sshKeys:
+                          - label: acme prod
+                            fingerprint: SHA256:Yk3Qx2qkJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1wE
+                            algorithm: ssh-ed25519
+                            addedAt: '2026-10-01T09:14:02.511Z'
                         overCap: false
                         lastConnectedAt: '2026-09-22T14:35:31.646Z'
                         createdAt: '2026-09-22T03:13:56.060Z'
-                        lastModified: '2026-09-22T14:35:31.648Z'
+                        lastModified: '2026-10-01T09:14:02.511Z'
+                      - _id: 6a9d0c41e2f7b83a5c1e9f02
+                        username: contoso-pickup
+                        login: contoso-pickup@acme-logistics
+                        _homeFolderId: 6a9d0c2ee2f7b83a5c1e9ee7
+                        homeFolderPath: /Partners/Contoso/Outbound
+                        enabled: true
+                        passwordSet: true
+                        sshKeys: []
+                        overCap: false
+                        lastConnectedAt: null
+                        createdAt: '2026-08-14T10:02:45.120Z'
+                        lastModified: '2026-08-14T10:02:45.120Z'
         '400':
           description: The `after` or `before` cursor is not one this list issued (`FILESERVER_INVALID_CURSOR`).
           content:
@@ -417,8 +434,7 @@ paths:
           description: |-
             The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`), or
             the environment is a sandbox (`FILESERVER_NOT_ENTITLED`). A personal access token is
-            refused the same way as a scoped token, and a manage, monitor or integration-level user
-            gets `access_restricted`: only the owner and administrators manage the file server.
+            refused the same way as a scoped token, and a monitor user gets `access_restricted`.
           content:
             application/json:
               schema:
@@ -430,7 +446,7 @@ paths:
                       - code: FILESERVER_FULL_ACCESS_TOKEN_REQUIRED
                         message: The file server management APIs require an API token with full access
                 notAdministrator:
-                  summary: A manage, monitor or integration-level user
+                  summary: A monitor user
                   value:
                     errors:
                       - code: access_restricted
@@ -454,12 +470,16 @@ paths:
         - File Server
       summary: Create a file server account
       description: |-
-        Creates an enabled partner account with the given `username`, `password`, and
-        Celigo Storage home folder, and returns it (the password is never returned).
-        Checks run in order and the first failure is answered: username shape, password
-        presence, home-folder presence, the enabled-account cap, then the folder is
-        verified to be an active folder in this environment. From then on the folder
-        and every folder above it refuse `DELETE /v1/storage/items/{_id}` with 403
+        Creates an enabled partner account with the given `username`, a Celigo Storage
+        home folder, and at least one credential — a `password`, an `sshKey`, or both —
+        and returns it (the password is never returned; a supplied key appears in
+        `sshKeys` with its server-computed fingerprint). The account starts with the
+        default `permissions`: `read` and `create` on, `modify` and `delete` off.
+        Checks run in order and the first failure is answered: username shape,
+        credential presence, password type, key validity, home-folder presence, the
+        enabled-account cap, the folder verified as an active folder in this
+        environment, then password strength. From then on the folder and every folder
+        above it refuse `DELETE /v1/storage/items/{_id}` with 403
         `STORAGE_SFTP_HOME_FOLDER_PROTECTED` until the account is deleted or moved.
         Requires a full-access API token, the file server add-on on the license, and a
         server that has been enabled at least once.
@@ -470,11 +490,20 @@ paths:
             schema:
               $ref: '#/components/schemas/FileServerAccountCreateRequest'
             examples:
-              default:
+              password:
+                summary: Password-only account
                 value:
                   username: northwind-edi
                   password: Nw-Inbound-2026!x
                   _homeFolderId: 6ab1f25daa3e7ed226ea3f25
+              sshKey:
+                summary: Key-only account
+                value:
+                  username: northwind-edi
+                  sshKey:
+                    label: acme prod
+                    publicKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ9rT5bU4xJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1 acme-prod
+                  _homeFolderId: 6ab1f25daa3e7ed226ea3f25
       responses:
         '201':
           description: The new account.
@@ -483,7 +512,8 @@ paths:
               schema:
                 $ref: '#/components/schemas/FileServerAccount'
               examples:
-                default:
+                password:
+                  summary: Password-only account
                   value:
                     _id: 6ab1f2737cf630a06d774d09
                     username: northwind-edi
@@ -492,6 +522,36 @@ paths:
                     homeFolderPath: /Partners/Northwind/Inbound
                     enabled: true
                     passwordSet: true
+                    permissions:
+                      read: true
+                      create: true
+                      modify: false
+                      delete: false
+                    sshKeys: []
+                    overCap: false
+                    lastConnectedAt: null
+                    createdAt: '2026-09-22T03:13:56.060Z'
+                    lastModified: '2026-09-22T03:13:56.060Z'
+                sshKey:
+                  summary: Key-only account
+                  value:
+                    _id: 6ab1f2737cf630a06d774d09
+                    username: northwind-edi
+                    login: northwind-edi@acme-logistics
+                    _homeFolderId: 6ab1f25daa3e7ed226ea3f25
+                    homeFolderPath: /Partners/Northwind/Inbound
+                    enabled: true
+                    passwordSet: false
+                    permissions:
+                      read: true
+                      create: true
+                      modify: false
+                      delete: false
+                    sshKeys:
+                      - label: acme prod
+                        fingerprint: SHA256:Yk3Qx2qkJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1wE
+                        algorithm: ssh-ed25519
+                        addedAt: '2026-09-22T03:13:56.014Z'
                     overCap: false
                     lastConnectedAt: null
                     createdAt: '2026-09-22T03:13:56.060Z'
@@ -515,7 +575,9 @@ paths:
             The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`);
             the license lacks the add-on or the environment is a sandbox
             (`FILESERVER_NOT_ENTITLED`); or the environment already holds
-            `limits.maxAccounts` enabled accounts (`FILESERVER_MAX_ACCOUNTS_EXCEEDED`). A personal access token is refused the same way as a scoped token, and a manage, monitor or integration-level user gets `access_restricted`: only the owner and administrators manage the file server.
