---
title: "POST /update-ssh-cert-issuer"
method: POST
path: "/update-ssh-cert-issuer"
tags: ["v2"]
---

# POST /update-ssh-cert-issuer

`POST /update-ssh-cert-issuer`

## Request body

- UpdateSSHCertIssuer
  - `ProviderType` string
  - `add-tag` string[] — List of the new tags that will be attached to this item
  - `allowed-users` string, required — Users allowed to fetch the certificate, e.g root,ubuntu
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `description` string — Description of the object
  - `extensions` object — Signed certificates with extensions, e.g permit-port-forwarding=\"\"
  - `external-username` string — Externally provided username [true/false]
  - `fixed-user-claim-keyname` string — For externally provided users, denotes the key-name of IdP claim to extract the username from (relevant only for external-username=true)
  - `host-provider` string — Host provider type [explicit/target], Default Host provider is explicit, Relevant only for Secure Remote Access of ssh cert issuer, ldap rotated secret and ldap dynamic secret
  - `item-custom-fields` object — Additional custom fields to associate with the item
  - `json` boolean — Set output format to JSON
  - `metadata` string — Deprecated - use description
  - `name` string, required — SSH certificate issuer name
  - `new-name` string — New item name
  - `principals` string — Signed certificates with principal, e.g example_role1,example_role2
  - `rm-tag` string[] — List of the existent tags that will be removed from this item
  - `secure-access-api` string — Secure Access SSH control API endpoint. E.g. https://my.sra-server:9900
  - `secure-access-bastion-api` string — Deprecated. use secure-access-api
  - `secure-access-bastion-ssh` string — Deprecated. use secure-access-ssh
  - `secure-access-enable` string — Enable/Disable secure remote access [true/false]
  - `secure-access-enforce-hosts-restriction` boolean — Enable this flag to enforce connections only to the hosts listed in --secure-access-host
  - `secure-access-gateway` string
  - `secure-access-host` string[] — Target servers for connections (In case of Linked Target association, host(s) will inherit Linked Target hosts - Relevant only for Dynamic Secrets/producers)
  - `secure-access-ssh` string — Bastion's SSH server. E.g. my.sra-server:22
  - `secure-access-ssh-creds-user` string — SSH username to connect to target server, must be in 'Allowed Users' list
  - `secure-access-use-internal-bastion` boolean — Deprecated. Use secure-access-use-internal-ssh-access
  - `secure-access-use-internal-ssh-access` boolean — Use internal SSH Access
  - `signer-key-name` string, required — A key to sign the certificate with
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `ttl` integer, required — The requested Time To Live for the certificate, in seconds
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication

## Response `200`

updateSSHCertIssuerResponse wraps response body.

- UpdateSSHCertIssuerOutput
  - `name` string

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)