Create SSH user for a web hosting package

A new SSH user for one web hosting package, with its public keys - after the customer agreed to the AGB and the rules for SSH users.

WWriteNot idempotentbetaNeeds service_webhosting

Tool

manitu_webhosting_web_sshuser_createon https://mcp.manitu.de/mcp

POST

/v1/webhosting/web/sshuser/createon https://api.manitu.de

Try it

Changes the account. Agents say what will happen and wait for an explicit yes before calling it.

Annotations as tools/list sends them

readOnlyHint falsedestructiveHint falseidempotentHint falseopenWorldHint false

Description for the model

Creates an SSH user for a web hosting package of the manitu customer account this connection works in, by its site_id from manitu_webhosting_list. Login is by public key only: give ssh_key_list (the customer's public keys) or ssh_keys_same_as (the username of another SSH user of the package whose keys it gets). manitu gives the user name (ssh<number>); the answer has it and how to connect. CONSENT IN TWO CALLS: the first call (without consent_token) is answered with the conflict consent_required - its consent_list holds what the customer has to agree to (the AGB as a link, the rules for SSH users as a text) and a consent_token. Show the customer every item of it - the title with the link, the text as it is, in its language (language; it is the binding wording - a translation only in addition, marked as an unofficial help) - and ask for an explicit yes. Only then make the same call again with consent_token (valid 15 minutes, once). Never agree on the customer's behalf. Also refused with a conflict when the package allows no more SSH users (limit_reached), its disk space is almost full (quota_almost_exceeded) or it cannot be changed now (not_configurable). An SSH user reaches the whole package.

Provide at least one of: ssh_key_list, ssh_keys_same_as.

Arguments

site_idinteger | stringrequired

The site_id from manitu_webhosting_list - never guess one.

pattern ^[1-9][0-9]*$min 1

quota_mbinteger | null

Disk space in MB the files it owns may take, at most the package's; null or 0: no limit of its own.

min 0

statusstring

active, or inactive to switch it off without deleting it. Default when created: active.

One of active inactive

expires_atstring | null

When the SSH user expires - it works up to the next midnight (Europe/Berlin) at or after the moment given, which the answer shows. Not in the past. From this moment on it can no longer be used (the moment itself is excluded); null: without end.

Format date-time

descriptionstring | null

The customer's description, for his own overview - e.g. who uses it. Left out: unchanged (set) or none (create); null or empty: none.

max length 1024

ssh_key_listarray of string

The public keys that may log in as this SSH user - all of them: the list replaces the keys it has. Only one of ssh_key_list, ssh_keys_same_as. Each one public key, one line as in authorized_keys: "ssh-ed25519 AAAA... comment" (also ecdsa-sha2-nistp256/384/521, ssh-rsa from 2048 bits). No options in front of the key (command=, environment=, from= ...), no DSA. The public key only - never a private key.

min items 1max items 50

ssh_keys_same_asstring

The user name of the SSH user (ssh<number>) from manitu_webhosting_web_sshuser_list - never guess one.

max length 32pattern ^ssh[0-9]+$

shellstring

bash (default when created), zsh, or git - git-shell: only git push/pull, no commands.

One of bash zsh git

consent_tokenstringwrite-only

The consent_token from the consent_required answer of the same call - only after the customer agreed to everything in its consent_list. Valid 15 minutes, once.

min length 1max length 255

The tool list carries this simplified form: a rule at the root of a schema does not reach every client, so it is said in the description instead.

Result structuredContent, checked against the schema

usernamestringrequired

The user name to log in with (ssh<number>) - what the other SSH user tools take.

descriptionstring | nullrequired

What the customer wrote about it (his description), null if nothing - not its name or user name.

statusstringrequired

active, or inactive (switched off by the customer, kept for later).

One of active inactive

is_usable_nowbooleanrequired

It can log in right now: active and not expired.

expires_atstring | nullrequired

When the SSH user expires. From this moment on it can no longer be used (the moment itself is excluded); null: without end.

Format date-time

shellstring | nullrequired

The shell: bash, zsh, or git (git only - for pushing and pulling repositories).

One of bash zsh git null

quota_mbinteger | nullrequired

Disk space in MB the files it owns may take; null: no limit of its own (the package's applies).

created_atstring | nullrequired

When it was created.

Format date-time

last_login_atstring | nullrequired

Its last login, null if never.

