storage

Get Storage Credentials

Return temporary AWS credentials for the requested S3 path.

Enabled OPERA sources use read-only ASF credentials with provider-controlled scope and expiry (no per-request downscoping); duration must be 3600.

Resolution order: 0. Enabled read-only dataset providers (matching prefix; authorization before cache access)

  1. Managed storage (org file store bucket)
  2. Temp user data bucket (org-scoped prefix)
  3. WherobotsDB releases bucket (if the org has the feature)
  4. User files buckets, which are always refused
  5. User-defined storage integrations (prefix match)

A user files path is refused outright: no client is ever handed credentials that reach a user files area.

payload.access_mode controls whether returned credentials are read-only or include write permissions.

Credentials already held for an identical request are re-served until they approach expiry, so the audit event below records every credential the caller was given, not only the ones freshly minted.

Returns empty credentials for public buckets (no role_arn).

post/storage/credentials

Request

  • Base URL: https://api.cloud.wherobots.com
  • URL: https://api.cloud.wherobots.com/storage/credentials
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-Key

Request body

pathstring required

S3 URI (e.g. s3://bucket/prefix) to obtain credentials for.

access_mode'read' | 'read_write'

Access mode for the credentials. 'read' returns read-only credentials; 'read_write' returns credentials that also allow writing.

duration_secondsinteger

Requested credential lifetime in seconds.

Response

Temporary AWS credentials; OPERA sources use provider-scoped read-only ASF sessions

accessKeyIdstring required
secretAccessKeystring required
sessionTokenstring required
expirationstring date-time required
regionstring required

Changes

No recorded changes to this operation across all 1 revision of this API.