---
title: "Update storage settings"
method: PUT
path: "/storage/settings"
tags: ["Storage"]
---

# Update storage settings

`PUT /storage/settings`

Replaces the account-level storage lifecycle settings applied to newly
uploaded fal CDN files. Omitted or null fields are cleared (reset to the
system default), so always send the full desired configuration. Sending an
empty JSON object `{}` clears all settings. To change a single setting,
first GET the current settings and PUT the full object back with only that
field changed.

A request whose body is not valid JSON (including a zero-length body) or
whose Content-Type is not `application/json` is rejected with a 400
`validation_error` and the stored settings are unchanged.

ACL rules referencing users that do not exist are dropped. The response
reflects the settings actually saved, so verify it contains the rules you sent.

These are the same settings that the per-request
`X-Fal-Object-Lifecycle-Preference` header overrides on individual requests.

**Authentication:** Required. The API key must have the `account:settings:write` permission.

## Request body

- object — Account-level storage lifecycle settings
  - `expiration_duration_seconds` integer, nullable — Seconds after which newly uploaded files automatically expire and are deleted. Null disables auto-expiration.
  - `initial_acl` object, nullable — Default ACL applied to newly uploaded files. Null uses the system default (public).
    - `default` 'allow' | 'forbid' | 'hide', required — Fallback decision when no user-specific rule matches
    - `rules` object[] — User-specific overrides to the default decision
      - `user` string, required — User nickname or user ID the rule applies to
      - `decision` 'allow' | 'forbid' | 'hide', required — Access decision applied to this user

## Response `200`

Storage settings after the update

- object — Account-level storage lifecycle settings
  - `expiration_duration_seconds` integer, nullable, required — Seconds after which newly uploaded files automatically expire, or null if auto-expiration is disabled
  - `initial_acl` object, nullable, required — Default ACL applied to newly uploaded files, or null if the system default (public) is used
    - `default` 'allow' | 'forbid' | 'hide', required — Fallback decision when no user-specific rule matches
    - `rules` object[], required — User-specific overrides to the default decision. Users are returned as nicknames where possible.
      - `user` string, required — User nickname or user ID the rule applies to
      - `decision` 'allow' | 'forbid' | 'hide', required — Access decision applied to this user

## Other responses

- `400` — Invalid request parameters
- `401` — Authentication required
- `403` — Access denied
- `429` — Rate limit exceeded
- `500` — Internal server error

---

[API](https://skmtc.dev/fal/apis/platform-apis.md) · [All operations](https://skmtc.dev/fal/apis/platform-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fal/platform-apis/revisions/0c7dabf80b00/schema)