Format date-time

ssh_key_listarray of object | nullrequired

The public keys that may log in, read live from the server (the customer may change them there himself); null if the file could not be read.

ssh_key_list[].linestringrequired

The line as it is in the file - a public key, no secret.

ssh_key_list[].algorithmstring | nullrequired

e.g. ssh-ed25519; null if the line is no key.

ssh_key_list[].commentstring | nullrequired

The comment after the key - often who it belongs to.

ssh_key_list[].fingerprint_sha256string | nullrequired

As "ssh-keygen -lf" shows it, e.g. "SHA256:...".

ssh_key_list[].has_optionsbooleanrequired

Options in front of the key (command=, from= ...) - written by the customer on the server.

ssh_key_list[].is_validbooleanrequired

A line manitu would write itself; false: kept only as long as the file is not replaced.

connectionobjectrequired

connection.hoststring | nullrequired

The host to connect to - the web server of the package.

connection.usernamestringrequired

The user name to log in with.

connection.method_listarray of objectrequired

The ways to connect: SSH on port 22.

connection.method_list[].protocolstringrequired

One of ssh

connection.method_list[].portintegerrequired

connection.method_list[].is_encryptedbooleanrequired

connection.method_list[].is_recommendedbooleanrequired

connection.authstringrequired

public_key_only: log in with a key from the user's ssh_key_list - a password does not work.

One of public_key_only

connection.host_key_listarray of objectrequired

The server's host keys - on the first connection the SSH client shows one of these fingerprints; it must match.

connection.host_key_list[].algorithmstringrequired

connection.host_key_list[].fingerprint_sha256stringrequired

As the SSH client shows it, e.g. "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8".

Authentication

One of X-API-Key, Authorization: Bearer … - never more than one in a request. More

Request body JSON; unknown fields are refused

Provide at least one of: ssh_key_list, ssh_keys_same_as.

site_idinteger | stringrequired

The site_id from manitu_webhosting_list - never guess one.

pattern ^[1-9][0-9]*$min 1

quota_mbinteger | null

Disk space in MB the files it owns may take, at most the package's; null or 0: no limit of its own.

min 0

statusstring

active, or inactive to switch it off without deleting it. Default when created: active.

One of active inactive

expires_atstring | null

Format date-time

descriptionstring | null

The customer's description, for his own overview - e.g. who uses it. Left out: unchanged (set) or none (create); null or empty: none.

max length 1024

ssh_key_listarray of string

min items 1max items 50

ssh_keys_same_asstring

The user name of the SSH user (ssh<number>) from manitu_webhosting_web_sshuser_list - never guess one.

max length 32pattern ^ssh[0-9]+$

shellstring

bash (default when created), zsh, or git - git-shell: only git push/pull, no commands.

One of bash zsh git

consent_tokenstringwrite-only

The consent_token from the consent_required answer of the same call - only after the customer agreed to everything in its consent_list. Valid 15 minutes, once.

min length 1max length 255

Response in `data`; the rest of the body as on every call

usernamestringrequired

The user name to log in with (ssh<number>) - what the other SSH user tools take.

descriptionstring | nullrequired

What the customer wrote about it (his description), null if nothing - not its name or user name.

statusstringrequired

active, or inactive (switched off by the customer, kept for later).

One of active inactive

is_usable_nowbooleanrequired

It can log in right now: active and not expired.

expires_atstring | nullrequired

When the SSH user expires. From this moment on it can no longer be used (the moment itself is excluded); null: without end.

Format date-time

shellstring | nullrequired

The shell: bash, zsh, or git (git only - for pushing and pulling repositories).

One of bash zsh git null

quota_mbinteger | nullrequired

Disk space in MB the files it owns may take; null: no limit of its own (the package's applies).

created_atstring | nullrequired

When it was created.

Format date-time

last_login_atstring | nullrequired

Its last login, null if never.

Format date-time

ssh_key_listarray of object | nullrequired

The public keys that may log in, read live from the server (the customer may change them there himself); null if the file could not be read.

ssh_key_list[].linestringrequired

The line as it is in the file - a public key, no secret.

ssh_key_list[].algorithmstring | nullrequired

e.g. ssh-ed25519; null if the line is no key.

ssh_key_list[].commentstring | nullrequired

The comment after the key - often who it belongs to.

ssh_key_list[].fingerprint_sha256string | nullrequired

As "ssh-keygen -lf" shows it, e.g. "SHA256:...".

ssh_key_list[].has_optionsbooleanrequired

Options in front of the key (command=, from= ...) - written by the customer on the server.

ssh_key_list[].is_validbooleanrequired

A line manitu would write itself; false: kept only as long as the file is not replaced.

connectionobjectrequired

connection.hoststring | nullrequired

The host to connect to - the web server of the package.

connection.usernamestringrequired

The user name to log in with.

connection.method_listarray of objectrequired

The ways to connect: SSH on port 22.

connection.method_list[].protocolstringrequired

One of ssh

connection.method_list[].portintegerrequired

connection.method_list[].is_encryptedbooleanrequired

connection.method_list[].is_recommendedbooleanrequired

connection.authstringrequired

public_key_only: log in with a key from the user's ssh_key_list - a password does not work.

