# Create SSH user for a web hosting package

> A new SSH user for one web hosting package, with its public keys - after the customer agreed to the AGB and the rules for SSH users.

- Effect: Write - Changes the account. Agents ask first.
- Idempotent: no
- Stability: beta
- MCP tool: `manitu_webhosting_web_sshuser_create` on https://mcp.manitu.de/mcp
- REST: `POST https://api.manitu.de/v1/webhosting/web/sshuser/create`
- Needs: `service_webhosting`
- Page: /reference/webhosting/web/sshuser/create/

**Changes the account. Agents say what will happen and wait for an explicit yes before calling it.**

## MCP tool

`manitu_webhosting_web_sshuser_create`

### Description for the model

Creates an SSH user for a web hosting package of the manitu customer account this connection works in, by its site_id from manitu_webhosting_list. Login is by public key only: give ssh_key_list (the customer's public keys) or ssh_keys_same_as (the username of another SSH user of the package whose keys it gets). manitu gives the user name (ssh<number>); the answer has it and how to connect. CONSENT IN TWO CALLS: the first call (without consent_token) is answered with the conflict consent_required - its consent_list holds what the customer has to agree to (the AGB as a link, the rules for SSH users as a text) and a consent_token. Show the customer every item of it - the title with the link, the text as it is, in its language (language; it is the binding wording - a translation only in addition, marked as an unofficial help) - and ask for an explicit yes. Only then make the same call again with consent_token (valid 15 minutes, once). Never agree on the customer's behalf. Also refused with a conflict when the package allows no more SSH users (limit_reached), its disk space is almost full (quota_almost_exceeded) or it cannot be changed now (not_configurable). An SSH user reaches the whole package.

Provide at least one of: ssh_key_list, ssh_keys_same_as.

### Arguments

- `site_id` (integer | string, required) - The site_id from manitu_webhosting_list - never guess one. (pattern `"^[1-9][0-9]*$"`; minimum `1`)
- `quota_mb` (integer | null) - Disk space in MB the files it owns may take, at most the package's; null or 0: no limit of its own. (minimum `0`)
- `status` (string) - active, or inactive to switch it off without deleting it. Default when created: active. (one of `"active"`, `"inactive"`)
- `expires_at` (string | null) - When the SSH user expires - it works up to the next midnight (Europe/Berlin) at or after the moment given, which the answer shows. Not in the past. From this moment on it can no longer be used (the moment itself is excluded); null: without end. (format `date-time`)
- `description` (string | null) - The customer's description, for his own overview - e.g. who uses it. Left out: unchanged (set) or none (create); null or empty: none. (maxLength `1024`)
- `ssh_key_list` (array of string) - The public keys that may log in as this SSH user - all of them: the list replaces the keys it has. Only one of ssh_key_list, ssh_keys_same_as. Each one public key, one line as in authorized_keys: "ssh-ed25519 AAAA... comment" (also ecdsa-sha2-nistp256/384/521, ssh-rsa from 2048 bits). No options in front of the key (command=, environment=, from= ...), no DSA. The public key only - never a private key. (minItems `1`; maxItems `50`)
- `ssh_keys_same_as` (string) - The user name of the SSH user (ssh<number>) from manitu_webhosting_web_sshuser_list - never guess one. (maxLength `32`; pattern `"^ssh[0-9]+$"`)
- `shell` (string) - bash (default when created), zsh, or git - git-shell: only git push/pull, no commands. (one of `"bash"`, `"zsh"`, `"git"`)
- `consent_token` (string, write-only) - The consent_token from the consent_required answer of the same call - only after the customer agreed to everything in its consent_list. Valid 15 minutes, once. (minLength `1`; maxLength `255`)

