---
title: "POST /api/v1/hosting/apps/{app_id}/storage_resources"
method: POST
path: "/api/v1/hosting/apps/{app_id}/storage_resources"
tags: ["hosting"]
---

# POST /api/v1/hosting/apps/{app_id}/storage_resources

`POST /api/v1/hosting/apps/{app_id}/storage_resources`

## Request

- Base URL: `https://composal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://composal.com/api/v1/hosting/apps/{app_id}/storage_resources`
- Auth: HTTP bearer

Preview-owned storage can be created only while the preview is paused with cleanup complete. Creation and provisioning are fenced against preview teardown.

## Path parameters

- `app_id` string, required

## Request body

- AppStorageResourceCreatePayload
  - `app_environment_id` string
  - `location_id` string: Required for volume kind. nomad_csi needs a CSI-plugin-enabled location; local_nvme works in any location and pins the volume to that datacenter
  - `slug` string, required
  - `name` string, required
  - `kind` 'bucket' | 'volume', required
  - `provider` 's3' | 'tigris' | 'nomad_csi' | 'local_nvme' | 'local_nvme_authority', required: Storage backend. `local_nvme` volumes are node-local NVMe caches and are EPHEMERAL by contract — deletable at any time, gone with their node, and safe to lose. They ignore capacity_gb (it is advisory) and are not resizable. `local_nvme_authority` provisions one pinned single-writer directory and refuses destructive repair or empty replacement after node loss. Remote replication and fenced restoration are required for repository authority durability.
  - `region` string
  - `access_mode` 'private' | 'public' | 'internal', required
  - `mount_path` string
  - `capacity_gb` integer: Enforced for nomad_csi (minimum 10 GB). Advisory only for local_nvme, which claims no reservation
  - `status` 'provisioning' | 'available' | 'updating' | 'failed' | 'archived', required

## Response `200`

App storage resource created

- object
  - `storage_resource` AppStorageResource, required
    - `id` string, required
    - `hosted_app_id` string, required
    - `app_environment_id` string, nullable, required
    - `location_id` string, nullable, required: Volume datacenter pin (volume kind only)
    - `location_code` string, nullable, required
    - `slug` string, required
    - `name` string, required
    - `kind` 'bucket' | 'volume', required
    - `provider` 's3' | 'tigris' | 'nomad_csi' | 'local_nvme' | 'local_nvme_authority', required: Storage backend. `local_nvme` is a directory on the node's own NVMe, created as a Nomad dynamic host volume — fast, node-local and EPHEMERAL: the platform may delete it at any time and it does not survive the loss of its node. Use it as a cache, never as a system of record. `local_nvme_authority` is a single-node, single-writer authority volume that refuses destructive repair. Node loss requires restoration from remote replication into a new volume.
    - `region` string, nullable, required
    - `access_mode` 'private' | 'public' | 'internal', required: Object-store semantics only; ignored for volume resources
    - `mount_path` string, nullable, required
    - `capacity_gb` integer, nullable, required
    - `capacity_label` string, nullable, required
    - `status` 'provisioning' | 'available' | 'updating' | 'failed' | 'archived', required
    - `external_volume_id` string, nullable, required: Nomad/CSI volume id assigned at provisioning
    - `attachment` object, nullable, required: Attachment readback: CSI publish state for nomad_csi, or the nodes carrying the directory for local_nvme. Nil until provisioned
      - `state` 'attached' | 'detached'
      - `node_ids` string[]
      - `alloc_ids` string[]
    - `ephemeral` boolean, required: True when the contents may be deleted at any time and do not survive the loss of the underlying node. Ephemeral storage is a cache and must never hold a system of record.
    - `provider_error` string, nullable, required: Last provisioning/teardown error from the storage provider
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required

## Other responses

- `201`: App storage resource created
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `409`: Preview is active, archived, expired, or waiting for cleanup
- `422`: Infrastructure request failed validation
- `502`: Bad gateway

---

[API](https://skmtc.dev/composal/apis/vex-api.md) - [All operations](https://skmtc.dev/composal/apis/vex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/composal/apis/vex-api/revisions/74298a24e040?raw)