Get a bucket's data-management settings.

GET

/v1/projects/{projectId}/objectstorage/buckets/{bucketId}/settings

Shell / cURL

curl --request GET \
  --url https://stratum.example.com/v1/projects/example/objectstorage/buckets/example/settings \
  --header 'Authorization: Bearer <token>'

Versioning, encryption (SSE-S3), lifecycle. Cedar s3:GetBucketSettings.

Authorizations

bearerAuth

Parameters

Path Parameters

projectId

required

string

/^p-[a-z0-9-]+$/

bucketId

required

string

The bucket id.

Responses

200

Settings.

application/json

Per-bucket data-management settings.

object

versioning

Object versioning state.

string

Allowed values: "" Enabled Suspended

encryption

Default server-side encryption. AES256 = SSE-S3 (RGW-managed keys); aws:kms = SSE-KMS (per-project OpenBao transit key,); empty = none. Both require the corresponding RGW backend to be wired (else the API rejects the change).

string

Allowed values: "" AES256 aws:kms

lifecycle

Lifecycle rules document — a minio-go lifecycle.Configuration JSON, e.g. {“Rules”:[{“ID”:“expire-logs”,“Status”:“Enabled”, “Filter”:{“Prefix”:“logs/”},“Expiration”:{“Days”:90}}]}. An empty or rules-empty document clears all rules. Each rule needs a unique ID, a Status of Enabled|Disabled, and at least one action.

string

logging

S3 server access-logging destination, as a JSON object: {“targetBucket”:“audit-logs”,“targetPrefix”:“s3/”}. An empty document, or one with an empty targetBucket, disables logging. The target must be a bucket in the SAME project, must be available, and must not be the source bucket itself. Access logs record who read what, so a target in another project would be both an exfiltration channel out and a write primitive in; a bucket logging to itself is an unbounded feedback loop, since each log write is a request that generates another record. Enabling logging also installs the log-delivery bucket policy RGW requires on the TARGET bucket. That policy uses tenant-qualified ARNs and a service principal, which the bucket-policy API deliberately rejects, so it cannot be supplied by hand.

string

acl

Canned S3 bucket ACL. private is the default. The public-* values grant anonymous access and require allowPublic: true.

string

Allowed values: private public-read public-read-write authenticated-read

allowPublic

Request-only opt-in required to set a public-* acl (mirrors the bucket policy allowPublic gate,). Not returned on GET.

boolean

Example

{
  "versioning": "",
  "encryption": "",
  "acl": "private"
}

403

Authenticated but not authorized.

application/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

404

Resource not found.

application/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}