Full S3 operation reference
buckets.ninja is a full S3-compatible object store. If your tool speaks the S3 API — rclone, aws-cli, Cyberduck, Veeam,
Restic, or your own SDK — it works here. This page is the reference for the endpoint, which operations are supported,
how requests are billed, and the few operations we deliberately do not expose.
Endpoint
| | | | --------------- | ----------------------------------------------------------------------- | | Endpoint |
https://s3.buckets.ninja | | Region | any value is accepted | | Addressing | Virtual-host style
(bucket.s3.buckets.ninja) and path style both work | | TLS | Required — HTTPS only | | Credentials | Access key + secret
from Buckets → Access keys in the panel |
Buckets are created and deleted in the panel, not over the API — see "What is not exposed" below. Once a bucket exists,
everything inside it is done over S3.
Billing classes
Requests fall into three classes. Writes are always free; reads and metadata have generous monthly free tiers that reset
on the 1st of each month. You are only billed for overage beyond the free tier.
| Class | Operations | Free tier | Overage | | ---------------- | ------------------------------------------- |
--------------- | ----------------- | | A — Writes | PUT, POST, multipart uploads, bucket config | Unlimited | Always
free | | B — Reads | GET, HEAD, downloads | 100,000 / month | €0.40 per million | | C — Metadata | LIST, COPY, bucket
listings | 100,000 / month | €2.00 per million |
Storage is €7.99 per TB per month (1 TB minimum). Each TB you commit includes 1 TB of egress; egress beyond that is
€3.00 per TB. Ingress (uploads) is always free.
Supported operations
Objects
| Operation | S3 action | Class | | ---------------- |
------------------------------------------------------------------------------------------- | ----- | | Upload object |
PutObject | A | | Multipart upload | CreateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload,
ListParts | A | | Download object | GetObject, GetObjectVersion | B | | Object metadata | HeadObject | B | | List
objects | ListObjectsV2, ListObjectVersions | C | | Copy object | CopyObject | C | | Delete object | DeleteObject,
DeleteObjectVersion | A | | Object tags | GetObjectTagging, PutObjectTagging | B / A | | Pre-signed URLs | signed GET /
PUT | B / A |
Buckets (configuration only)
| Operation | S3 action | Class | | ------------------ | ---------------------------------------------------- | ----- |
| Bucket location | GetBucketLocation | C | | Versioning | GetBucketVersioning, PutBucketVersioning | C / A | | Object
lock config | GetObjectLockConfiguration | C | | Lifecycle rules | GetLifecycleConfiguration, PutLifecycleConfiguration
| C / A |
Versioning is toggled per bucket from the panel as well as over the API.
Immutability (object lock)
Object lock is supported in Governance mode: you can make an object immutable against accidental deletion, ransomware,
and your own tooling.
- ✓ PutObjectRetention in GOVERNANCE mode, and reading retention / legal-hold state.
- ✗ COMPLIANCE mode retention and PutObjectLegalHold are not available. Governance retention is available and gives
you strong protection while keeping that guarantee intact.
What is not exposed, and why
- CreateBucket / DeleteBucket — buckets are managed in the panel, so provisioning and billing stay in one place. Your
keys cannot create or delete buckets over S3; everything else inside them works normally.
If your client tries to list all buckets at startup (some do), point it directly at a known bucket name rather than
relying on discovery, and it will work.
Tested clients
rclone, aws-cli, Cyberduck, Veeam, Restic, and anything built on the AWS SDKs. rclone needs three specific settings to
handle our at-rest encryption correctly — the panel's downloadable rclone.conf includes them, and there is a separate
guide explaining why.