+            `limits.maxAccounts` enabled accounts (`FILESERVER_MAX_ACCOUNTS_EXCEEDED`). A
+            personal access token is refused the same way as a scoped token, and a monitor
+            user gets `access_restricted`.
           content:
             application/json:
               schema:
@@ -527,7 +589,7 @@ paths:
                       - code: FILESERVER_MAX_ACCOUNTS_EXCEEDED
                         message: The maximum number of enabled accounts for this environment has been reached
                 notAdministrator:
-                  summary: A manage, monitor or integration-level user
+                  summary: A monitor user
                   value:
                     errors:
                       - code: access_restricted
@@ -547,12 +609,15 @@ paths:
         '422':
           description: |-
             The server has never been enabled (`FILESERVER_NOT_ENABLED`); `username` is
-            missing or malformed (`FILESERVER_USERNAME_INVALID`); `password` is missing
-            or not a string (`FILESERVER_LAST_CREDENTIAL`) or too weak
-            (`FILESERVER_WEAK_PASSWORD` — the message lists every rule broken);
-            `_homeFolderId` is missing or does not exist in this environment
-            (`FILESERVER_HOME_FOLDER_NOT_FOUND`) or is a file rather than an active folder
-            (`FILESERVER_HOME_FOLDER_NOT_FOLDER`).
+            missing or malformed (`FILESERVER_USERNAME_INVALID`); neither `password` nor
+            `sshKey` was sent (`FILESERVER_LAST_CREDENTIAL`); the password is not a string or
+            is too weak (`FILESERVER_WEAK_PASSWORD` — the message lists every rule broken);
+            the key does not parse, is of an unsupported type, or is an RSA key under 2048
+            bits (`FILESERVER_KEY_INVALID`, `FILESERVER_KEY_TYPE_UNSUPPORTED`,
+            `FILESERVER_KEY_TOO_WEAK`), or its `label` is not a usable string
+            (`FILESERVER_KEY_LABEL_INVALID`); `_homeFolderId` is missing or does not exist in
+            this environment (`FILESERVER_HOME_FOLDER_NOT_FOUND`) or is a file rather than an
+            active folder (`FILESERVER_HOME_FOLDER_NOT_FOLDER`).
           content:
             application/json:
               schema:
@@ -563,17 +628,22 @@ paths:
                     errors:
                       - code: FILESERVER_USERNAME_INVALID
                         message: Username must be 3-32 lowercase letters, digits or hyphens, with no leading or trailing hyphen
-                passwordMissing:
+                noCredential:
                   value:
                     errors:
                       - code: FILESERVER_LAST_CREDENTIAL
-                        message: An enabled account must have a password
+                        message: An enabled account must have a password or at least one SSH key
                 weakPassword:
                   summary: Password shorter than 12 characters
                   value:
                     errors:
                       - code: FILESERVER_WEAK_PASSWORD
                         message: "Password is too weak.\n\t1. Password must have at least 12 characters."
+                keyTypeUnsupported:
+                  value:
+                    errors:
+                      - code: FILESERVER_KEY_TYPE_UNSUPPORTED
+                        message: Unsupported key type; use ssh-ed25519, ecdsa-sha2-nistp256/384/521, or ssh-rsa
                 homeFolderMissing:
                   value:
                     errors:
@@ -610,9 +680,10 @@ paths:
       summary: Get a file server account
       description: |-
         Returns one partner account with `overCap` computed against the current cap.
-        An id that is unknown, belongs to another environment, or is not a valid
-        identifier all answer the same 404. Requires a full-access API token and a
-        server that has been enabled at least once.
+        This is the only route that includes each key's `publicKey` in `sshKeys`. An id
+        that is unknown, belongs to another environment, or is not a valid identifier
+        all answer the same 404. Requires a full-access API token and a server that has
+        been enabled at least once.
       parameters:
         - $ref: '#/components/parameters/AccountId'
       responses:
@@ -632,10 +703,21 @@ paths:
                     homeFolderPath: /Partners/Northwind/Inbound
                     enabled: true
                     passwordSet: true
+                    permissions:
+                      read: true
+                      create: true
+                      modify: false
+                      delete: false
+                    sshKeys:
+                      - label: acme prod
+                        fingerprint: SHA256:Yk3Qx2qkJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1wE
+                        algorithm: ssh-ed25519
+                        addedAt: '2026-10-01T09:14:02.511Z'
+                        publicKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ9rT5bU4xJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1
                     overCap: false
                     lastConnectedAt: '2026-09-22T14:35:31.646Z'
                     createdAt: '2026-09-22T03:13:56.060Z'
-                    lastModified: '2026-09-22T14:35:31.648Z'
+                    lastModified: '2026-10-01T09:14:02.511Z'
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '403':
@@ -656,11 +738,12 @@ paths:
         Renaming keeps `_id` and updates `login`. Moving the home folder is verified
         against Celigo Storage, ends the account's open sessions (as does disabling
         it), and shifts the delete protection from the old folder to the new one.
