> ## Documentation Index
> Fetch the complete documentation index at: https://ara-90a60a07.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Connect or reconnect over SSH
> Returns 202, not readiness. With no pinned host key, this only probes: poll, compare the fingerprint to a trusted source, then send a fresh idempotency_key and host_key_fingerprint to install. Never blindly trust a probe. Later reconnects reuse retained credentials and valid Device identity. A repeated key replays the original operation without launching again. Poll GET with a deadline; after interruption use a fresh key explicitly. Authorization is checked at admission; revoking the initiating API key does not cancel accepted setup or revoke its Device. Non-systemd hosts need manual Reconnect after restart. REST only.
Scope: `ssh:write`
## OpenAPI
````yaml /openapi.json post /v3/organizations/{orgId}/ssh-connections/{connectionId}/connect
openapi: 3.1.0
info:
title: Reason Machines API
version: 3.0.0
description: >-
The Reason HTTP API. Drive cloud software-engineering agents: open sessions
against your repositories, stream their work, and manage the secrets,
knowledge, skills, and automations they run with.
Authenticate with a Reason API key sent as a bearer token. New keys use
`reason_`; legacy `ara_` keys remain accepted. Every resource is scoped to
an organization; resolve your `org_id` once with `GET /v3/self`.
servers:
- url: https://api.reasonmachines.ai
security:
- araApiKey: []
tags:
- name: Devices
description: >-
Owned Mac and headless Device identity, bounded enrollment and root
grants.
- name: Account
description: Verify a key and resolve the organization it belongs to.
- name: Projects
description: >-
Discover existing workspace projects to target when creating and listing
sessions.
- name: Sessions
description: >-
A session is one run of an agent against a repository: it reproduces the
task, writes the code, verifies it, and opens a pull request or merge
request.
- name: Secrets
description: >-
Encrypted credentials injected into the agent's sandbox. Write-only:
values can be set but never read back.
- name: Knowledge
description: Durable notes the agent consults while it works.
- name: Memory
description: >-
Editable repository notes that are projected into native memory; generated
memory remains read-only.
- name: Skills
description: >-
Reusable instruction bundles Reason selects semantically from their
descriptions for matching agent tasks.
- name: Automations
description: Recurring or one-time triggers that open sessions on a timetable.
- name: Change Request Reviews
description: >-
Automated senior-engineer reviews posted on pull requests and merge
requests.
- name: Repositories
description: Connected repositories, their indexing state, and generated wikis.
- name: Git Connections
description: Linked source-control accounts and the repositories they expose.
- name: Consumption
description: 'Billing-aligned usage: daily consumption and billing cycles.'
- name: Metrics
description: Aggregate analytics over sessions, change requests, and usage.
- name: Audit Logs
description: An append-only record of changes made within the organization.
- name: Organizations
description: The top-level tenant. Create, read, update, and delete organizations.
- name: Members
description: People in an organization and their pending invites.
- name: Service Users
description: Machine principals that own API keys for headless access.
- name: Roles
description: Role assignments that govern what each member can do.
- name: Attachments
description: >-
Files uploaded to the organization and shared with sessions, downloaded
via short-lived signed URLs.
- name: Guardrails
description: >-
Per-repository automation limits and the violations recorded when a limit
is hit.
- name: MCP Servers
description: >-
Org-level Model Context Protocol servers exposed to the agent. Secret
values are write-only.
- name: Settings
description: 'Organization configuration: namespaced settings and the run tag policy.'
- name: Blueprints
description: >-
Read-only declarative manifests of an organization's agents (identity, run
config, triggers, suite), with credentials redacted.
- name: IP Access List
description: >-
Source-network allow-list that, when enabled, restricts the organization's
API surface to a set of CIDR ranges.
- name: Groups
description: Manually-curated member groups carrying optional per-day resource limits.
