As per Michael's reponse you need to access the WSDL for both Target and Runtime User.
Make sure you have enabled the TEO NBWS first(under file->server properties->web service in the master UI). Port 61527 for http, 61526 for HTTPS (both defaults)
For Unix connections I have done the exact thing you describe and I used the telnet target type as I find it easiest to work with.
I do a 3 step process... create runtime user, extract the GUID of that Runtime User from the output of the web services call, and then create the SSH connection and pass the GUID of the Runtime User into the SSH connection web service call.
Here is a screenshot of the create runtime user:
I extract the guid by using a match regular expression on ".*" and then doing a substring on that result.
Here is a screenshot fo the create SSH connection:
If you need further help, let me know or if you would like a copy of the work, I can extract to a tap.
i use a find target to grab the new target after it's made and then set the target as a target reference = found target. If you still need open please open a TAC case and myself or someone from my team can help with a quick webex.