Provision a new bucket | Tigris Object Storage Documentation

Provision a new bucket

POST https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/provision

Provisions a new bucket in the organization account and also creates the organization account if it doesn't exist. This is an idempotent operation, and calling it multiple times with the same parameters will not create duplicate buckets.

Provisioning API responds with an access key and secret to access the newly provisioned bucket.

Request

Path Parameters

provider_id string required
Provider ID

org_id string required
Organization ID

Body required

bucket_name string required
Name of the bucket to be provisioned

org_name string required
Name of the organization where the bucket should be provisioned

org_quota object

limit_bytes int64 required
The number of bytes that the organization is allowed to store across all of its buckets. Zero means no limit.

user_id string required
ID of the user who is requesting the bucket

bucket_options object

public boolean
If set to true, the bucket will be publicly accessible. Default is false.

enable_public_list_objects boolean
If set to true, anonymous users can list objects in public buckets. Default is false for new buckets. Only applicable to public buckets.

storage_class StorageClass
Storage class for the bucket. Default is STANDARD.

Possible values: [STANDARD, STANDARD_IA, GLACIER, GLACIER_IR]

regions Regions
Restricts the regions where bucket data is stored. Default is empty, which means no restrictions (global distribution).

Accepted values:

If you want to remove existing region restrictions, you can set the value to "global".

See regions documentation for more details.

enable_object_acl boolean
If set to true, per object ACL will be enabled. Default is false.

enable_snapshots boolean
Enable snapshots on the bucket at creation. Snapshots can also be enabled or disabled on an existing bucket from the Storage Settings page in the Tigris Dashboard. See snapshots documentation.

object_notifications object
Configuration for object event notifications via webhook. Receive HTTP callbacks when objects are created, updated, or deleted in your bucket.

Update behavior (partial updates supported):

Common operations:

// Enable notifications (preserves webhook, filter, auth)
{"enabled": true}

// Disable temporarily (keeps all config for later)
{"enabled": false, "webhook": "https://..."}

// Update webhook only (preserves auth, filter)
{"webhook": "https://new-endpoint.com"}

// Change auth type (replaces entire auth object)
{"auth": {"token": "new-token"}}

// Remove all notifications
{"enabled": false}

Note: Auth credentials are masked in responses. You don't need to re-send them when updating other fields.

enabled boolean required
Enable or disable notifications (webhook required when true)

webhook uri
HTTPS endpoint to receive notification events

Example: https://webhook.example.com/tigris-events

filter string
SQL WHERE clause to filter which objects trigger notifications (e.g., size comparisons)

Example: size > 1000000

auth object
Authentication credentials for webhook endpoint

basic_user string
Basic auth username

basic_pass password
Basic auth password

token password
Bearer token for authorization

lifecycle_rules object
Lifecycle rules to automatically transition objects to different storage classes or permanently delete (expire) them.

Example: Archive old logs and delete after 1 year

{
  "rules": [
    {
      "id": "archive-and-cleanup-logs",
      "enabled": true,
      "transitions": [
        { "days": 90, "storage_class": "GLACIER" }
      ],
      "expiration": { "days": 365 }
    }
  ]
}

This rule transitions objects to GLACIER after 90 days, and permanently deletes them after 365 days.

Update Behavior (Partial Updates Supported)

Note: When updating rules, you must provide the complete rule configuration. To preserve existing rules while making changes, first retrieve the current bucket configuration, modify the desired fields, and submit the complete updated rules.

rules object[]
Array [ id string required
Unique identifier for the rule (max 255 chars). Use a descriptive name like archive-old-logs or expire-temp-uploads. Possible values: <= 255 characters

enabled boolean required
Whether the rule is currently active. Set to false to temporarily disable a rule without deleting it. When disabled, objects will not be transitioned or expired by this rule.

expiration object
Configuration for automatic object deletion (expiration). When the expiration condition is met, objects matching this rule are permanently deleted.

Specify ONE Condition (Not Both)

**days** integer  
Number of days after object creation when the object will be deleted.
The deletion happens at midnight UTC on the calculated expiration date.

Example: If `days: 30` and an object was created on Dec 1, it expires on Dec 31.

**date** date-time  
Specific date (at midnight UTC) when all matching objects will be deleted, regardless of when they were created.
Use this for one-time cleanup operations or compliance deadlines.
Must be a future date in RFC3339 format with midnight UTC time.

**Example:** `2025-01-01T00:00:00Z`

**transitions** object[]  
List of storage class transitions. Objects will transition through each defined step.
Transitions must be in chronological order (earlier days/dates first).

Array [
  **days** integer  
  Number of days after object creation when the transition occurs.
  The transition happens at midnight UTC on the calculated date.
  
  Example: If `days: 60` and an object was created on Jan 1, it transitions on Mar 2.
  
  **date** date-time  
  Specific date (at midnight UTC) when all matching objects will be transitioned, regardless of when they were created.
  Use this for planned migrations or cost optimization deadlines.
  Must be a future date in RFC3339 format with midnight UTC time.
  
  **Example:** `2025-06-01T00:00:00Z`
  
  **storage_class** StorageClass required  
  Storage class for the bucket. Default is `STANDARD`.
  **Possible values:** `[STANDARD, STANDARD_IA, GLACIER, GLACIER_IR]`
]

**filter** object  
Optional scope for a lifecycle rule. When unset, the rule applies to every object in the bucket.

**prefix** string  
Only apply this rule to objects whose keys start with the given prefix.
For example, `logs/` scopes the rule to objects under that prefix.

**user_role** OrgMembership  
Role of the user in the organization. Controls what the user can do through the Partner API management endpoints.