-        Re-enabling counts against `limits.maxAccounts` and requires a password to be
-        set. The password cannot be changed here — use
-        `POST /v1/mft/fileserver/accounts/{_id}/password`. Requires a full-access API
-        token, the file server add-on on the license, and a server that has been
-        enabled at least once.
+        Re-enabling counts against `limits.maxAccounts` and requires a password or at
+        least one SSH key. Sending `permissions` replaces the whole set of toggles; the
+        partner's open sessions pick the new set up without being ended. The password
+        and the keys cannot be changed here — use the `password` and `sshKeys` routes.
+        Requires a full-access API token, the file server add-on on the license, and a
+        server that has been enabled at least once.
       parameters:
         - $ref: '#/components/parameters/AccountId'
       requestBody:
@@ -682,6 +765,14 @@ paths:
                 summary: Move to another folder
                 value:
                   _homeFolderId: 6ac5e3371ddaae28c1fea86e
+              dropBox:
+                summary: Make the account a write-only drop box
+                value:
+                  permissions:
+                    read: false
+                    create: true
+                    modify: false
+                    delete: false
       responses:
         '200':
           description: The account after the change.
@@ -699,10 +790,35 @@ paths:
                     homeFolderPath: /Partners/Northwind/Inbound
                     enabled: false
                     passwordSet: true
+                    permissions:
+                      read: true
+                      create: true
+                      modify: false
+                      delete: false
+                    sshKeys: []
                     overCap: false
                     lastConnectedAt: '2026-09-22T14:35:31.646Z'
                     createdAt: '2026-09-22T03:13:56.060Z'
                     lastModified: '2026-09-25T01:40:12.004Z'
+                dropBox:
+                  value:
+                    _id: 6ab1f2737cf630a06d774d09
+                    username: northwind-edi
+                    login: northwind-edi@acme-logistics
+                    _homeFolderId: 6ab1f25daa3e7ed226ea3f25
+                    homeFolderPath: /Partners/Northwind/Inbound
+                    enabled: true
+                    passwordSet: true
+                    permissions:
+                      read: false
+                      create: true
+                      modify: false
+                      delete: false
+                    sshKeys: []
+                    overCap: false
+                    lastConnectedAt: '2026-09-22T14:35:31.646Z'
+                    createdAt: '2026-09-22T03:13:56.060Z'
+                    lastModified: '2026-10-01T09:20:44.318Z'
         '400':
           description: The body is not a JSON object sent as `application/json` (`FILESERVER_JSON_BODY_REQUIRED`).
           content:
@@ -722,7 +838,8 @@ paths:
             The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`);
             the license lacks the add-on or the environment is a sandbox
             (`FILESERVER_NOT_ENTITLED`); or re-enabling would exceed `limits.maxAccounts`
-            (`FILESERVER_MAX_ACCOUNTS_EXCEEDED`). A personal access token is refused the same way as a scoped token, and a manage, monitor or integration-level user gets `access_restricted`: only the owner and administrators manage the file server.
+            (`FILESERVER_MAX_ACCOUNTS_EXCEEDED`). A personal access token is refused the
+            same way as a scoped token, and a monitor user gets `access_restricted`.
           content:
             application/json:
               schema:
@@ -734,7 +851,7 @@ paths:
                       - code: FILESERVER_MAX_ACCOUNTS_EXCEEDED
                         message: The maximum number of enabled accounts for this environment has been reached
                 notAdministrator:
-                  summary: A manage, monitor or integration-level user
+                  summary: A monitor user
                   value:
                     errors:
                       - code: access_restricted
@@ -757,9 +874,11 @@ paths:
           description: |-
             The server has never been enabled (`FILESERVER_NOT_ENABLED`); `username` is
             malformed (`FILESERVER_USERNAME_INVALID`); `enabled` is present but not a
-            boolean (`FILESERVER_ENABLED_REQUIRED`); re-enabling an account with no
-            password (`FILESERVER_LAST_CREDENTIAL`); or the new home folder does not exist
-            or is not an active folder (`FILESERVER_HOME_FOLDER_NOT_FOUND`,
+            boolean (`FILESERVER_ENABLED_REQUIRED`); `permissions` is present but not an
+            object with exactly the four boolean toggles (`FILESERVER_PERMISSIONS_INVALID`);
+            re-enabling an account that has neither a password nor a key
+            (`FILESERVER_LAST_CREDENTIAL`); or the new home folder does not exist or is
+            not an active folder (`FILESERVER_HOME_FOLDER_NOT_FOUND`,
             `FILESERVER_HOME_FOLDER_NOT_FOLDER`).
