Object storage management API

Object storage management API

Create private buckets, issue scoped object credentials, and inspect retained dependencies.

Object-storage management uses the control-plane API. Object upload, download, and multipart operations use the returned S3-compatible data endpoint and separately scoped object credentials.

POST/organizations/{organization_id}/projects/{project_id}/buckets
Scope
objects:write
Auth
Bearer API key

Creates a private application bucket.

Send name, region ID, supported encryption-domain reference, and optional versioning, default false. The bucket name must satisfy the endpoint's DNS-compatible namespace and availability rules.

To create a private bucket with versioning, send this body:

JSON
{
  "name": "payments-attachments",
  "region_id": "reg_euwest",
  "encryption_domain_id": "enc_project",
  "versioning": true
}

Returns 202 with bucket ID and provisioning operation. Invalid names, foreign-region domains, and quota failures reject admission.

Credentials and policy

POST/organizations/{organization_id}/projects/{project_id}/object-credentials
Scope
objects:write
Auth
Bearer API key

Issues scoped credentials for the object-storage data endpoint.

Requires objects:write and credential-issuance permission. Supply principal, allowed bucket IDs, prefixes, operations, and required expiry. The 201 response reveals the secret once. The credential cannot authorize ordinary control-plane mutations.

PATCH/organizations/{organization_id}/projects/{project_id}/buckets/{bucket_id}/policy
Scope
objects:write
Auth
Bearer API key

Updates bucket access policy.

Bucket policy updates require its ETag. Public access remains disabled unless explicitly permitted by organization policy. An external S3 client uses the bucket's returned service endpoint, not the console origin.

Read and delete

GET/organizations/{organization_id}/projects/{project_id}/buckets/{bucket_id}
Scope
objects:read
Auth
Bearer API key

Returns endpoint, region, versioning, policy references, state, and retained dependencies. Requires objects:read. Secret values are excluded.

DELETE/organizations/{organization_id}/projects/{project_id}/buckets/{bucket_id}
Scope
objects:write
Auth
Bearer API key

Deletes an empty bucket when retention permits removal.

Deletion requires the current ETag and an empty eligible bucket. Versions, delete markers, multipart data, or holds return 409 bucket_not_empty or bucket_retained with dependency classes. The API does not silently purge all versions because no current object is visible.

See object buckets, retention, and backup destinations.