Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Retrieve the bucket detail read model
Returns the full bucket detail read model for bucketId in the active scope, as the
console's bucket detail page shows it across its tabs: the bucket identity and properties
(endpoint host, region, owner, object count, total size, default storage class, versioning
state, encryption mode (kmsKeyId is always null), legacy delete protection (objectLock),
block-public-access guardrails, access-logging target, timestamps), the object browser rows
(folders and files with size, content type, storage class and last-modified), the stored
bucket policy document (not enforced), CORS / lifecycle /
replication rule collections, versioned-object groups, server access log entries, recent
activity, key/value tags, and the monitoring series (30-day storage growth, 24-hour
requests and per-status request/egress points). No resource state is mutated.
Validation: scopeId must reference a scope the caller can read (unknown → 404
NOT_FOUND); bucketId must reference an existing, non-deleted bucket visible in that scope
(unknown or soft-deleted → 404 NOT_FOUND); caller must hold reader-or-higher RBAC on the
scope, otherwise 403 FORBIDDEN.
Async & state: Synchronous read; no state change. Later changes (uploads, visibility
flips, rule edits, deletion progress) arrive as resource.updated SSE frames (kind
storage.bucket, patch {objectCount, sizeBytes, visibility, versioning, status}).
Errors: 401 missing/expired session; 403 caller lacks read access; 404 unknown
scopeId or bucketId; 500 unexpected backend failure.
Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response
carries an ETag that subsequent mutations (policy update, rule create/delete, bucket
delete) present via If-Match. Presigned URLs are never echoed back in this read model.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
bucketId*stringIdentifier of the bucket.
Bucket detail read model including objects, policy, rules, versions, logs, activity, tags and metrics.
application/json- response
Full bucket detail read model behind every tab of the bucket detail page.
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"status*BucketStatusLifecycle status of a bucket. creating until its Swift container exists; active; deleting while the delete Operation drains and removes it (object operations, rule changes and a second delete are refused with 409); error when a create or delete failed (the bucket can be deleted again).
"creating""active""deleting""error"id*stringname*stringGlobally unique, DNS-compatible bucket name used as the S3 endpoint host.
region*RegionIdPlatform region code (a DNS-label-shaped slug, e.g. ist-1). No longer a closed enum: the set of valid region codes is operator-managed in the platform-region registry, so this carries only a shape guard. The authoritative set of activated regions is read from GET /regions; invalid-shape codes are VALIDATION_FAILED and codes absent from the registry are rejected at the resolving endpoint.
^[a-z][a-z0-9-]{1,39}$objectCount*integersizeBytes*integervisibility*BucketVisibilityAccess visibility of a bucket. Authenticated can no longer be set (no container ACL is written for it); a bucket that carries it from before is reported as stored, but the only read ACL ever written for it is the private one.
"Private""Public""Authenticated"versioning*booleanencryption*BucketEncryptionWhether the bucket's data is encrypted at rest. NONE = not encrypted;
AT_REST = encrypted at rest by the object store with platform-managed keys. Set at
bucket creation from the region's operator-asserted capability and never changed
afterwards (the object store encrypts at write time). There are no S3 modes and no
customer-managed keys.
"NONE""AT_REST"kmsKeyId*|Always null -- customer-managed (KMS) keys are not offered.
storageClass*ObjectStorageClassStorage class of a bucket, echoed on its objects. Saved with the bucket; it doesn't change how objects are stored or billed.
"Standard""Infrequent Access""Archive"blockPublicAcls*booleanIgnore ACLs that grant public access.
blockPublicPolicy*booleanWhile true, visibility cannot be set to Public (409). Bucket policy statements are not supported at all.
objectLock*booleanLegacy platform delete protection. Enforced only on this API and the console; the object store itself does not enforce it. Direct OpenStack Swift access with the project's own credentials can delete objects. No new bucket can enable it.
accessLogging*booleanlogTarget*stringServer access log target bucket.
owner*stringcreatedAt*stringdate-timeupdatedAt*stringdate-timeendpoint*|Virtual-hosted-style S3 endpoint host for the bucket, derived from the operator-configured object-store gateway host ({name}.{gateway}). Null when no gateway is configured (no fabricated host is reported).
objects*array<>policyJson*stringStored bucket policy JSON document. Not enforced: the object store has no bucket-policy engine, so only a document without statements can be written. A document with statements stored before that is returned as stored but was never applied.
corsRules*array<>CORS rules, merged into the bucket's one Swift container CORS policy.
corsApply*|Whether the latest CORS rule change has reached the Swift container: the state of the bucket's newest objectstore.bucket.cors.apply Operation. Null when the bucket's CORS rules were never changed.
lifecycleRules*array<>Always empty for new buckets: lifecycle is not supported by the object store (new rules are refused with lifecycle_not_supported). A rule stored before that is listed but was never applied.
replicationRules*array<>Always empty for new buckets: replication is not supported by the object store (new rules are refused with replication_not_supported). A rule stored before that is listed but was never applied.
versionedObjects*array<>accessLogs*array<>activity*array<>tags*array<>growth30d*array<>requests24h*array<>requestStatus24h*array<>curl -X GET "https://example.com/scopes/string/storage/buckets/string"{ "origin": "portal", "status": "creating", "id": "string", "name": "string", "region": "string", "objectCount": 0, "sizeBytes": 0, "visibility": "Private", "versioning": true, "encryption": "NONE", "kmsKeyId": "string", "storageClass": "Standard", "blockPublicAcls": true, "blockPublicPolicy": true, "objectLock": true, "accessLogging": true, "logTarget": "string", "owner": "string", "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z", "endpoint": "string", "objects": [ { "key": "string", "kind": "folder", "sizeBytes": 0, "contentType": "string", "storageClass": "Standard", "lastModified": "2019-08-24T14:15:22Z" } ], "policyJson": "string", "corsRules": [ { "id": "string", "origins": [ "string" ], "methods": [ "string" ], "headers": [ "string" ], "maxAgeSeconds": 0 } ], "corsApply": { "status": "pending", "message": "string", "operationId": "string", "updatedAt": "2019-08-24T14:15:22Z" }, "lifecycleRules": [ { "id": "string", "name": "string", "prefix": "string", "enabled": true, "action": "string", "days": 0 } ], "replicationRules": [ { "id": "string", "name": "string", "prefix": "string", "destination": "string", "destinationRegion": "string", "storageClass": "string", "status": "Enabled", "rtoMinutes": 0 } ], "versionedObjects": [ { "key": "string", "versions": [ { "versionId": "string", "sizeBytes": 0, "isLatest": true, "isDeleteMarker": true, "storageClass": "string", "lastModified": "2019-08-24T14:15:22Z" } ] } ], "accessLogs": [ { "id": "string", "at": "2019-08-24T14:15:22Z", "remoteIp": "string", "requester": "string", "operation": "string", "key": "string", "status": 0, "bytes": 0, "latencyMs": 0 } ], "activity": [ { "id": "string", "at": "2019-08-24T14:15:22Z", "actor": "string", "event": "string", "detail": "string" } ], "tags": [ { "key": "string", "value": "string" } ], "growth30d": [ { "t": "string", "storageGb": 0, "objects": 0 } ], "requests24h": [ { "t": "string", "requests": 0 } ], "requestStatus24h": [ { "t": "string", "ok": 0, "clientErr": 0, "serverErr": 0, "egressGb": 0 } ]}