           content:
             application/json:
@@ -771,11 +890,16 @@ paths:
                     errors:
                       - code: FILESERVER_ENABLED_REQUIRED
                         message: '"enabled" is required and must be a boolean'
-                noPassword:
+                permissionsInvalid:
+                  value:
+                    errors:
+                      - code: FILESERVER_PERMISSIONS_INVALID
+                        message: permissions must be an object with exactly read, create, modify and delete as booleans
+                noCredential:
                   value:
                     errors:
                       - code: FILESERVER_LAST_CREDENTIAL
-                        message: An enabled account must have a password
+                        message: An enabled account must have a password or at least one SSH key
                 homeFolderIsFile:
                   value:
                     errors:
@@ -832,12 +956,14 @@ paths:
       summary: Set or clear an account's password
       description: |-
         Sets a new password for the partner account, or clears it when `password` is
-        `null`. Clearing is refused while the account is enabled, because an enabled
-        account must keep a credential — disable it first. Either change ends the
-        account's open sessions and stamps the change for session revalidation. The
-        route answers 204 and never echoes a credential; `passwordSet` on the account
-        reflects the result. Requires a full-access API token, the file server add-on on
-        the license, and a server that has been enabled at least once.
+        `null`. Clearing is refused when it would leave an enabled account with no
+        credential at all — disable the account or register an SSH key first; an
+        account that still has a key can drop its password while enabled. Either
+        change ends the account's open sessions and stamps the change for session
+        revalidation. The route answers 204 and never echoes a credential;
+        `passwordSet` on the account reflects the result. Requires a full-access API
+        token, the file server add-on on the license, and a server that has been enabled
+        at least once.
       parameters:
         - $ref: '#/components/parameters/AccountId'
       requestBody:
@@ -852,7 +978,7 @@ paths:
                 value:
                   password: Nw-Inbound-2026!y
               clear:
-                summary: Clear the password of a disabled account
+                summary: Clear the password (account disabled, or keys registered)
                 value:
                   password: null
       responses:
@@ -881,7 +1007,7 @@ paths:
             The server has never been enabled (`FILESERVER_NOT_ENABLED`); the new password
             breaks the policy or `password` is neither a string nor `null`
             (`FILESERVER_WEAK_PASSWORD` — the message names the rule); or `null` was sent
-            for an enabled account (`FILESERVER_LAST_CREDENTIAL`).
+            for an enabled account that has no SSH key (`FILESERVER_LAST_CREDENTIAL`).
           content:
             application/json:
               schema:
@@ -896,7 +1022,127 @@ paths:
                   value:
                     errors:
                       - code: FILESERVER_LAST_CREDENTIAL
-                        message: An enabled account must have a password
+                        message: An enabled account must have a password or at least one SSH key
+  /v1/mft/fileserver/accounts/{_id}/sshKeys:
+    post:
+      x-internal: false
+      operationId: addFileServerAccountSshKey
+      tags:
+        - File Server
+      summary: Add an SSH public key to an account
+      description: |-
+        Registers one OpenSSH public key on the partner account and returns the account
+        with the new entry in `sshKeys`, its `fingerprint` computed by the server. The
+        partner can log in with the matching private key from the next connection on;
+        sessions already open are not affected, and the account's password, if any,
+        keeps working alongside the keys. An account holds at most 10 keys. Requires a
+        full-access API token, the file server add-on on the license, and a server that
+        has been enabled at least once.
+      parameters:
+        - $ref: '#/components/parameters/AccountId'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/FileServerAccountSshKeyRequest'
+            examples:
+              default:
+                value:
+                  label: acme prod
+                  publicKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ9rT5bU4xJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1 acme-prod
+      responses:
+        '201':
+          description: The account with the key added.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/FileServerAccount'
+              examples:
+                default:
+                  value:
+                    _id: 6ab1f2737cf630a06d774d09
+                    username: northwind-edi
+                    login: northwind-edi@acme-logistics
+                    _homeFolderId: 6ab1f25daa3e7ed226ea3f25
+                    homeFolderPath: /Partners/Northwind/Inbound
+                    enabled: true
+                    passwordSet: true
+                    permissions:
+                      read: true
+                      create: true
+                      modify: false
+                      delete: false
+                    sshKeys:
+                      - label: acme prod
+                        fingerprint: SHA256:Yk3Qx2qkJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1wE
+                        algorithm: ssh-ed25519
+                        addedAt: '2026-10-01T09:14:02.511Z'
+                    overCap: false
+                    lastConnectedAt: '2026-09-22T14:35:31.646Z'
+                    createdAt: '2026-09-22T03:13:56.060Z'
+                    lastModified: '2026-10-01T09:14:02.511Z'
+        '400':
+          description: The body is not a JSON object sent as `application/json` (`FILESERVER_JSON_BODY_REQUIRED`). A body that is not valid JSON at all is refused by the platform's request parser with code `entity.parse.failed`.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                notJson:
+                  value:
+                    errors:
+                      - code: FILESERVER_JSON_BODY_REQUIRED
+                        message: 'Request body must be a JSON object sent with Content-Type: application/json'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-full-access-required'
+        '404':
+          $ref: '#/components/responses/404-account-not-found'
+        '422':
+          $ref: '#/components/responses/422-ssh-key-rejected'
+  /v1/mft/fileserver/accounts/{_id}/sshKeys/{fingerprint}:
+    delete:
+      x-internal: false
+      operationId: removeFileServerAccountSshKey
+      tags:
+        - File Server
+      summary: Remove an SSH public key from an account
+      description: |-
+        Removes the key with this fingerprint from the partner account and ends any
+        session the account has open, so a revoked key stops working at once. The route
+        answers 204 with no body — read the account to see the remaining keys. The last
+        key of an enabled account that has no password cannot be removed, because an
+        enabled account must keep a credential; disable the account or set a password
+        first. Requires a full-access API token, the file server add-on on the license,
+        and a server that has been enabled at least once.
