---
title: "Remove an SSH key from a server"
method: DELETE
path: "/api/v1/vms/{id}/ssh-keys/{fingerprint}"
tags: ["Virtual Machines"]
---

# Remove an SSH key from a server

`DELETE /api/v1/vms/{id}/ssh-keys/{fingerprint}`

## Request

- Base URL: `https://api.rafftechnologies.com`
- URL: `https://api.rafftechnologies.com/api/v1/vms/{id}/ssh-keys/{fingerprint}`
- Auth: API key in header `X-API-Key`

Remove the key with this fingerprint from root's `authorized_keys` on a running Linux server, and from the server's settings so it does not come back at the next restart. Put the fingerprint in the path as `ssh-keygen -l` shows it, slashes included. Root's last key is removed only with `confirm_last=true`: a server created with only an SSH key has password sign-in turned off. Every change is emailed to the account owner and written to the audit log. Needs `vm.ssh_keys`; in the dashboard it also asks for a two-factor code.

## Path parameters

- `id` string, uuid, required
- `fingerprint` string, required

## Query parameters

- `confirm_last` boolean

## Response `200`

The server's keys after the remove

- ServerSSHKeysResponse
  - `success` boolean
  - `data` ServerSSHKeys: A server's keys after a read, add or remove
    - `keys` ServerSSHKey[]
      - `fingerprint` string
      - `type` string
      - `comment` string
      - `has_options` boolean: The line starts with `authorized_keys` options (`command="..."`, `from="..."`)
      - `saved_key_id` string: Your saved key with this fingerprint; empty when it is not saved
      - `saved_key_name` string
      - `public_key` string: The key without its options, as a `.pub` file holds it
    - `read_at` string, date-time
    - `changed` integer: Lines added or removed (0 when the key was already there, or not there)
    - `saved_key_id` string: The saved key `save_as` created

## Other responses

- `400`: The server's keys could not be read or changed. `reason` says why: `not_linux`, `invalid_key` (400); `not_on_server` (404); `not_running`, `no_guest_agent`, `agent_blocked`, `selinux_blocked`, `last_key`, `refused` (409); `host_unavailable`, `context_failed` (503); `no_answer` (504). `error` is the sentence to show.
- `401`: Authentication required
- `403`: Missing `vm.ssh_keys`, or (dashboard sessions) `mfa_required`
- `404`: The server's keys could not be read or changed. `reason` says why: `not_linux`, `invalid_key` (400); `not_on_server` (404); `not_running`, `no_guest_agent`, `agent_blocked`, `selinux_blocked`, `last_key`, `refused` (409); `host_unavailable`, `context_failed` (503); `no_answer` (504). `error` is the sentence to show.
- `409`: The server's keys could not be read or changed. `reason` says why: `not_linux`, `invalid_key` (400); `not_on_server` (404); `not_running`, `no_guest_agent`, `agent_blocked`, `selinux_blocked`, `last_key`, `refused` (409); `host_unavailable`, `context_failed` (503); `no_answer` (504). `error` is the sentence to show.
- `503`: The server's keys could not be read or changed. `reason` says why: `not_linux`, `invalid_key` (400); `not_on_server` (404); `not_running`, `no_guest_agent`, `agent_blocked`, `selinux_blocked`, `last_key`, `refused` (409); `host_unavailable`, `context_failed` (503); `no_answer` (504). `error` is the sentence to show.
- `504`: The server's keys could not be read or changed. `reason` says why: `not_linux`, `invalid_key` (400); `not_on_server` (404); `not_running`, `no_guest_agent`, `agent_blocked`, `selinux_blocked`, `last_key`, `refused` (409); `host_unavailable`, `context_failed` (503); `no_answer` (504). `error` is the sentence to show.

## Changes

- **2026-10-21** `25a12e36b279`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/rafftechnologies/apis/raff-api/changes/api/v1/vms/:id/ssh-keys/:fingerprint/delete.md)

---

[API](https://skmtc.dev/rafftechnologies/apis/raff-api.md) - [All operations](https://skmtc.dev/rafftechnologies/apis/raff-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rafftechnologies/apis/raff-api/revisions/3d30cde0acb4?raw)