List Origin SSH Certificate Authorities via the API

List every SSH certificate authority an owner trusts for git over SSH with GET https://api.cursor.com/v1/origin/owners/{ownerSlug}/ssh-certificate-authorities. Official reference: Origin API (OpenAPI OriginService_ListSshCertificateAuthorities) and changelog (added 2026-09-22).

Origin is in Early Beta and subject to change. Authenticate with an installation access token (oit_…) or a Cursor user access token that carries namespace:settings:read. Availability: Early Beta per the API overview.

The response is not paginated: every authority comes back in one body, newest first, together with requireCertificates (whether the owner requires certificates). Cost: 1 point against the principal budget (ordinary read).

Path parameters

Param	Required	Meaning
ownerSlug	yes	Slug of the owner whose authorities to list

curl --request GET \
  --url 'https://api.cursor.com/v1/origin/owners/OWNER_SLUG/ssh-certificate-authorities' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

Response

200 returns certificateAuthorities[] and requireCertificates.

{
  "certificateAuthorities": [
    {
      "id": "nsca_01k2ja2000e0080000000000s5",
      "name": "Acme production CA",
      "keyType": "ssh-ed25519",
      "fingerprint": "SHA256:D5vlIclvaSZlwq4gmckavfLE7n7F542Eyhk/PvXkRq0",
      "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPwoQNzBuiWhDF4EKwRyt8h48XRY7Bc4yWbQ9s3Tnj7Q",
      "createdAt": "2026-08-02T14:45:00Z"
    }
  ],
  "requireCertificates": true
}

Each authority carries id, name, keyType, fingerprint (SHA256:<base64>, the form ssh-keygen -l prints), publicKey as <key_type> <base64> without a comment, and createdAt. To add or remove an authority, use Add / Delete SSH Certificate Authority. To flip the requirement bit, use Set SSH Certificate Requirement. Base URL: https://api.cursor.com/v1/origin.