---
title: "Change visibility (public/private), quota, object limit, CORS rules or the linked project"
method: PATCH
path: "/storage/buckets/{bucketId}"
tags: ["Storage"]
---

# Change visibility (public/private), quota, object limit, CORS rules or the linked project

`PATCH /storage/buckets/{bucketId}`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/storage/buckets/{bucketId}`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `bucketId` string, uuid, required

## Request body

- object
  - `visibility` 'private' | 'public': public: every object is readable without credentials at its public URL
  - `quotaBytes` integer
  - `maxObjects` integer, nullable
  - `projectId` string, uuid, nullable: null unlinks the bucket from its project
  - `cors` object[]: replaces every CORS rule; [] removes them
    - `allowedOrigins` string[], required
    - `allowedMethods` string[], required
    - `allowedHeaders` string[]
    - `exposeHeaders` string[]
    - `maxAgeSeconds` integer, nullable

## Response `200`

Updated

- object
  - `id` string, uuid, required
  - `organizationId` string, uuid, required
  - `projectId` string, uuid, nullable, required: the project this bucket belongs to, if any
  - `name` string, required: the name you chose, unique in your team
  - `bucket` string, required: the S3 bucket name to use with SDKs and tools (globally unique)
  - `visibility` 'private' | 'public', required: public: every object is readable without credentials at its public URL
  - `status` 'provisioning' | 'active' | 'deleting', required: deleting: objects are being removed in the background; the bucket and its keys no longer work
  - `endpoint` string, required: S3 endpoint (path-style addressing), e.g. https://s3.hostingsurge.app
  - `region` string, required: S3 region to sign requests with
  - `publicUrl` string, nullable, required: base URL of the objects when the bucket is public: <publicUrl><key>
  - `quotaBytes` integer, required
  - `maxObjects` integer, nullable, required
  - `usage` object, required: stored bytes and objects, refreshed every few minutes
    - `bytes` integer, required
    - `objects` integer, required
    - `checkedAt` string, nullable, required: ISO-8601 timestamp
  - `cors` object[], required
    - `allowedOrigins` string[], required
    - `allowedMethods` string[], required
    - `allowedHeaders` string[]
    - `exposeHeaders` string[]
    - `maxAgeSeconds` integer, nullable
  - `createdAt` string, required: ISO-8601 timestamp
  - `updatedAt` string, required: ISO-8601 timestamp

## Other responses

- `400`: Invalid request (code invalid_request)
- `401`: Missing or invalid session/token (code unauthorized)
- `402`: A storage limit or quota is reached (code limit_reached)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After
- `501`: Object storage is not configured on this server (code not_configured)
- `503`: The storage server is unavailable (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)