+      parameters:
+        - $ref: '#/components/parameters/AccountId'
+        - $ref: '#/components/parameters/SshKeyFingerprint'
+      responses:
+        '204':
+          description: Key removed. No body.
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-full-access-required'
+        '404':
+          $ref: '#/components/responses/404-key-not-found'
+        '422':
+          description: |-
+            The server has never been enabled (`FILESERVER_NOT_ENABLED`), or this is the
+            only credential left on an enabled account (`FILESERVER_LAST_CREDENTIAL`).
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                lastCredential:
+                  value:
+                    errors:
+                      - code: FILESERVER_LAST_CREDENTIAL
+                        message: An enabled account must have a password or at least one SSH key
 components:
   securitySchemes:
     bearerAuth:
@@ -1168,15 +1414,119 @@ components:
           FILESERVER_ENABLED_REQUIRED, and a non-JSON body fails with 400
           FILESERVER_JSON_BODY_REQUIRED. Never send a new identifier for an existing server —
           it is rejected with 422 FILESERVER_IDENTIFIER_IMMUTABLE even when enabled is unchanged.
+    FileServerAccountPermissions:
+      type: object
+      description: |-
+        Which SFTP operations the account may perform inside its home folder. Stored
+        and returned as a whole — all four toggles together — and absent on accounts
+        created before the toggles existed. New accounts are created with `read` and
+        `create` on and `modify` and `delete` off. Changing the toggles takes effect on
+        the account's open sessions without ending them. Every refused operation
+        reaches the partner as the SFTP "Permission denied" status.
+      required:
+        - read
+        - create
+        - modify
+        - delete
+      properties:
+        read:
+          type: boolean
+          description: When true, the partner can list folders and download files.
+          examples:
+            - true
+        create:
+          type: boolean
+          description: |-
+            When true, the partner can upload to a new name and create folders, and can
+            overwrite or rename a file it uploaded itself — so an upload-then-rename
+            client pattern works in a drop box that has no `modify`.
+          examples:
+            - true
+        modify:
+          type: boolean
+          description: When true, the partner can overwrite and rename any file or folder in the home folder, not only its own uploads.
+          examples:
+            - false
+        delete:
+          type: boolean
+          description: When true, the partner can delete files and remove folders, including non-empty ones.
+          examples:
+            - false
+    FileServerSshKey:
+      type: object
+      description: |-
+        One SSH public key registered on a partner account. The server computes
+        `fingerprint` when the key is added; the key is matched by it on login and
+        addressed by it when removed.
+      required:
+        - label
+        - fingerprint
+        - algorithm
+        - addedAt
+      properties:
+        label:
+          type:
+            - string
+            - 'null'
+          readOnly: true
+          description: Admin-chosen name for the key, as stored after HTML markup and control characters were removed. Null when none was given.
+          examples:
+            - acme prod
+        fingerprint:
+          type: string
+          readOnly: true
+          description: |-
+            SHA-256 fingerprint in OpenSSH `SHA256:<base64>` form, as `ssh-keygen -lf`
+            prints it. To remove the key, send the part after `SHA256:` in the URL with
+            `+` and `/` replaced by `-` and `_` (base64url, no padding).
+          examples:
+            - SHA256:Yk3Qx2qkJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1wE
+        algorithm:
+          type: string
+          readOnly: true
+          description: Key type from the public key line.
+          enum:
+            - ssh-ed25519
+            - ecdsa-sha2-nistp256
+            - ecdsa-sha2-nistp384
+            - ecdsa-sha2-nistp521
+            - ssh-rsa
+          x-enumDescriptions:
+            ssh-ed25519: Ed25519 key
+            ecdsa-sha2-nistp256: ECDSA key on the NIST P-256 curve
+            ecdsa-sha2-nistp384: ECDSA key on the NIST P-384 curve
+            ecdsa-sha2-nistp521: ECDSA key on the NIST P-521 curve
+            ssh-rsa: RSA key of at least 2048 bits
+          examples:
+            - ssh-ed25519
+        addedAt:
+          type: string
+          format: date-time
+          readOnly: true
+          description: Timestamp when the key was registered on the account.
+          examples:
+            - '2026-10-01T09:14:02.511Z'
+        publicKey:
+          type: string
+          readOnly: true
+          description: |-
+            The registered public key as an OpenSSH line (`<type> <base64>`), for the
+            admin to verify with the partner. Returned only by
+            `GET /v1/mft/fileserver/accounts/{_id}`; list and write responses carry the
+            metadata fields only.
+          examples:
+            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ9rT5bU4xJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1
     FileServerAccount:
       type: object
       description: |-
         A partner login on the environment's file server. The partner authenticates as
-        `login` with the password set through `POST /v1/mft/fileserver/accounts/{_id}/password`
-        (never returned — `passwordSet` only says whether one exists) and sees the
-        Celigo Storage folder `_homeFolderId` as the root of the session. Disabling the
-        account, deleting it, changing its password, or moving its home folder ends any
-        session it has open.
