Skip to content

API Overview

API Overview

Learn how to authenticate and interact with the SSH-KLM API using SDKs and direct API calls.

Authentication

SSH-KLM uses JWT-based authentication with API keys.

Obtaining API Key

Navigate to Settings → API Keys
Click Create API Key
Set name and permissions
Copy and securely store the key

Using API Key

import { QcClient } from '@qcecuring/ssh-sdk';

const client = new QcClient({
  apiKey: process.env.QC_API_KEY,
  baseUrl: 'https://ssh-klm.example.com'  // Optional, defaults to cloud
});

Token Lifetime

Token Type	Lifetime	Refresh
API Key	Long-lived	Manual rotation
Access Token	15 minutes	Auto-refresh
Refresh Token	7 days	Re-authenticate

SDK Installation

Node.js

npm install @qcecuring/ssh-sdk

Python

pip install qcecuring-ssh

Go

go get github.com/qcecuring/ssh-sdk-go

Quick Start

import { QcClient } from '@qcecuring/ssh-sdk';

const client = new QcClient({ apiKey: process.env.QC_API_KEY });

// List all discovered keys
const keys = await client.ssh.listKeys();

// Start discovery scan
const scan = await client.ssh.startDiscovery({
  hosts: ['server01.example.com']
});

// Request ephemeral access
const ephemeral = await client.ssh.requestEphemeral({
  host: 'server01.example.com',
  username: 'deploy',
  ttl: 300
});

Core Resources

Resource	Description
`hosts`	Target servers in inventory
`keys`	Discovered SSH keys
`scans`	Discovery scan jobs
`rotations`	Key rotation jobs
`policies`	Rotation and access policies
`ephemeral`	Just-in-time credentials

Rate Limits

Endpoint	Rate Limit
Read operations	1000/minute
Write operations	100/minute
Discovery scans	10/minute
Ephemeral requests	50/minute

Error Handling

import { QcClient, QcError } from '@qcecuring/ssh-sdk';

try {
  await client.ssh.rotateKey({ keyId: 'invalid' });
} catch (error) {
  if (error instanceof QcError) {
    console.log('Error code:', error.code);
    console.log('Message:', error.message);
    console.log('Details:', error.details);
  }
}

Error Codes

Code	Description
`AUTH_INVALID`	Invalid or expired API key
`AUTH_FORBIDDEN`	Insufficient permissions
`NOT_FOUND`	Resource not found
`RATE_LIMITED`	Too many requests
`VALIDATION_ERROR`	Invalid request parameters