- `Admin`: Full org access. Can list and manage all access keys in the org, update org settings, and manage users. ListAccessKeys returns all keys in the org.
- `Member`: Standard access. Can only manage their own access keys. ListAccessKeys returns only keys owned by this user.

If omitted, defaults to `Member` behavior.

**Possible values:** `Admin, Member`

**fork_of** string  
Create this bucket as a fork of the named source bucket. The source must belong to the same organization, and the acting user must either have `user_role=Admin` or own the source bucket.

**source_snapshot** string  
Fork from a specific snapshot of the source bucket. Accepts a snapshot version string or any UNIX nanosecond-precision timestamp (e.g. `1765889000501544464`). Requires `fork_of`.

**access_key_scope** AccessKeyScope  
Controls whether the key receives the implicit default-allowed operations (such as create bucket or list buckets) on top of what its policies and bucket roles grant.

- `standard` (default): grants the default-allowed operations.
- `no_default_allow`: denies them, so the key can do only what its policies and bucket roles explicitly allow.

**Possible values:** `standard, no_default_allow`

```json
{
  "bucket_name": "string",
  "org_name": "string",
  "org_quota": {
    "limit_bytes": 0
  },
  "user_id": "string",
  "bucket_options": {
    "public": true,
    "enable_public_list_objects": true,
    "storage_class": "STANDARD",
    "regions": "string",
    "enable_object_acl": true,
    "enable_snapshots": true,
    "object_notifications": {
      "enabled": true,
      "webhook": "https://webhook.example.com/tigris-events",
      "filter": "size > 1000000",
      "auth": {
        "basic_user": "string",
        "basic_pass": "string",
        "token": "string"
      }
    },
    "lifecycle_rules": {
      "rules": [
        {
          "id": "string",
          "enabled": true,
          "expiration": {
            "days": 0,
            "date": "2025-01-01T00:00:00Z"
          },
          "transitions": [
            {
              "days": 0,
              "date": "2025-06-01T00:00:00Z",
              "storage_class": "STANDARD"
            }
          ],
          "filter": {
            "prefix": "string"
          }
        }
      ]
    }
  },
  "user_role": "Admin",
  "fork_of": "string",
  "source_snapshot": "string",
  "access_key_scope": "standard"
}

Responses

OK

Schema

object object

{}

Unexpected error

Schema

message string

{
  "message": "string"
}

Authorization: X-Tigris-Signature

name: X-Tigris-Signature
type: apiKey
in: header
description: HMAC-SHA256 of the canonical request signed using the signing key.
To create the signature, concatenate the HTTP method, URL, timestamp, and nonce with a newline character in between.
Then, calculate the HMAC-SHA256 of the concatenated string using the signing key. Example:

Create the `canonical_request` as:
```
POST
https://mgmt.storage.dev/provider/your-provider-id/orgs/user-org-id/provision
1731703213870
f8d133cb-5a42-47b1-9ef2-874bb55bab72
```
Then, calculate HMAC-SHA256 of the canonical request using the signing key as:
```
Signature = hex(sha256sign(canonical_request, "signing_key"))
```

name: X-Tigris-Nonce
type: apiKey
in: header
description: Random unique string to identify the request and prevent replay attacks. Example: "f8d133cb-5a42-47b1-9ef2-874bb55bab72"

name: X-Tigris-Time
type: apiKey
in: header
description: Unix timestamp in milliseconds of the request. Example: 1731703213870

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/provision");
request.Headers.Add("Accept", "application/json");
request.Headers.Add("X-Tigris-Signature", "<X-Tigris-Signature>");
request.Headers.Add("X-Tigris-Nonce", "<X-Tigris-Nonce>");
request.Headers.Add("X-Tigris-Time", "<X-Tigris-Time>");
var content = new StringContent("{\n  \"bucket_name\": \"string\",\n  \"org_name\": \"string\",\n  \"org_quota\": {\n    \"limit_bytes\": 0\n  },\n  \"user_id\": \"string\",\n  \"bucket_options\": {\n    \"public\": true,\n    \"enable_public_list_objects\": true,\n    \"storage_class\": \"STANDARD\",\n    \"regions\": \"string\",\n    \"enable_object_acl\": true,\n    \"enable_snapshots\": true,\n    \"object_notifications\": {\n      \"enabled\": true,\n      \"webhook\": \"https://webhook.example.com/tigris-events\",\n      \"filter\": \"size > 1000000\",\n      \"auth\": {\n        \"basic_user\": \"string\",\n        \"basic_pass\": \"string\",\n        \"token\": \"string\"\n      }\n    },\n    \"lifecycle_rules\": {\n      \"rules\": [\n        {\n          \"id\": \"string\",\n          \"enabled\": true,\n          \"expiration\": {\n            \"days\": 0,\n            \"date\": \"2025-01-01T00:00:00Z\"\n          },\n          \"transitions\": [\n            {\n              \"days\": 0,\n              \"date\": \"2025-06-01T00:00:00Z\",\n              \"storage_class\": \"STANDARD\"\n            }\n          ],\n          \"filter\": {\n            \"prefix\": \"string\"\n          }\n        }\n      ]\n    }\n  },\n  \"user_role\": \"Admin\",\n  \"fork_of\": \"string\",\n  \"source_snapshot\": \"string\",\n  \"access_key_scope\": \"standard\"\n}", null, "application/json");
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Request

Base URL

https://mgmt.storage.dev

Auth

Signature

Nonce

Timestamp

Parameters

provider_id — path required org_id — path required

Body required

Send API Request

Response

Click the Send API Request button above and see the response here!