+        `login` with a password (set through `POST /v1/mft/fileserver/accounts/{_id}/password`,
+        never returned — `passwordSet` only says whether one exists) or with one of the
+        SSH public keys in `sshKeys`, and sees the Celigo Storage folder `_homeFolderId`
+        as the root of the session. `permissions` says which SFTP operations the account
+        may perform inside that folder. Disabling the account, deleting it, changing its
+        password, removing one of its keys, or moving its home folder ends any session
+        it has open; adding a key or changing `permissions` does not.
       required:
         - _id
         - username
@@ -1184,6 +1534,7 @@ components:
         - _homeFolderId
         - enabled
         - passwordSet
+        - sshKeys
         - overCap
         - createdAt
         - lastModified
@@ -1242,10 +1593,10 @@ components:
         enabled:
           type: boolean
           description: |-
-            When true, the partner can log in. Disabling keeps the account and its password
-            but refuses logins and ends open sessions; re-enabling counts against
-            `limits.maxAccounts` and requires a password to be set (422
-            `FILESERVER_LAST_CREDENTIAL` otherwise). New accounts start enabled.
+            When true, the partner can log in. Disabling keeps the account, its password and
+            its keys but refuses logins and ends open sessions; re-enabling counts against
+            `limits.maxAccounts` and requires a credential — a password or at least one SSH
+            key (422 `FILESERVER_LAST_CREDENTIAL` otherwise). New accounts start enabled.
           examples:
             - true
         passwordSet:
@@ -1254,9 +1605,28 @@ components:
           description: |-
             When true, the account has a password. The password itself is never returned by
             any route; change or clear it through `POST /v1/mft/fileserver/accounts/{_id}/password`.
-            Clearing is allowed only while the account is disabled.
+            Clearing is allowed while the account is disabled or while it still has at
+            least one SSH key.
           examples:
             - true
+        permissions:
+          $ref: '#/components/schemas/FileServerAccountPermissions'
+        sshKeys:
+          type: array
+          readOnly: true
+          description: |-
+            SSH public keys the partner may authenticate with, newest last. Managed through
+            `POST /v1/mft/fileserver/accounts/{_id}/sshKeys` and
+            `DELETE /v1/mft/fileserver/accounts/{_id}/sshKeys/{fingerprint}`, or seeded with
+            `sshKey` on create; always present, empty for a password-only account. Each
+            entry's `publicKey` is included only on `GET /v1/mft/fileserver/accounts/{_id}`.
+          items:
+            $ref: '#/components/schemas/FileServerSshKey'
+          examples:
+            - - label: acme prod
+                fingerprint: SHA256:Yk3Qx2qkJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1wE
+                algorithm: ssh-ed25519
+                addedAt: '2026-10-01T09:14:02.511Z'
         overCap:
           type: boolean
           readOnly: true
@@ -1290,18 +1660,70 @@ components:
           description: Timestamp of the last change to the account, including logins updating `lastConnectedAt`.
           examples:
             - '2026-09-22T14:35:31.648Z'
+    FileServerAccountSshKeyRequest:
+      type: object
+      description: |-
+        An SSH public key to register — the body of
+        `POST /v1/mft/fileserver/accounts/{_id}/sshKeys`, and the `sshKey` value on
+        create. The key is parsed, checked against the allowed types and sizes, and
+        stored with its server-computed fingerprint; the comment at the end of the
+        line is not kept. A missing `publicKey` answers 422 `FILESERVER_KEY_INVALID`, a
+        key already on the account 422 `FILESERVER_KEY_DUPLICATE`, and an eleventh key
+        422 `FILESERVER_KEY_LIMIT`; none of these change the account.
+      required:
+        - publicKey
+      properties:
+        publicKey:
+          type: string
+          description: |-
+            One OpenSSH public key line: the type, a space, and the base64 blob, with an
+            optional trailing comment (`ssh-ed25519 AAAA... partner@host`). Accepted
+            types are `ssh-ed25519`, `ecdsa-sha2-nistp256`/`384`/`521`, and `ssh-rsa` with a
+            modulus of at least 2048 bits; `ssh-dss` and other types answer 422
+            `FILESERVER_KEY_TYPE_UNSUPPORTED`, a smaller RSA key 422 `FILESERVER_KEY_TOO_WEAK`,
+            and anything that does not parse 422 `FILESERVER_KEY_INVALID`.
+          examples:
+            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ9rT5bU4xJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1 acme-prod
+        label:
+          type: string
+          maxLength: 1024
+          description: |-
+            Optional admin-chosen name shown with the key. HTML markup and control
+            characters are removed before it is stored; a value that is not a string, longer
+            than 1024 characters as sent, or empty or longer than 256 characters once
+            cleaned, answers 422 `FILESERVER_KEY_LABEL_INVALID`. When absent the key is
+            stored without a label.
+          examples:
+            - acme prod
+      x-celigo-ai-guidance:
+        - |-
+          Send the whole OpenSSH public key line (type, space, base64 blob, optional comment) as
+          one string in publicKey. A bare base64 blob without the type, a PEM "BEGIN PUBLIC KEY"
+          block, or a missing publicKey answers 422 FILESERVER_KEY_INVALID. A key already on the
+          account answers 422 FILESERVER_KEY_DUPLICATE (not 409), even with a different comment,
+          and an eleventh key 422 FILESERVER_KEY_LIMIT; neither changes the account.