- name: Provider Credentials
description: >-
Configure Bring-Your-Own-Key (BYOK) API keys and subscription credentials
for model providers. Secret values are write-only.
paths:
/v3/organizations/{orgId}/ssh-connections/{connectionId}/connect:
parameters:
- $ref: '#/components/parameters/orgId'
- name: connectionId
description: The owned SSH connection id, not its eventual Device id.
in: path
required: true
schema:
type: string
format: uuid
post:
tags:
- Devices
summary: Connect or reconnect over SSH
description: >-
Returns 202, not readiness. With no pinned host key, this only probes:
poll, compare the fingerprint to a trusted source, then send a fresh
idempotency_key and host_key_fingerprint to install. Never blindly trust
a probe. Later reconnects reuse retained credentials and valid Device
identity. A repeated key replays the original operation without
launching again. Poll GET with a deadline; after interruption use a
fresh key explicitly. Authorization is checked at admission; revoking
the initiating API key does not cancel accepted setup or revoke its
Device. Non-systemd hosts need manual Reconnect after restart. REST
only.
Scope: `ssh:write`
operationId: connectSshConnection
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ConnectSshConnection'
responses:
'202':
description: Accepted operation or replay; poll the connection.
content:
application/json:
schema:
$ref: '#/components/schemas/SshConnectionAccepted'
'400':
description: >-
Invalid input; credential values and validation details are never
reflected.
'401':
description: A valid public bearer credential is required.
'403':
description: Required scope or workspace access is missing.
'404':
description: Owned SSH connection not found.
'409':
description: >-
Setup in progress, changed host key, quota, conflicting/expired
idempotency key, or deleted connection.
'413':
description: Request exceeds 48 KiB.
'429':
description: Rate/cooldown limit; respect Retry-After.
'503':
description: >-
Writes, headless admission, encrypted storage, audit or cleanup
unavailable.
security:
- araApiKey:
- ssh:write
components:
parameters:
orgId:
name: orgId
in: path
required: true
description: Organization id or slug. Resolve it with `GET /v3/self`.
schema:
type: string
schemas:
ConnectSshConnection:
type: object
properties:
host_key_fingerprint:
type: string
pattern: ^SHA256:[A-Za-z0-9+/]{43}$
idempotency_key:
type: string
minLength: 1
maxLength: 160
pattern: ^[A-Za-z0-9._:-]+$
description: >-
Persist one non-secret key per logical request. Retry the identical
body/key for up to 24 hours. Expired or deleted request keys return
409; reconnect intentionally with a fresh key.
required:
- idempotency_key
additionalProperties: false
SshConnectionAccepted:
type: object
properties:
connection:
type: object
properties:
id:
type: string
format: uuid
pattern: >-
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
name:
type: string
host:
type: string
port:
type: integer
username:
type: string
workspace_path:
type:
- string
- 'null'
auth_type:
type: string
enum:
- password
- private_key
host_key_fingerprint:
type:
- string
- 'null'
pending_host_key_fingerprint:
type:
- string
- 'null'
device_id:
type:
- string
- 'null'
status:
type: string
enum:
- saved
- connecting
- awaiting_host_key
- connected
- failed
error_code:
type:
- string
- 'null'
created_at:
type: string
updated_at:
type: string
required:
- id
- name
- host
- port
- username
- workspace_path
- auth_type
- host_key_fingerprint
- pending_host_key_fingerprint
- device_id
- status
- error_code
- created_at
- updated_at
additionalProperties: false
replayed:
type: boolean
operation_id:
type: string
format: uuid
pattern: >-
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
required:
- connection
- replayed
- operation_id
additionalProperties: false
securitySchemes:
araApiKey:
type: http
scheme: bearer
bearerFormat: 'reason_ (legacy: ara_)'
description: >-
Your Reason API key from Settings > API. New keys use `reason_`; legacy
`ara_` keys remain accepted. Keys are capability-scoped: run, mcp:read,
mcp:write, secrets:read, secrets:write, sessions:read, sessions:debug,
knowledge:read, memory:read, memory:write, skills:read, skills:write,
repos:read, repos:write, reviews:read, reviews:write, deployment:read,
analytics:read, org:read, org:write, attachments:read,
attachments:write, guardrails:read, guardrails:write, automations:read,
automations:write, agent_auth:read. mcp:write manages MCP server
configuration only; it does not authorize remote MCP-tool execution.
sessions:debug is privileged: it expands diagnostic session events only
for organization owners/admins.
````