Chelabase
ManagementStorage

Create a signed download URL as a role

POST
/v1/databases/{id}/branches/{branch_id}/storage/object/sign/{bucket}/{name}

Storage's signed download URL, minted as the role (it must be able to read the object). expires_in is 1 to 3600 seconds (default 3600). The URL works while it is the object's current version and while you still hold the role at Developer on the database; it stops when you are removed or the role's level drops below Developer. Needs the role held at Developer.

Authorization

bearer
AuthorizationBearer <token>

In: header

Path Parameters

id*string

Database id

Formatuuid
branch_id*string

Branch id

Formatuuid
bucket*string

Bucket name

name*string

Object name (may contain /)

Query Parameters

role?string

The role to act as: row level security on storage.buckets and storage.objects decides what it sees and may do. Absent, owner or the owner's name: owner mode, for an Admin of the database only, which sees and writes past every policy (write-once buckets still hold) and writes objects with no owner (owner null).

claims?string

The JWT claims to run with: a JSON object (at most 4 KiB), {} when absent. Acting as authenticated with {"sub": "<user id>"} shows what that app user sees.

database?string

The Postgres database; the branch's main database when absent. It must be served by the data API.

upsert?boolean

Upload: replace an existing object.

download?string

Download as an attachment; the value is the file name (empty: the object's own).

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

body*unknown

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/databases/497f6eca-6276-4993-bfeb-53cbbbba6f08/branches/497f6eca-6276-4993-bfeb-53cbbbba6f08/storage/object/sign/string/string"
null

Resolve object refs to URLs as a role POST

Storage's `POST /storage/v1/object/resolve` as the role: `{"refs": [...], "expires_in"?}`, at most 1000 refs, each `{bucket_id, name}`, `{bucket, name}` or `{id}`. For each ref, in order: a signed download URL when the role can read the bucket and the object (row level security), the public URL when the bucket is public, and `null` when it can't read it (missing or hidden alike). `expires_in` is 1 to 3600 seconds (default 3600). A signed URL works while it is the object's current version and while you hold the role at Developer on the database (Admin for one resolved in owner mode): one resolved as a role you hold only at Viewer is refused when opened. Needs the role held at Viewer.

Delete several objects as a role DELETE

Storage's delete-many (`{"names": [...]}`) as the role. Needs the role held at Developer.