One of public_key_only

connection.host_key_listarray of objectrequired

The server's host keys - on the first connection the SSH client shows one of these fingerprints; it must match.

connection.host_key_list[].algorithmstringrequired

connection.host_key_list[].fingerprint_sha256stringrequired

As the SSH client shows it, e.g. "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8".

Statuses

200Success.400The request does not match the declared input schema.401No credential was presented, or it was not recognised.403The credential is not permitted to use this operation.500The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.503The channel this operation forwards through is unavailable.

MCPtools/call

Request

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manitu_webhosting_web_sshuser_create",
    "arguments": {
      "site_id": 12345,
      "ssh_key_list": [
        "string"
      ]
    }
  }
}

Result

{
  "structuredContent": {
    "username": "string",
    "description": "Example",
    "status": "active",
    "is_usable_now": true,
    "expires_at": "2026-10-23T12:00:00+02:00",
    "shell": "bash",
    "quota_mb": 1,
    "created_at": "2026-10-23T12:00:00+02:00",
    "last_login_at": "2026-10-23T12:00:00+02:00",
    "ssh_key_list": [
      {
        "line": "string",
        "algorithm": "string",
        "comment": "Example",
        "fingerprint_sha256": "string",
        "has_options": true,
        "is_valid": true
      }
    ],
    "connection": {
      "host": "string",
      "username": "string",
      "method_list": [
        {
          "protocol": "ssh",
          "port": 1,
          "is_encrypted": true,
          "is_recommended": true
        }
      ],
      "auth": "public_key_only",
      "host_key_list": [
        {
          "algorithm": "string",
          "fingerprint_sha256": "string"
        }
      ]
    }
  },
  "content": [
    {
      "type": "text",
      "text": "… the same answer as text …"
    }
  ],
  "isError": false
}

POST/v1/webhosting/web/sshuser/create

Request

curl -X POST 'https://api.manitu.de/v1/webhosting/web/sshuser/create' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "site_id": 12345,
    "ssh_key_list": [
      "string"
    ]
  }'

const response = await fetch('https://api.manitu.de/v1/webhosting/web/sshuser/create', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "site_id": 12345,
    "ssh_key_list": [
      "string"
    ]
  }),
});
const answer = await response.json();

<?php

$curl = curl_init('https://api.manitu.de/v1/webhosting/web/sshuser/create');

curl_setopt_array($curl, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => [
        'X-API-Key: ' . getenv('API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => '{"site_id":12345,"ssh_key_list":["string"]}',
    CURLOPT_RETURNTRANSFER => true,
]);

$answer = json_decode(curl_exec($curl), true);

import os

import requests

response = requests.request(
    "POST",
    "https://api.manitu.de/v1/webhosting/web/sshuser/create",
    headers={"X-API-Key": os.environ["API_KEY"]},
    json={
        "site_id": 12345,
        "ssh_key_list": [
            "string",
        ],
    },
)
answer = response.json()

Response 200

{
  "status": {
    "type": "success",
    "code": 200
  },
  "meta": {},
  "data": {
    "username": "string",
    "description": "Example",
    "status": "active",
    "is_usable_now": true,
    "expires_at": "2026-10-23T12:00:00+02:00",
    "shell": "bash",
    "quota_mb": 1,
    "created_at": "2026-10-23T12:00:00+02:00",
    "last_login_at": "2026-10-23T12:00:00+02:00",
    "ssh_key_list": [
      {
        "line": "string",
        "algorithm": "string",
        "comment": "Example",
        "fingerprint_sha256": "string",
        "has_options": true,
        "is_valid": true
      }
    ],
    "connection": {
      "host": "string",
      "username": "string",
      "method_list": [
        {
          "protocol": "ssh",
          "port": 1,
          "is_encrypted": true,
          "is_recommended": true
        }
      ],
      "auth": "public_key_only",
      "host_key_list": [
        {
          "algorithm": "string",
          "fingerprint_sha256": "string"
        }
      ]
    }
  }
}

Create SSH user for a web hosting package

Annotations as tools/list sends them

Description for the model

Arguments

Result structuredContent, checked against the schema

Authentication

Request body JSON; unknown fields are refused

Response in data; the rest of the body as on every call

Statuses

Response in `data`; the rest of the body as on every call