API reference

Object storage

S3-compatible buckets, their access keys, and signed URLs for objects. Objects themselves are read and written with any S3 client at the storage endpoint.

Buckets of an organisation, with how much each holds

GET/v1/orgs/{org}/buckets

API token or dashboard session

Buckets of an organisation, with how much each holds.

Path parameters

orgstringpathrequired
Organisation slug

Responses

200Bucket[]
501Problem

Fields of Bucket

bytesintegerrequired
created_atdate-timerequired
hostnamestringrequired
The bucket's own hostname, for virtual-hosted requests.
iduuidrequired
namestringrequired
objectsintegerrequired
publicbooleanrequired
Whether objects can be read without credentials.
quota_bytesinteger | null
Largest total size allowed, in bytes.

curl "https://api.infraflow.app/v1/orgs/acme/buckets" \
  -H "Authorization: Bearer $INFRAFLOW_TOKEN"

Response · 200

[
  {
    "bytes": 0,
    "created_at": "2026-01-15T09:30:00Z",
    "hostname": "www.example.com",
    "id": "0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55",
    "name": "my-app",
    "objects": 0,
    "public": true,
    "quota_bytes": 0
  }
]

Create a private bucket

POST/v1/orgs/{org}/buckets

API token or dashboard session

Create a private bucket.

Path parameters

orgstringpathrequired
Organisation slug

Request body · application/json

namestringrequired
Lowercase letters, digits and hyphens. Unique across the platform: it becomes the bucket's hostname.

Responses

201Bucket
409Problem
name_taken, bucket_limit
422

Change a bucket's public access or size limit

PATCH/v1/orgs/{org}/buckets/{bucket}

API token or dashboard session

Change a bucket's public access or size limit.

Path parameters

orgstringpathrequired
Organisation slug
bucketstringpathrequired
Bucket name

Request body · application/json

publicboolean | null
Allow anyone to read objects, without credentials.
quota_bytesinteger | null
Size limit in bytes. Send 0 to remove the limit.

Responses

200

Delete an empty bucket and its access keys

DELETE/v1/orgs/{org}/buckets/{bucket}

API token or dashboard session

Delete an empty bucket and its access keys.

Path parameters

orgstringpathrequired
Organisation slug
bucketstringpathrequired
Bucket name

Responses

204no body
409Problem
bucket_not_empty

curl -X DELETE "https://api.infraflow.app/v1/orgs/acme/buckets/photos" \
  -H "Authorization: Bearer $INFRAFLOW_TOKEN"

Access keys of a bucket

GET/v1/orgs/{org}/buckets/{bucket}/keys

API token or dashboard session

Access keys of a bucket. Secrets are not listed.

Path parameters

orgstringpathrequired
Organisation slug
bucketstringpathrequired
Bucket name

Responses

200BucketKey[]

Fields of BucketKey

access_key_idstringrequired
created_atdate-timerequired
id

Create an access key for a bucket

POST/v1/orgs/{org}/buckets/{bucket}/keys

API token or dashboard session

Create an access key for a bucket.

Path parameters

orgstringpathrequired
Organisation slug
bucketstringpathrequired
Bucket name

Request body · application/json

namestringrequired
read_onlyboolean
Allow reading objects but not writing or deleting them.

Responses

201CreatedKey

Delete an access key

DELETE/v1/orgs/{org}/buckets/{bucket}/keys/{id}

API token or dashboard session

Delete an access key. It stops working immediately.

Path parameters

orgstringpathrequired
Organisation slug
bucketstringpathrequired
Bucket name
iduuidpathrequired

Responses

204no body
404Problem

curl -X DELETE "https://api.infraflow.app/v1/orgs/acme/buckets/photos/keys/0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55" \
  -H "Authorization: Bearer $INFRAFLOW_TOKEN"

Sign URLs that let a browser list, read, write and delete objects of a bucket directly at the storage endpoint

POST/v1/orgs/{org}/buckets/{bucket}/objects/sign

API token or dashboard session

Sign URLs that let a browser list, read, write and delete objects of a bucket directly at the storage endpoint. Reading takes the viewer role; anything that writes takes the member role.

Path parameters

orgstringpathrequired
Organisation slug
bucketstringpathrequired
Bucket name

Request body · application/json

expires_secsinteger | null
How long the URLs work, in seconds. Fifteen minutes when omitted; a week at most. Longer than an hour is for links meant to be shared.
operations

[ { "bytes": 0, "created_at": "2026-01-15T09:30:00Z", "hostname": "www.example.com", "id": "0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55", "name": "my-app", "objects": 0, "public": true, "quota_bytes": 0 } ]

Path parameters

Responses

Fields of Bucket

Path parameters

Request body · application/json

Responses

Path parameters

Request body · application/json

Responses

Path parameters

Responses

Path parameters

Responses

Fields of BucketKey

Path parameters

Request body · application/json

Responses

Path parameters

Responses

Path parameters

Request body · application/json

Path parameters

Responses

Fields of Bucket

Path parameters

Request body · application/json

Responses

Path parameters

Request body · application/json

Responses

Path parameters

Responses

Path parameters

Responses

Fields of BucketKey

Path parameters

Request body · application/json

Responses

Path parameters

Responses

Path parameters

Request body · application/json

Fields of Bucket

Fields of Bucket

Responses

Fields of SignedObjects