Add a bucket: AWS S3 (with its region), Cloudflare R2 (with the account ID) or Google Cloud Storage (HMAC keys).

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. Saving writes a small test file under the prefix first; if the bucket refuses it nothing is saved (422 destination_unreachable, with the test in details.test). The keys need permission to put objects under the prefix and nothing else. The first run is within five minutes. Up to 5 destinations (409 too_many_destinations). Behind the warehouseExport flag (and the organizations flag): 404 not_found until it is on for your organization. Each run writes JSON lines under <prefix><dataset>/dt=<date>/<run>-<n>.jsonl and then a manifest at <prefix>manifests/<time>-<run>.json listing the files, their rows and SHA-256; load the files a manifest lists (a file with no manifest is from a run that failed and is written again). Parquet is not written. Keys are stored encrypted and never returned.