---
title: "Create a bucket (private by default). Its S3 name is <name>-<6 random characters>"
method: POST
path: "/storage/buckets"
tags: ["Storage"]
---

# Create a bucket (private by default). Its S3 name is <name>-<6 random characters>

`POST /storage/buckets`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/storage/buckets`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Query parameters

- `orgId` string: Organization id (required when you belong to several)

## Request body

- object
  - `name` string, required
  - `visibility` 'private' | 'public': public: every object is readable without credentials at its public URL
  - `quotaBytes` integer: storage quota in bytes (default 1 GiB, capped by what your team has left)
  - `maxObjects` integer, nullable
  - `projectId` string, uuid: link the bucket to a project (it then shows in that project's Storage tab)
  - `cors` object[]
    - `allowedOrigins` string[], required
    - `allowedMethods` string[], required
    - `allowedHeaders` string[]
    - `exposeHeaders` string[]
    - `maxAgeSeconds` integer, nullable

## Response `201`

Created

- object
  - `id` string, uuid, required
  - `organizationId` string, uuid, required
  - `projectId` string, uuid, nullable, required: the project this bucket belongs to, if any
  - `name` string, required: the name you chose, unique in your team
  - `bucket` string, required: the S3 bucket name to use with SDKs and tools (globally unique)
  - `visibility` 'private' | 'public', required: public: every object is readable without credentials at its public URL
  - `status` 'provisioning' | 'active' | 'deleting', required: deleting: objects are being removed in the background; the bucket and its keys no longer work
  - `endpoint` string, required: S3 endpoint (path-style addressing), e.g. https://s3.hostingsurge.app
  - `region` string, required: S3 region to sign requests with
  - `publicUrl` string, nullable, required: base URL of the objects when the bucket is public: <publicUrl><key>
  - `quotaBytes` integer, required
  - `maxObjects` integer, nullable, required
  - `usage` object, required: stored bytes and objects, refreshed every few minutes
    - `bytes` integer, required
    - `objects` integer, required
    - `checkedAt` string, nullable, required: ISO-8601 timestamp
  - `cors` object[], required
    - `allowedOrigins` string[], required
    - `allowedMethods` string[], required
    - `allowedHeaders` string[]
    - `exposeHeaders` string[]
    - `maxAgeSeconds` integer, nullable
  - `createdAt` string, required: ISO-8601 timestamp
  - `updatedAt` string, required: ISO-8601 timestamp

## Other responses

- `400`: Invalid request (code invalid_request)
- `401`: Missing or invalid session/token (code unauthorized)
- `402`: A storage limit or quota is reached (code limit_reached)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After
- `501`: Object storage is not configured on this server (code not_configured)
- `503`: The storage server is unavailable (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)