Upload, download and delete objects

An object is a file stored in a bucket under a key, its full name, such as photos/2026/beach.jpg. The Buckets tab has an object browser where you upload, download and delete objects. For large files, many files or whole folder trees, use an S3 client (Connect an S3 client).

The object browser does not use your access keys. We sign a short-lived link for each upload, download and folder, and your browser sends the data straight to storage over that link. You can use the browser before you create a key.

• Sign in to the dashboard and open the service.
• The bucket must exist (Create a bucket).
• To upload, create folders or delete objects, the service must be active. You can browse and download in any status.

1. Open the service and select the Buckets tab.
2. Select the bucket's name, or Browse objects in its menu. The bucket's page opens on its Objects tab.

The header shows the bucket's name, its address to copy, its region, and the number of objects and their size from the last hourly measurement. All buckets goes back to the list. The tabs under the header open the bucket's Settings and its other sections. The refresh button at the top of the Objects card lists the folder again.

S3 has no real folders. The browser treats the part of a key before each / as a folder, so photos/beach.jpg shows as beach.jpg inside the folder photos. The list shows folders first, then objects with their Size and the time they were Modified.

• Select a folder to open it. The path above the list starts at Buckets and ends at the folder you are in. Select any part of it to go back up. The folder is part of the page address, so the back button and bookmarks work.
• To find objects, type the start of their name in the search box, which reads Keys starting with…. The list narrows to the keys in the current folder that start with what you typed.
• The list shows 200 entries at a time. Select Load more for the next 200.

1. Open the folder you want the files in.
2. Select Upload… and choose one or more files. You can also drag files from your computer and drop them on the list.
3. Follow each upload in the Transfers panel at the bottom right of the page. Select Cancel to stop an upload that is running, or Dismiss to clear one that has ended.

Each file becomes an object whose key is the folder path and the file name, such as photos/beach.jpg.

The browser sends each file in a single request, and it cannot upload a folder with its contents. For a folder tree, or a file of several gigabytes, use an S3 client: aws s3 sync and rclone copy upload whole folders and send large files in parts.

Pages on your own website can upload from the browser with presigned URLs. Until the bucket has CORS rules, a page on any website can do so. Once it has rules, only the sites they allow can (How the bucket answers browsers).

1. Open the folder to create the new folder in.
2. Select New folder…. A form opens above the list, with Folder name in focus.
3. Type a name, such as photos, and press Enter or select Create folder. Escape or Cancel closes the form.

A message confirms Folder created. A name that a folder here already has shows A folder named photos is already here. under the field. The browser writes an empty object named after the folder with a / at the end, such as photos/, so the folder shows before it holds anything. A / inside the name creates a folder within a folder, such as 2026/09. We remove a / at the start or the end of the name, and a backslash is refused.

Folders also appear on their own. When an S3 client uploads photos/beach.jpg, the browser shows a photos folder even though nobody created it.

Select Download in the object's menu, or select its name and then Download at the top of the object's page. Your browser saves the file under the last part of its key, such as beach.jpg. The page also shows the object's size, type, metadata and tags (See a version's details). Its address is the bucket's Objects address with ?object= and the key, so you can bookmark it or send it to a colleague. Objects in and the folder's name at the top of the page go back to the list you came from.

The object browser downloads one object at a time. To download a folder or many objects, use an S3 client, for example aws --profile coritan s3 cp s3://u7-assets/photos/ ./photos/ --recursive.

To delete one object:

1. Open the object's menu and select Delete object….
2. Select Delete object to confirm.

To delete several objects, or a folder with everything in it:

1. Tick the box beside each object or folder. The box in the heading selects every entry in the list. For one folder, you can also select Delete folder… in its menu.
2. Select the button that gives the number of entries, such as Delete 3 items….
3. Type the number of items, such as 3 items, and confirm.

The Transfers panel follows the deletion. A message then says what was deleted, such as 1,284 objects deleted. Deleting a folder deletes every object under it, including its folders.

The browser deletes up to 10,000 objects under each folder in one run. When a folder holds more, the message A folder had more than the browser deletes at once; run the delete again for the rest. appears. Repeat the delete until the folder is gone. An S3 client deletes a large folder in one command, such as aws --profile coritan s3 rm s3://u7-assets/photos/ --recursive.

A presigned URL is a link that carries its own signature. It lets anyone who has it download, upload or delete one object, whichever it was signed for, without an access key. It works as many times as they like until it expires. The dashboard has no button for it. Create one through the API (Presign an object), or with an S3 client and one of your keys:

aws --profile coritan s3 presign s3://u7-assets/reports/2026-09.pdf --expires-in 3600

A link from the API lasts 15 minutes unless you ask for longer, and 1 hour at most. We sign it ourselves, so revoking an access key does not affect it. A link from an S3 client is signed with your key, so it stops working when it expires or when you revoke that key.

Every request made with a link counts as one of your requests, whoever makes it, and we bill it to your account (Which requests count).

The browser shows each change as soon as it finishes. The object count and size in the header, on the Buckets tab and on the Overview tab follow at the next hourly measurement.

