Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Termix-SSH/Termix/llms.txt

Use this file to discover all available pages before exploring further.

The Credentials API manages reusable SSH authentication credentials — either a username/password pair or an SSH key pair. Once saved, a credential can be applied to one or many hosts, simplifying rotation and access control. The API also provides utility endpoints for generating, parsing, and validating SSH keys without persisting them.
All endpoints require a valid jwt session cookie or Authorization: Bearer <token> header. Secret fields (password, key, keyPassword, privateKey) are stripped from list responses; use GET /credentials/:id to retrieve them.

​
Credential CRUD

​
POST /credentials

Create a new credential. The credential is encrypted with the user’s data key before storage.
​
name
string
required
Human-readable label (e.g. Production SSH key).
​
authType
string
required
Authentication type: password or key.
​
username
string
Login username associated with this credential.
​
password
string
Password value. Required when authType is password.
​
key
string
PEM-encoded SSH private key. Required when authType is key. Must include -----BEGIN and -----END headers.
​
keyPassword
string
Passphrase for an encrypted SSH private key.
​
keyType
string
Algorithm hint (e.g. ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256). Auto-detected when omitted.
​
description
string
Optional free-text description.
​
folder
string
Folder name for grouping credentials.
​
tags
string[]
Array of tag strings.
​
id
number
Auto-assigned credential ID.
​
name
string
​
authType
string
password or key.
​
username
string
​
publicKey
string
Derived public key (key credentials only).
​
keyType
string
Algorithm label supplied at creation.
​
detectedKeyType
string
Auto-detected algorithm from key parsing.
​
usageCount
number
Number of times this credential has been applied to a host.
​
lastUsed
string
ISO 8601 timestamp of last usage, or null.
​
createdAt
string
​
updatedAt
string
StatusMeaning
201Credential created; sanitized object returned.
400name missing, invalid authType, missing secret, or invalid SSH key.
500Database or encryption error.
curl -X POST https://your-termix-instance/credentials \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{
    "name": "Prod server cred",
    "authType": "password",
    "username": "ubuntu",
    "password": "s3cr3t!"
  }'

​
GET /credentials

Return all credentials for the authenticated user, ordered by most recently updated. Secret fields are omitted.
object[]
Array of sanitized credential objects (same shape as the POST /credentials response, without password, key, keyPassword, or privateKey).
StatusMeaning
200Credential list returned.
400Invalid session.
500Database error.
curl https://your-termix-instance/credentials \
  -b cookies.txt

​
GET /credentials/:id

Return a single credential by ID, including the secret fields (password, key, privateKey, publicKey, keyPassword).
​
id
number
required
Credential ID.
StatusMeaning
200Full credential object returned.
400Invalid request.
404Credential not found (or not owned by caller).
500Database or decryption error.
curl https://your-termix-instance/credentials/7 \
  -b cookies.txt

​
PUT /credentials/:id

Update fields on an existing credential. Only fields present in the request body are changed.
​
id
number
required
Credential ID.
​
name
string
New label.
​
description
string
Updated description.
​
folder
string
Folder assignment.
​
tags
string[]
Replacement tag array.
​
username
string
Updated login username.
​
authType
string
Updated auth type (password or key).
​
password
string
New password value.
​
key
string
New PEM-encoded private key. Triggers re-parsing to update publicKey and detectedKeyType.
​
keyPassword
string
New key passphrase.
​
keyType
string
Updated algorithm hint.
After a successful update, any hosts using this credential via sharing have their shared copies re-encrypted automatically.
StatusMeaning
200Updated credential returned (sanitized).
400Invalid request or malformed key.
404Credential not found.
500Update or re-encryption error.
curl -X PUT https://your-termix-instance/credentials/7 \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{"name": "Updated label", "username": "ubuntu2"}'

​
DELETE /credentials/:id

Delete a credential. Any hosts that were using this credential have their credentialId, password, key, and keyPassword cleared, and any host-sharing grants for those hosts are revoked.
​
id
number
required
Credential ID.
StatusMeaning
200Credential deleted.
400Invalid request.
404Credential not found.
500Database error.
curl -X DELETE https://your-termix-instance/credentials/7 \
  -b cookies.txt

​
Host application

​
POST /credentials/:id/apply-to-host/:hostId

Apply a credential to a host. Sets the host’s credentialId, clears any inline password/key, and records usage statistics.
​
id
number
required
Credential ID.
​
hostId
number
required
Host ID to apply the credential to.
StatusMeaning
200Credential applied.
400Invalid request.
404Credential not found.
500Database error.
curl -X POST https://your-termix-instance/credentials/7/apply-to-host/42 \
  -b cookies.txt

​
GET /credentials/:id/hosts

Return a list of all hosts currently using this credential.
​
id
number
required
Credential ID.
object[]
Array of host objects with fields: id, userId, name, ip, port, username, folder, tags, pin, authType, enableTerminal, enableTunnel, tunnelConnections, enableFileManager, defaultPath, createdAt, updatedAt.
StatusMeaning
200Host list returned.
400Invalid request.
500Database error.
curl https://your-termix-instance/credentials/7/hosts \
  -b cookies.txt