### Example

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manitu_webhosting_web_sshuser_create",
    "arguments": {
      "site_id": 12345,
      "ssh_key_list": [
        "string"
      ]
    }
  }
}
```

## REST

`POST https://api.manitu.de/v1/webhosting/web/sshuser/create`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

Provide at least one of: ssh_key_list, ssh_keys_same_as.

- `site_id` (integer | string, required) - The site_id from manitu_webhosting_list - never guess one. (pattern `"^[1-9][0-9]*$"`; minimum `1`)
- `quota_mb` (integer | null) - Disk space in MB the files it owns may take, at most the package's; null or 0: no limit of its own. (minimum `0`)
- `status` (string) - active, or inactive to switch it off without deleting it. Default when created: active. (one of `"active"`, `"inactive"`)
- `expires_at` (string | null) - When the SSH user expires - it works up to the next midnight (Europe/Berlin) at or after the moment given, which the answer shows. Not in the past. From this moment on it can no longer be used (the moment itself is excluded); null: without end. (format `date-time`)
- `description` (string | null) - The customer's description, for his own overview - e.g. who uses it. Left out: unchanged (set) or none (create); null or empty: none. (maxLength `1024`)
- `ssh_key_list` (array of string) - The public keys that may log in as this SSH user - all of them: the list replaces the keys it has. Only one of ssh_key_list, ssh_keys_same_as. Each one public key, one line as in authorized_keys: "ssh-ed25519 AAAA... comment" (also ecdsa-sha2-nistp256/384/521, ssh-rsa from 2048 bits). No options in front of the key (command=, environment=, from= ...), no DSA. The public key only - never a private key. (minItems `1`; maxItems `50`)
- `ssh_keys_same_as` (string) - The user name of the SSH user (ssh<number>) from manitu_webhosting_web_sshuser_list - never guess one. (maxLength `32`; pattern `"^ssh[0-9]+$"`)
- `shell` (string) - bash (default when created), zsh, or git - git-shell: only git push/pull, no commands. (one of `"bash"`, `"zsh"`, `"git"`)
- `consent_token` (string, write-only) - The consent_token from the consent_required answer of the same call - only after the customer agreed to everything in its consent_list. Valid 15 minutes, once. (minLength `1`; maxLength `255`)

### Response

In `data`; the rest of the body as on every call.

- `username` (string, required) - The user name to log in with (ssh<number>) - what the other SSH user tools take.
- `description` (string | null, required) - What the customer wrote about it (his description), null if nothing - not its name or user name.
- `status` (string, required) - active, or inactive (switched off by the customer, kept for later). (one of `"active"`, `"inactive"`)
- `is_usable_now` (boolean, required) - It can log in right now: active and not expired.
- `expires_at` (string | null, required) - When the SSH user expires. From this moment on it can no longer be used (the moment itself is excluded); null: without end. (format `date-time`)
- `shell` (string | null, required) - The shell: bash, zsh, or git (git only - for pushing and pulling repositories). (one of `"bash"`, `"zsh"`, `"git"`, `null`)
- `quota_mb` (integer | null, required) - Disk space in MB the files it owns may take; null: no limit of its own (the package's applies).
- `created_at` (string | null, required) - When it was created. (format `date-time`)
- `last_login_at` (string | null, required) - Its last login, null if never. (format `date-time`)
- `ssh_key_list` (array of object | null, required) - The public keys that may log in, read live from the server (the customer may change them there himself); null if the file could not be read.
  - `ssh_key_list[].line` (string, required) - The line as it is in the file - a public key, no secret.
  - `ssh_key_list[].algorithm` (string | null, required) - e.g. ssh-ed25519; null if the line is no key.
  - `ssh_key_list[].comment` (string | null, required) - The comment after the key - often who it belongs to.
  - `ssh_key_list[].fingerprint_sha256` (string | null, required) - As "ssh-keygen -lf" shows it, e.g. "SHA256:...".
  - `ssh_key_list[].has_options` (boolean, required) - Options in front of the key (command=, from= ...) - written by the customer on the server.
  - `ssh_key_list[].is_valid` (boolean, required) - A line manitu would write itself; false: kept only as long as the file is not replaced.
- `connection` (object, required)
  - `connection.host` (string | null, required) - The host to connect to - the web server of the package.
  - `connection.username` (string, required) - The user name to log in with.
  - `connection.method_list` (array of object, required) - The ways to connect: SSH on port 22.
    - `connection.method_list[].protocol` (string, required) - (one of `"ssh"`)
    - `connection.method_list[].port` (integer, required)
    - `connection.method_list[].is_encrypted` (boolean, required)
    - `connection.method_list[].is_recommended` (boolean, required)
  - `connection.auth` (string, required) - public_key_only: log in with a key from the user's ssh_key_list - a password does not work. (one of `"public_key_only"`)
  - `connection.host_key_list` (array of object, required) - The server's host keys - on the first connection the SSH client shows one of these fingerprints; it must match.
    - `connection.host_key_list[].algorithm` (string, required)
    - `connection.host_key_list[].fingerprint_sha256` (string, required) - As the SSH client shows it, e.g. "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8".

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/webhosting/web/sshuser/create' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"site_id":12345,"ssh_key_list":["string"]}'
```

## Example result

```json
{
  "username": "string",
  "description": "Example",
  "status": "active",
  "is_usable_now": true,
  "expires_at": "2026-10-23T12:00:00+02:00",
  "shell": "bash",
  "quota_mb": 1,
  "created_at": "2026-10-23T12:00:00+02:00",
  "last_login_at": "2026-10-23T12:00:00+02:00",
  "ssh_key_list": [
    {
      "line": "string",
      "algorithm": "string",
      "comment": "Example",
      "fingerprint_sha256": "string",
      "has_options": true,
      "is_valid": true
    }
  ],
  "connection": {
    "host": "string",
    "username": "string",
    "method_list": [
      {
        "protocol": "ssh",
        "port": 1,
        "is_encrypted": true,
        "is_recommended": true
      }
    ],
    "auth": "public_key_only",
    "host_key_list": [
      {
        "algorithm": "string",
        "fingerprint_sha256": "string"
      }
    ]
  }
}
```