Chelabase
ManagementStorage

Move an object as a role

POST
/v1/databases/{id}/branches/{branch_id}/storage/object/move

Storage's move as the role. Needs the role held at Developer.

Authorization

bearer
AuthorizationBearer <token>

In: header

Path Parameters

id*string

Database id

Formatuuid
branch_id*string

Branch id

Formatuuid

Query Parameters

role?string

The role to act as: row level security on storage.buckets and storage.objects decides what it sees and may do. Absent, owner or the owner's name: owner mode, for an Admin of the database only, which sees and writes past every policy (write-once buckets still hold) and writes objects with no owner (owner null).

claims?string

The JWT claims to run with: a JSON object (at most 4 KiB), {} when absent. Acting as authenticated with {"sub": "<user id>"} shows what that app user sees.

database?string

The Postgres database; the branch's main database when absent. It must be served by the data API.

upsert?boolean

Upload: replace an existing object.

download?string

Download as an attachment; the value is the file name (empty: the object's own).

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

body*unknown

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/databases/497f6eca-6276-4993-bfeb-53cbbbba6f08/branches/497f6eca-6276-4993-bfeb-53cbbbba6f08/storage/object/move"
null

List objects as a role POST

Storage's `POST /storage/v1/object/list/{bucket}` as the role: only the objects its policies show. Needs the role held at Viewer.

Resolve object refs to URLs as a role POST

Storage's `POST /storage/v1/object/resolve` as the role: `{"refs": [...], "expires_in"?}`, at most 1000 refs, each `{bucket_id, name}`, `{bucket, name}` or `{id}`. For each ref, in order: a signed download URL when the role can read the bucket and the object (row level security), the public URL when the bucket is public, and `null` when it can't read it (missing or hidden alike). `expires_in` is 1 to 3600 seconds (default 3600). A signed URL works while it is the object's current version and while you hold the role at Developer on the database (Admin for one resolved in owner mode): one resolved as a role you hold only at Viewer is refused when opened. Needs the role held at Viewer.