​
Folders

​
GET /credentials/folders

Return all folder names that contain at least one credential for the authenticated user.
string[]
Array of non-empty folder name strings.
StatusMeaning
200Folder list returned.
400Invalid session.
500Database error.
curl https://your-termix-instance/credentials/folders \
  -b cookies.txt

​
PUT /credentials/folders/rename

Rename a credential folder. Updates all credentials in that folder.
​
oldName
string
required
Current folder name.
​
newName
string
required
New folder name. Must differ from oldName.
StatusMeaning
200Folder renamed.
400Missing names, or oldName equals newName.
500Database error.
curl -X PUT https://your-termix-instance/credentials/folders/rename \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{"oldName": "Staging", "newName": "Pre-prod"}'

​
SSH key utilities

The following endpoints operate on raw key material without persisting anything to the database. They are useful for validating or inspecting keys before storing them as credentials.

​
POST /credentials/detect-key-type

Parse an SSH private key and detect its algorithm.
​
privateKey
string
required
PEM-encoded SSH private key.
​
keyPassword
string
Passphrase if the key is encrypted.
​
success
boolean
true when the key was parsed successfully.
​
keyType
string
Detected algorithm (e.g. ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256).
​
detectedKeyType
string
Same value as keyType.
​
hasPublicKey
boolean
Whether a public key was derived from the private key.
​
error
string
Error message when success is false.
StatusMeaning
200Detection result returned (check success field).
400privateKey is missing.
500Unexpected parsing error.
curl -X POST https://your-termix-instance/credentials/detect-key-type \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{
    "privateKey": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----"
  }'

​
POST /credentials/detect-public-key-type

Parse an SSH public key and detect its algorithm.
​
publicKey
string
required
SSH public key string (e.g. ssh-ed25519 AAAA...).
​
success
boolean
​
keyType
string
​
detectedKeyType
string
​
error
string
StatusMeaning
200Result returned.
400publicKey is missing.
500Parsing error.
curl -X POST https://your-termix-instance/credentials/detect-public-key-type \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{"publicKey": "ssh-ed25519 AAAAC3Nz..."}'

​
POST /credentials/validate-key-pair

Verify that a private key and a public key form a matching pair.
​
privateKey
string
required
PEM-encoded SSH private key.
​
publicKey
string
required
SSH public key string.
​
keyPassword
string
Passphrase for an encrypted private key.
​
isValid
boolean
true when the keys match.
​
privateKeyType
string
Detected algorithm of the private key.
​
publicKeyType
string
Detected algorithm of the public key.
​
generatedPublicKey
string
Public key derived from the private key, for comparison.
​
error
string
Error message when isValid is false.
StatusMeaning
200Validation result returned.
400privateKey or publicKey is missing.
500Validation error.
curl -X POST https://your-termix-instance/credentials/validate-key-pair \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{
    "privateKey": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----",
    "publicKey": "ssh-ed25519 AAAAC3Nz..."
  }'

​
POST /credentials/generate-key-pair

Generate a new SSH key pair. Supported types: ssh-ed25519 (default), ssh-rsa, ecdsa-sha2-nistp256.
​
keyType
string
default:"ssh-ed25519"
Algorithm: ssh-ed25519, ssh-rsa, or ecdsa-sha2-nistp256.
​
keySize
number
default:"2048"
Key size in bits. Only relevant for ssh-rsa.
​
passphrase
string
Optional passphrase to encrypt the private key.
​
success
boolean
​
privateKey
string
PEM-encoded private key.
​
publicKey
string
Corresponding public key in OpenSSH format.
​
keyType
string
Algorithm used.
​
format
string
Always "ssh".
​
algorithm
string
Same as keyType.
​
keySize
number
Bit size (RSA only).
​
curve
string
Curve name for ECDSA ("nistp256").
StatusMeaning
200Key pair returned.
500Key generation failed.
curl -X POST https://your-termix-instance/credentials/generate-key-pair \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{"keyType": "ssh-ed25519"}'

​
POST /credentials/generate-public-key

Derive the SSH public key from a PEM private key. Tries multiple parsing strategies including PKCS#8, PKCS#1, SEC1, and OpenSSH formats.
​
privateKey
string
required
PEM-encoded SSH private key.
​
keyPassword
string
Passphrase for an encrypted key.
​
success
boolean
​
publicKey
string
Derived public key in OpenSSH format (e.g. ssh-ed25519 AAAAC3Nz...).
​
keyType
string
Detected algorithm.
​
format
string
"ssh" or "pem" depending on which parsing path succeeded.
StatusMeaning
200Public key returned.
400privateKey missing or unparseable.
500Derivation error.
curl -X POST https://your-termix-instance/credentials/generate-public-key \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{
    "privateKey": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----"
  }'

Build docs developers (and LLMs) love

Get started for freeTalk to us