Cluster access

Read SSH access: GET /clusters/{clusterId}/ssh-access
Read a kubeconfig: GET /clusters/{clusterId}/kubeconfig

These endpoints take the organization as organizationId, not businessOrgId as the other Platform endpoints do.

Read SSH access

GET /clusters/{clusterId}/ssh-access

API: Platform. Permission: clusters.ssh. Slurm SSH requires organization membership and the organization’s SSH permission. A Kubernetes resource grant does not provide SSH access. Returns the SSH gateway address, its host key, and your login name on the cluster. The response is not cached (Cache-Control: no-store). For the full flow, see Connect over SSH.

Parameters

Name	In	Type	Required	Description
`clusterId`	path	string	yes	Cluster ID.
`organizationId`	query	string	yes	Organization ID.

Response

This response uses snake_case. An authorized request returns 200 even when access is not ready, with ready: false and a reason. Connection details can be empty until ready is true.

Field	Type	Description
`hostname`	string	The SSH gateway’s hostname.
`port`	integer	The SSH gateway’s port. `22`.
`username`	string	Your login name on the cluster. Log in as `<clusterId>.<username>`.
`host_key`	string	The gateway’s public host key, in OpenSSH format. Add `<hostname> <host_key>` to `~/.ssh/known_hosts`.
`host_key_fingerprint`	string	SHA-256 fingerprint of `host_key`.
`login_mode`	string	`Shared`: everyone uses one login node. `PerUser`: each person gets their own.
`ready`	boolean	`true` when the cluster has confirmed your access, you have an active key, and the gateway is up.
`reason`	string	`ready`, `no_keys`, `access_not_projected`, `projection_pending`, `gateway_unavailable`, `observation_stale`, `cluster_inactive`, or `named_user_required`.
`manifest_generation`	integer	Version of the cluster’s access list that Platform has accepted. `0` when unknown.
`observed_manifest_generation`	integer	Version of the access list the cluster last reported applying. `0` when unknown.
`ssh_key_set_generation`	integer	Version of your key set the cluster has confirmed. `0` when unknown. Compare with `generation` from `GET /me/ssh-keys`.
`key_fingerprints`	array of strings	Fingerprints of your active keys that the cluster has confirmed.
`shell`	string	Your requested shell, as confirmed by the cluster. Empty when unknown. Compare with `user.login_shell` from `GET /me`.
`observation_current`	boolean	`true` when the cluster’s latest report is recent and covers the newest access list. Can be `true` with `ready: false` when you have no active keys.
`observed_at`	timestamp, optional	When the cluster last reported.

Readiness is per person, but the cluster applies one access list for everyone, so another person’s change can briefly delay your new logins. ready does not wait for compute nodes or your Slurm accounting association, so SSH can work before job submission does. It can also still describe an earlier change. To confirm that a specific change has reached the cluster, see Wait for access. After you revoke your last key, ready stays false with reason: no_keys.

Example

andromeda call platform GET "/clusters/$CLUSTER_ID/ssh-access?organizationId=$ORG_ID"

{
  "hostname": "ssh.k8s.prod-nyc3-z001.tenants.andromedacluster.xyz",
  "port": 22,
  "username": "ada",
  "host_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGF0ZXN0a2V5Zm9yZG9jdW1lbnRhdGlvbm9ubHk",
  "host_key_fingerprint": "SHA256:dGhpcyBpcyBhbiBleGFtcGxlIGZpbmdlcnByaW50IG9ubHk",
  "login_mode": "Shared",
  "ready": true,
  "reason": "ready",
  "manifest_generation": 7,
  "observed_manifest_generation": 7,
  "ssh_key_set_generation": 3,
  "key_fingerprints": ["SHA256:Qm9vbGVhbiBhbGdlYnJhIGlzIHRoZSBrZXkgdG8gaXQ"],
  "shell": "/bin/bash",
  "observation_current": true,
  "observed_at": "2026-10-06T12:00:00Z"
}

Errors

Status	Code	When
403	`forbidden`	You lack `clusters.ssh`.
404	`not_found`	No cluster with this ID belongs to the organization.
422	`invalid_request`	`organizationId` is missing.

Pending access, an inactive cluster, a missing gateway, and a stale report all return 200 with ready: false. The reason table says what to do for each. Kubernetes-only clusters have no SSH endpoint; use a kubeconfig instead.

Read a kubeconfig

GET /clusters/{clusterId}/kubeconfig

API: Platform. Permission: clusters.kubernetes in the owning organization, or a live Kubernetes resource grant on the cluster or one of its namespaces. Organization membership is not required for the resource-grant path. Returns a kubeconfig for the cluster’s Kubernetes API. It holds no credentials. Instead, it runs kubectl oidc-login, which signs you in with your Andromeda account the first time you use it. The response is not cached (Cache-Control: no-store). For the full flow, see Connect with kubectl.

Parameters

Name	In	Type	Required	Description
`clusterId`	path	string	yes	Cluster ID.
`organizationId`	query	string	yes	Organization ID.

Response

Field	Type	Description
`kubeconfig`	string	A kubeconfig in YAML. Its cluster, context, and user are named after the cluster ID.
`accessExpiresAt`	timestamp, optional	Expiry of the grant admitting the caller. Absent when that access has no expiry. The kubeconfig itself contains no credential.

Example

andromeda call platform GET "/clusters/$CLUSTER_ID/kubeconfig?organizationId=$ORG_ID" | jq -r .kubeconfig

apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTi...
    server: https://training-h200.k8s.prod-nyc3-z001.tenants.andromedacluster.xyz:443
  name: 0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b
contexts:
- context:
    cluster: 0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b
    user: 0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b
  name: 0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b
current-context: 0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b
users:
- name: 0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1
      command: kubectl
      args:
      - oidc-login
      - get-token
      - --oidc-issuer-url=https://zitadel.andromedacluster.xyz
      - --oidc-client-id=000000000000000000
      - --grant-type=device-code
      installHint: 'Install kubectl oidc-login: https://github.com/int128/kubelogin'
      interactiveMode: IfAvailable

Errors

Status	Code	When
403	`forbidden`	Neither an organization permission nor a live Kubernetes resource grant admits you.
404	`not_found`	No cluster with this ID belongs to the organization.
409	`invalid_state`	The cluster is not `active`, or its Kubernetes API is not ready yet.
422	`invalid_request`	`organizationId` is missing.
503	`customer_kubernetes_login_not_configured`	This environment does not offer Kubernetes sign-in.

Overview

Business API

Platform API

Read SSH access

Parameters

Response

Example

Errors

Read a kubeconfig

Parameters

Response

Example

Errors

​Read SSH access

​Parameters

​Response

​Example

​Errors

​Read a kubeconfig

​Parameters

​Response

​Example

​Errors

Read SSH access

Parameters

Response

Example

Errors

Read a kubeconfig

Parameters

Response

Example

Errors