Could not reach the storage endpoint

Your browser could not connect to the region's endpoint on its port (7337, or 443 where the endpoint has no port). A firewall, proxy or VPN on your network may block that port. Try another network, or ask whoever runs yours to allow outgoing HTTPS on its port (7337, or 443 where the endpoint has no port).

Could not upload beach.jpg with The upload link expired or was refused

Storage refused the upload. Reload the page and upload the file again. If it keeps happening, contact support.

Could not upload beach.jpg with Upload failed and a number

Storage answered the upload with that HTTP status. Upload the file again. For a large file, use an S3 client, which sends it in parts.

Could not prepare the download

We could not sign the download link. The message beside it gives the reason. Try again.

Bucket not found

The bucket was deleted, or the address belongs to another service. Select All buckets to go back to the list.

Could not delete 2 objects.

Storage refused some of the deletions. The rest went through. Run the delete again.

Upload… and New folder… are missing

The service is not active, so you cannot change its objects. You can still browse and download.

A folder is still there after you deleted everything in it

The folder has an empty folder object, written by New folder… or by a client. Delete the folder itself with Delete folder….

The size in the header did not change

We measure each bucket once an hour. The header shows the last measurement.

• Create and delete buckets
• Keep earlier versions of objects
• Connect an S3 client
• Object Storage limits
• Troubleshoot Object Storage

Each request takes the service ID and the bucket's id from List buckets. A bucket that is not on the service answers 404 with Bucket not found.

GET /api/v1/client/object-storage/{service_id}/buckets/{bucket_id}/objects lists one page of a bucket. It takes these query parameters:

prefix

Lists only keys that start with it, up to 1024 characters. Give a folder with its /, such as photos/.

max_keys

How many entries a page holds, from 1 to 1000. The default is 200.

token

The next_token of the previous page, to read the next one.

flat

true lists every key under the prefix, with no folders. The default, false, groups keys into folders at each /.

curl "https://api.coritan.com/api/v1/client/object-storage/1207/buckets/31/objects?prefix=photos/&max_keys=100" \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "items": [
    {"key": "photos/2026/", "size": null, "last_modified": null, "etag": null, "is_prefix": true},
    {"key": "photos/beach.jpg", "size": 2483027, "last_modified": "2026-09-20T14:02:11+00:00", "etag": "9b2cf535f27731c974343645a3985328", "is_prefix": false}
  ],
  "prefix": "photos/",
  "next_token": null
}

Each page lists its folders first, with is_prefix set to true and no size. size is in bytes. next_token is null on the last page.

POST /api/v1/client/object-storage/{service_id}/buckets/{bucket_id}/objects/presign returns a presigned URL for one object. The body takes:

key

Required. The object's key, up to 1024 bytes. A key that ends in / works only with put, which is how the browser creates a folder.

op

Required. get to download, put to upload, or delete to delete.

expires

How long the link lasts, in seconds, from 60 to 86400. We shorten anything above 3600 to 3600. The default is 900.

content_type

For put, the object's content type, such as application/pdf, up to 255 characters.

download

For get, true makes browsers save the file under the last part of its key instead of opening it.

version_id

For get, the version to download, from the versions list. Leave it out for the current version. The answer then carries the same version_id. With put or delete, the request answers 400 with A version can only be downloaded.

curl -X POST https://api.coritan.com/api/v1/client/object-storage/1207/buckets/31/objects/presign \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"key": "reports/2026-09.pdf", "op": "get", "expires": 3600, "download": true}'

{
  "url": "https://s3.fra.coritan.com:7337/u7-assets/reports/2026-09.pdf?response-content-disposition=attachment%3B%20filename%3D%222026-09.pdf%22&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=...&X-Amz-Date=20260926T100000Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=...",
  "method": "GET",
  "headers": {},
  "expires_in": 3600,
  "expires_at": "2026-09-26T11:00:00+00:00"
}

Send a request with method to url before expires_at, with every header in headers. expires_in is the lifetime you got, after any shortening. To upload, ask for put and send the file as the request body:

curl -X PUT --upload-file 2026-09.pdf \
  -H "Content-Type: application/pdf" \
  "https://s3.fra.coritan.com:7337/u7-assets/reports/2026-09.pdf?X-Amz-Algorithm=..."

When you send content_type, headers holds Content-Type with that value, and the upload must carry it unchanged.

The errors: 400 An object key is required for an empty key or a key that ends in / with get or delete, and 400 Object keys are at most 1024 bytes.

DELETE /api/v1/client/object-storage/{service_id}/buckets/{bucket_id}/objects deletes up to 1000 objects by key. It does not expand folders, so list the keys under a folder with flat=true first.

curl -X DELETE https://api.coritan.com/api/v1/client/object-storage/1207/buckets/31/objects \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keys": ["photos/beach.jpg", "photos/2026/"]}'

{"deleted": 2, "errors": []}

deleted counts the keys that storage did not refuse, including keys that did not exist. errors lists each refused key with its key, code and message.