     FileServerAccountCreateRequest:
       type: object
       description: |-
         Body of `POST /v1/mft/fileserver/accounts`. The account is created enabled, so
-        all three fields are needed for a partner to be able to log in. Checks run in
-        this order and the first failure is returned: `username` shape, `password`
-        presence, `_homeFolderId` presence, the enabled-account cap, then the folder's
-        existence and type in this environment.
+        it needs a credential the partner can log in with: a `password`, an `sshKey`,
+        or both. Checks run in this order and the first failure is returned: `username`
+        shape, credential presence, `password` type, `sshKey` validity, `_homeFolderId`
+        presence, the enabled-account cap, the folder's existence and type in this
+        environment, then `password` strength. The new account gets the default
+        `permissions` (`read` and `create` on, `modify` and `delete` off); a
+        `permissions` object in this body is ignored — set it afterwards with
+        `PUT /v1/mft/fileserver/accounts/{_id}`.
       required:
         - username
-        - password
         - _homeFolderId
+      if:
+        not:
+          required:
+            - sshKey
+      then:
+        required:
+          - password
       properties:
         username:
           type: string
@@ -1322,11 +1744,14 @@ components:
           description: |-
             Partner's password. Needs upper- and lower-case letters, a digit, and a symbol;
             anything weaker is rejected with 422 `FILESERVER_WEAK_PASSWORD` and the message
-            lists every rule broken. A non-string value counts as no password at all (422
-            `FILESERVER_LAST_CREDENTIAL`). Never returned by any route — rotate or clear it
-            later through `POST /v1/mft/fileserver/accounts/{_id}/password`.
+            lists every rule broken. Any other non-null type answers 422
+            `FILESERVER_WEAK_PASSWORD` ("Password must be a string."). Optional when `sshKey`
+            is sent. Never returned by any route — rotate or clear it later through
+            `POST /v1/mft/fileserver/accounts/{_id}/password`.
           examples:
             - Nw-Inbound-2026!x
+        sshKey:
+          $ref: '#/components/schemas/FileServerAccountSshKeyRequest'
         _homeFolderId:
           type: string
           format: objectId
@@ -1341,10 +1766,10 @@ components:
             - 6ab1f25daa3e7ed226ea3f25
       x-celigo-ai-guidance:
         - |-
-          Send username, password and _homeFolderId together. A missing username answers 422
-          FILESERVER_USERNAME_INVALID (same code as a malformed one), a missing password 422
-          FILESERVER_LAST_CREDENTIAL, and a missing _homeFolderId 422
-          FILESERVER_HOME_FOLDER_NOT_FOUND — each before anything is created.
+          Send username, _homeFolderId and at least one credential: password, sshKey, or both. A
+          missing username answers 422 FILESERVER_USERNAME_INVALID (same code as a malformed one),
+          a body with neither password nor sshKey 422 FILESERVER_LAST_CREDENTIAL, and a missing
+          _homeFolderId 422 FILESERVER_HOME_FOLDER_NOT_FOUND — each before anything is created.
         - |-
           Send _homeFolderId as the 24-character hex _id returned by POST /v1/storage/items. A
           malformed value is not a 422: it fails the storage lookup and answers 503
@@ -1356,7 +1781,8 @@ components:
       description: |-
         Body of `PUT /v1/mft/fileserver/accounts/{_id}`. Partial: only the fields sent
         change, and an empty object is a no-op that returns the current account. The
-        password is not part of this body — use the dedicated password route.
+        password and the SSH keys are not part of this body — use the dedicated
+        password and `sshKeys` routes.
       properties:
         username:
           type: string
@@ -1384,10 +1810,19 @@ components:
             Must be a JSON boolean when present (422 `FILESERVER_ENABLED_REQUIRED` for
             `"false"` or other non-booleans). False keeps the account but refuses logins
             and ends open sessions. True re-enables it — subject to `limits.maxAccounts`
-            (403 `FILESERVER_MAX_ACCOUNTS_EXCEEDED`) and only if a password is set (422
-            `FILESERVER_LAST_CREDENTIAL`).
+            (403 `FILESERVER_MAX_ACCOUNTS_EXCEEDED`) and only if the account has a
+            password or at least one SSH key (422 `FILESERVER_LAST_CREDENTIAL`).
           examples:
             - false
+        permissions:
+          $ref: '#/components/schemas/FileServerAccountPermissions'
+      x-celigo-ai-guidance:
+        - |-
+          permissions is all-or-nothing: send all four of read, create, modify and delete as JSON
+          booleans, or leave the key out. A partial object, a non-boolean value, an extra key, an
+          empty object, null or an array answers 422 FILESERVER_PERMISSIONS_INVALID and changes
+          nothing; sending the object the account already has returns 200 without touching
+          lastModified.
