Implement API endpoint to get single SSH key for specific user

The main driver for this is to implement a proper and easy to maintain
resource in the [GitLab terraform
provider](https://github.com/gitlabhq/terraform-provider-gitlab).

Changelog: added

doc/api/users.md

@@ -958,6 +958,32 @@ Parameters:
 }
 ```
 
+## Single SSH key for given user
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81790) in GitLab 14.9.
+
+Get a single key for a given user.
+
+```plaintext
+GET /users/:id/keys/:key_id
+```
+
+Parameters:
+
+| Attribute | Type    | Required | Description          |
+|-----------|---------|----------|----------------------|
+| `id`      | integer | yes      | ID of specified user |
+| `key_id`  | integer | yes      | SSH key ID           |
+
+```json
+{
+  "id": 1,
+  "title": "Public key",
+  "key": "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAiPWx6WM4lhHNedGfBpPJNPpZ7yKu+dnn1SJejgt4596k6YjzGGphH2TUxwKzxcKDKKezwkpfnxPkSMkuEspGRt/aZZ9wa++Oi7Qkr8prgHc4soW6NUlfDzpvZK2H5E7eQaSeP3SAwGmQKUFHCddNaP0L+hM7zhFNzjFvpaMgJw0=",
+  "created_at": "2014-08-01T14:47:39.080Z"
+}
+```
+
 ## Add SSH key
 
 Creates a new key owned by the currently authenticated user.

lib/api/users.rb

@@ -383,6 +383,23 @@ module API
         present paginate(keys), with: Entities::SSHKey
       end
 
+      desc 'Get a SSH key of a specified user.' do
+        success Entities::SSHKey
+      end
+      params do
+        requires :id, type: Integer, desc: 'The ID of the user'
+        requires :key_id, type: Integer, desc: 'The ID of the SSH key'
+      end
+      get ':id/keys/:key_id', requirements: API::USER_REQUIREMENTS, feature_category: :authentication_and_authorization do
+        user = find_user(params[:id])
+        not_found!('User') unless user && can?(current_user, :read_user, user)
+
+        key = user.keys.find_by(id: params[:key_id]) # rubocop: disable CodeReuse/ActiveRecord
+        not_found!('Key') unless key
+
+        present key, with: Entities::SSHKey
+      end
+
       desc 'Delete an existing SSH key from a specified user. Available only for admins.' do
         success Entities::SSHKey
       end

spec/requests/api/users_spec.rb

@@ -1735,6 +1735,33 @@ RSpec.describe API::Users do
     end
   end
 
+  describe 'GET /user/:id/keys/:key_id' do
+    it 'gets existing key', :aggregate_failures do
+      user.keys << key
+
+      get api("/users/#{user.id}/keys/#{key.id}")
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response['title']).to eq(key.title)
+    end
+
+    it 'returns 404 error if user not found', :aggregate_failures do
+      user.keys << key
+
+      get api("/users/0/keys/#{key.id}")
+
+      expect(response).to have_gitlab_http_status(:not_found)
+      expect(json_response['message']).to eq('404 User Not Found')
+    end
+
+    it 'returns 404 error if key not found', :aggregate_failures do
+      get api("/users/#{user.id}/keys/#{non_existing_record_id}")
+
+      expect(response).to have_gitlab_http_status(:not_found)
+      expect(json_response['message']).to eq('404 Key Not Found')
+    end
+  end
+
   describe 'DELETE /user/:id/keys/:key_id' do
     context 'when unauthenticated' do
       it 'returns authentication error' do