diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java
new file mode 100644
index 0000000..4fd4662
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java
@@ -0,0 +1,39 @@
+// Copyright (C) 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.serviceuser;
+
+import com.google.gerrit.extensions.restapi.AuthException;
+import com.google.gerrit.extensions.restapi.RestReadView;
+import com.google.gerrit.server.account.GetSshKeys.SshKeyInfo;
+import com.google.gwtorm.server.OrmException;
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+
+import java.util.List;
+
+public class GetSshKeys implements RestReadView<ServiceUserResource> {
+  private final Provider<com.google.gerrit.server.account.GetSshKeys> getSshKeys;
+
+  @Inject
+  GetSshKeys(Provider<com.google.gerrit.server.account.GetSshKeys> getSshKeys) {
+    this.getSshKeys = getSshKeys;
+  }
+
+  @Override
+  public List<SshKeyInfo> apply(ServiceUserResource rsrc) throws AuthException,
+      OrmException {
+    return getSshKeys.get().apply(rsrc);
+  }
+}
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/Module.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/Module.java
index cc51d43..6f18dc1 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/Module.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/Module.java
@@ -16,6 +16,7 @@
 
 import static com.google.gerrit.server.config.ConfigResource.CONFIG_KIND;
 import static com.googlesource.gerrit.plugins.serviceuser.ServiceUserResource.SERVICE_USER_KIND;
+import static com.googlesource.gerrit.plugins.serviceuser.ServiceUserResource.SSH_KEY_KIND;
 
 import com.google.gerrit.extensions.annotations.Exports;
 import com.google.gerrit.extensions.config.CapabilityDefinition;
@@ -38,12 +39,14 @@
       @Override
       protected void configure() {
         DynamicMap.mapOf(binder(), SERVICE_USER_KIND);
+        DynamicMap.mapOf(binder(), SSH_KEY_KIND);
         bind(ServiceUserCollection.class);
         child(CONFIG_KIND, "serviceusers").to(ServiceUserCollection.class);
         get(SERVICE_USER_KIND).to(GetServiceUser.class);
         install(new FactoryModuleBuilder().build(CreateServiceUser.Factory.class));
         get(CONFIG_KIND, "config").to(GetConfig.class);
         put(CONFIG_KIND, "config").to(PutConfig.class);
+        child(SERVICE_USER_KIND, "sshkeys").to(SshKeys.class);
       }
     });
   }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResource.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResource.java
index c8669af..604b27b 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResource.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResource.java
@@ -15,6 +15,7 @@
 package com.googlesource.gerrit.plugins.serviceuser;
 
 import com.google.gerrit.extensions.restapi.RestView;
+import com.google.gerrit.reviewdb.client.AccountSshKey;
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.AccountResource;
 import com.google.inject.TypeLiteral;
@@ -23,8 +24,23 @@
   public static final TypeLiteral<RestView<ServiceUserResource>> SERVICE_USER_KIND =
       new TypeLiteral<RestView<ServiceUserResource>>() {};
 
+  public static final TypeLiteral<RestView<SshKey>> SSH_KEY_KIND =
+      new TypeLiteral<RestView<SshKey>>() {};
 
   public ServiceUserResource(IdentifiedUser user) {
     super(user);
   }
+
+  public static class SshKey extends ServiceUserResource {
+    private final AccountSshKey sshKey;
+
+    public SshKey(IdentifiedUser user, AccountSshKey sshKey) {
+      super(user);
+      this.sshKey = sshKey;
+    }
+
+    public AccountSshKey getSshKey() {
+      return sshKey;
+    }
+  }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/SshKeys.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/SshKeys.java
new file mode 100644
index 0000000..900211c
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/SshKeys.java
@@ -0,0 +1,52 @@
+// Copyright (C) 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.serviceuser;
+
+import com.google.gerrit.extensions.registration.DynamicMap;
+import com.google.gerrit.extensions.restapi.ChildCollection;
+import com.google.gerrit.extensions.restapi.IdString;
+import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
+import com.google.gerrit.extensions.restapi.RestView;
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+
+public class SshKeys implements
+    ChildCollection<ServiceUserResource, ServiceUserResource.SshKey> {
+  private final DynamicMap<RestView<ServiceUserResource.SshKey>> views;
+  private final Provider<GetSshKeys> list;
+
+  @Inject
+  SshKeys(DynamicMap<RestView<ServiceUserResource.SshKey>> views,
+      Provider<GetSshKeys> list) {
+    this.views = views;
+    this.list = list;
+  }
+
+  @Override
+  public RestView<ServiceUserResource> list() {
+    return list.get();
+  }
+
+  @Override
+  public ServiceUserResource.SshKey parse(ServiceUserResource parent, IdString id)
+      throws ResourceNotFoundException {
+    throw new ResourceNotFoundException(id);
+  }
+
+  @Override
+  public DynamicMap<RestView<ServiceUserResource.SshKey>> views() {
+    return views;
+  }
+}
diff --git a/src/main/resources/Documentation/rest-api-config.md b/src/main/resources/Documentation/rest-api-config.md
index ac3e850..2d84b0f 100644
--- a/src/main/resources/Documentation/rest-api-config.md
+++ b/src/main/resources/Documentation/rest-api-config.md
@@ -132,6 +132,40 @@
   }
 ```
 
+### <a id="list-ssh-keys"> List SSH keys
+GET /config/server/@PLUGIN@~serviceusers/\{username\}/sshkeys/_
+
+Lists the SSH keys of a service user.
+
+#### Request
+
+```
+  GET /config/server/@PLUGIN@~serviceusers/JenkinsVoter/sshkeys/ HTTP/1.0
+```
+
+As response a list of [SshKeyInfo](../../../Documentation/rest-api-accounts.html#ssh-key-info)
+entities is returned.
+
+#### Response
+
+```
+  HTTP/1.1 200 OK
+  Content-Disposition: attachment
+  Content-Type: application/json;charset=UTF-8
+
+  )]}'
+  [
+    {
+      "seq": 1,
+      "ssh_public_key": "ssh-rsa AAAAB3NzaC1...",
+      "encoded_key": "AAAAB3NzaC1...",
+      "algorithm": "ssh-rsa",
+      "comment": "jenkins.voter@gerrit.com",
+      "valid": true
+    }
+  ]
+```
+
 ### <a id="get-config"> Get Config
 _GET /config/server/@PLUGIN@~config_