     FileServerAccountPasswordRequest:
       type: object
       description: |-
@@ -1405,10 +1840,11 @@ components:
           description: |-
             The new password, meeting the same policy as on create (422
             `FILESERVER_WEAK_PASSWORD` otherwise), or `null` to remove the password —
-            allowed only while the account is disabled, because an enabled account must
-            keep a credential (422 `FILESERVER_LAST_CREDENTIAL`). Any other type, or an
-            empty body, answers 422 `FILESERVER_WEAK_PASSWORD` with the message "Password
-            must be a string (or null to clear)."
+            allowed while the account is disabled or still has at least one SSH key,
+            because an enabled account must keep a credential (422
+            `FILESERVER_LAST_CREDENTIAL`). Any other type, or an empty body, answers 422
+            `FILESERVER_WEAK_PASSWORD` with the message "Password must be a string (or
+            null to clear)."
           examples:
             - Nw-Inbound-2026!y
   responses:
@@ -1451,8 +1887,7 @@ components:
         The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`) --
         a scoped API token, or any personal access token, which never counts as full access --
         or the license lacks the add-on / the environment is a sandbox (`FILESERVER_NOT_ENTITLED`).
-        A manage, monitor or integration-level user is refused with `access_restricted`: only the
-        account owner and administrators manage the file server.
+        A monitor user is refused with `access_restricted`.
       content:
         application/json:
           schema:
@@ -1464,7 +1899,7 @@ components:
                   - code: FILESERVER_FULL_ACCESS_TOKEN_REQUIRED
                     message: The file server management APIs require an API token with full access
             notAdministrator:
-              summary: A manage, monitor or integration-level user
+              summary: A monitor user
               value:
                 errors:
                   - code: access_restricted
@@ -1493,6 +1928,71 @@ components:
                 errors:
                   - code: FILESERVER_NOT_ENABLED
                     message: Enable the file server before managing accounts
+    422-ssh-key-rejected:
+      description: |-
+        The server has never been enabled (`FILESERVER_NOT_ENABLED`); the key line does not
+        parse (`FILESERVER_KEY_INVALID`); its type is not `ssh-ed25519`, `ecdsa-sha2-nistp256`,
+        `ecdsa-sha2-nistp384`, `ecdsa-sha2-nistp521` or `ssh-rsa` (`FILESERVER_KEY_TYPE_UNSUPPORTED`);
+        an RSA key is under 2048 bits (`FILESERVER_KEY_TOO_WEAK`); the same key is already on
+        the account (`FILESERVER_KEY_DUPLICATE`); the account already holds 10 keys
+        (`FILESERVER_KEY_LIMIT`); or `label` is not a string, or is empty or over 256
+        characters once markup is removed (`FILESERVER_KEY_LABEL_INVALID`). Nothing is stored.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            unparseable:
+              value:
+                errors:
+                  - code: FILESERVER_KEY_INVALID
+                    message: The public key could not be parsed; supply an OpenSSH public key line (e.g. "ssh-ed25519 AAAA... comment")
+            unsupportedType:
+              value:
+                errors:
+                  - code: FILESERVER_KEY_TYPE_UNSUPPORTED
+                    message: Unsupported key type; use ssh-ed25519, ecdsa-sha2-nistp256/384/521, or ssh-rsa
+            rsaTooSmall:
+              value:
+                errors:
+                  - code: FILESERVER_KEY_TOO_WEAK
+                    message: RSA keys must be at least 2048 bits
+            duplicate:
+              value:
+                errors:
+                  - code: FILESERVER_KEY_DUPLICATE
+                    message: This public key is already registered on the account
+            limitReached:
+              value:
+                errors:
+                  - code: FILESERVER_KEY_LIMIT
+                    message: The maximum number of SSH keys for this account has been reached
+            labelInvalid:
+              value:
+                errors:
+                  - code: FILESERVER_KEY_LABEL_INVALID
+                    message: Key label must be a non-empty string of at most 256 characters (HTML markup and control characters are removed)
+    404-key-not-found:
+      description: |-
+        No key with this fingerprint on the account, or the fingerprint is not in URL form
+        (`FILESERVER_KEY_NOT_FOUND`) — a standard base64 fingerprint that contains `/` splits
+        the path and answers `ROUTE_NOT_SUPPORTED` instead; or no account with this id in the
+        caller's environment (`FILESERVER_ACCOUNT_NOT_FOUND`).
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            keyNotFound:
+              value:
+                errors:
+                  - code: FILESERVER_KEY_NOT_FOUND
+                    message: No SSH key with that fingerprint is registered on the account
+            accountNotFound:
+              value:
+                errors:
+                  - code: FILESERVER_ACCOUNT_NOT_FOUND
+                    message: File server account not found
   parameters:
     AccountId:
       name: _id
@@ -1504,5 +2004,19 @@ components:
         format: objectId
         examples:
           - 6ab1f2737cf630a06d774d09
+    SshKeyFingerprint:
+      name: fingerprint
+      in: path
+      required: true
+      description: |-
+        The key's SHA-256 fingerprint in URL form: the 43 characters after `SHA256:`
+        in the stored fingerprint, with `+` and `/` replaced by `-` and `_` (base64url,
+        no padding). A value in any other shape, or one that matches no key on the
+        account, answers 404.
+      schema:
+        type: string
+        pattern: ^[A-Za-z0-9_-]{43}$
+        examples:
+          - Yk3Qx2qkJm0d7oM4g0a9Z2m1b9lM7sN4hR8pT6uV1wE
 x-internal: false
 x-enable-proxy: true