Storage API

Bucket Routes

Athena now exposes bucket-level S3 management routes in addition to object and CORS helpers:

POST /storage/buckets/list
POST /storage/buckets/create
POST /storage/buckets/delete
POST /storage/buckets/cors
POST /storage/buckets/cors/set
POST /storage/buckets/cors/delete

Use the bucket routes when you need to discover available buckets from a saved storage profile, create a new bucket, delete an empty bucket, or inspect/edit browser CORS behavior.

Object Routes

Athena storage object operations are available at:

POST /storage/objects
POST /storage/objects/head
POST /storage/objects/url
POST /storage/objects/upload-url
POST /storage/objects/folder
POST /storage/objects/delete

These routes support list, metadata-only lookup, signed URL retrieval, upload URL generation, folder placeholder creation, and delete workflows.

Auth requirements

Storage routes do not use a separate apikey header. You must present one of:

ATHENA_KEY_12 — same value as X-Athena-Key or X-Athena-Admin-Key, or
Gateway API key — ath_* secret in X-Athena-Key with the gateway.storage_proxy right.

Auth runs in middleware before the JSON body is parsed, so missing or invalid credentials yield 401 Unauthorized even when the body is not valid JSON.

For validation rules (bucket, endpoint, HTTPS), see Security, auth ordering, and rate limits.

Typical S3 profile flow

Call /storage/buckets/list with endpoint, region, and credentials to discover available buckets for a profile.
Create a bucket with /storage/buckets/create when the storage target is new.
Use /storage/objects/head or /storage/objects to validate object presence before download or delete flows.
Request a signed upload URL via /storage/objects/upload-url.
Upload directly to object storage using the returned URL.
Request a signed read URL via /storage/objects/url when needed.
Configure CORS for browser access where required.

Reference

See Reference -> Athena API Reference -> storage for exact request and response payloads.