Using the S3 API

IBEE Object Storage has two APIs, and they split the work the same way the portal does.

This is how Cloudflare R2 and E2E split it too. DigitalOcean and Hetzner push everything to S3; we don’t, because a few S3 bucket-configuration calls are not served on our endpoint (see below).

Credentials

Create an S3 credential with POST /v1/object-storage/credentials (or in the portal under Org → API Tokens → S3). The response shows the access key, the secret key once, and the endpoint. Scope it to one bucket with bucket_scope and allowed_buckets when the application needs only that bucket.

Endpoint and signing

Use signature version 4, path-style addressing, and the region returned on the bucket (region on GET /v1/object-storage/buckets/{bucket_name}).

aws configure set default.s3.addressing_style path
aws --endpoint-url https://<s3-endpoint> s3 ls s3://my-bucket/
aws --endpoint-url https://<s3-endpoint> s3 cp ./report.pdf s3://my-bucket/reports/report.pdf

Any S3 SDK works the same way: set the endpoint, the region and path-style addressing.

Served on the S3 endpoint

Object operations: PutObject, GetObject, HeadObject, DeleteObject, DeleteObjects, CopyObject, ListObjectsV2, multipart (CreateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload, ListMultipartUploads), presigned URLs for any of them. Bucket reads: ListBuckets, HeadBucket, GetBucketLocation.

A folder is an object key that ends with /. Emptying a bucket is ListObjectsV2 plus DeleteObjects (aws s3 rm s3://my-bucket --recursive).

Not served on the S3 endpoint

These answer 501 Not Implemented on the S3 endpoint. Use the REST operation instead, or the portal where no operation exists yet.

Related

• Buckets
• Presigned URLs
• API credentials