Set VPS SSH password login

PATCH /api/v2/vps/{id}/ssh-password-login

Enable or disable root SSH password login for a VPS through a server-owned QEMU Guest Agent command.

Get {id} from GET /api/v2/vps data[].id.

This endpoint is meant for recovery and hardening flows; callers should read GET /api/v2/vps/{id}/ssh-password-login first and render the returned action gates.

VPS Services VM

Authentication

Required API scope: write:vm

Authenticate with an API key in the Authorization: Bearer <token> header.

Context

Path Parameters

id string required Example: vps_01hxa3b4c5d6e7f8g9h0j1k2m3

Public VPS ID from GET /api/v2/vps data[].id. Do not invent this value; use the exact ID returned by the referenced API response.

Headers

Authorization Bearer <token>
Accept application/json
Content-Type application/json

Body

required
application/json
enabled boolean required · Example: true

true enables SSH password login for root; false disables password auth and keeps SSH-key login.

Responses

200 Updated live SSH password-login state.
available boolean required
enabled boolean · nullable required

reason string · nullable required

passwordAuthentication string · nullable required

permitRootLogin string · nullable required

source string · enum required
effective_sshd_config
config_files
unavailable
unknown
sshKeysConfigured boolean required
sshKeys array<string> required
actions object required
actions.canEnable object required
actions.canEnable.allowed boolean required · Example: true
actions.canEnable.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canEnable.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canDisable object required
actions.canDisable.allowed boolean required · Example: true
actions.canDisable.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canDisable.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

lastOperation object required
lastOperation.requestedEnabled boolean required
lastOperation.verified boolean required
lastOperation.message string · nullable required

Nullable: may be null when not applicable.

400 Invalid request. The response body is an RFC 7807 Problem Details document.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
401 Unauthorized. Authentication is required.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
403 Forbidden. The caller lacks a required scope or does not own the resource.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
404 Not found. The resource does not exist or is not owned by the caller.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
409 The VPS is still provisioning, stopped, guest command execution is unavailable, or sshd could not be updated.

No response body

429 Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
500 Internal error. Retry later or contact support if the issue persists.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
PATCH https://cloud.hostup.se/api/v2/vps/{id}/ssh-password-login
For AI assistants
View as Markdown
cURL 
curl -X PATCH "https://cloud.hostup.se/api/v2/vps/vps_01hxa3b4c5d6e7f8g9h0j1k2m3/ssh-password-login" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true
  }'
Response 
{
  "available": true,
  "enabled": true,
  "reason": null,
  "passwordAuthentication": "yes",
  "permitRootLogin": "yes",
  "source": "effective_sshd_config",
  "sshKeysConfigured": true,
  "sshKeys": [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... michael@example"
  ],
  "actions": {
    "canEnable": {
      "allowed": false,
      "reason": "SSH password login is already enabled."
    },
    "canDisable": {
      "allowed": true,
      "reason": null
    }
  },
  "lastOperation": {
    "requestedEnabled": true,
    "verified": true,
    "message": "SSH password login enabled."
  }
}
Request Body Enable password login 
{
  "enabled": true
}