Skip to main content
POST
Update S3
Auth: TokenAccount or TokenInstanceRate-limit: Global (100/min) • Idempotent: yes

Description

Configures the S3 storage of the instance. secretKey is encrypted at-rest and never returned. For S3-compatible storage (MinIO, Backblaze, DO Spaces), fill endpoint with the URL.

Examples

AWS S3

Points storage to official AWS S3: bucket ryzeapi-media in us-east-1, with endpoint empty to use AWS’s default domain and prefix media/myinstance/ to isolate the files.

Self-hosted MinIO

Same format as AWS, but with endpoint pointing to an internal MinIO (https://minio.internal.company.com). The same pattern works for DigitalOcean Spaces, Backblaze B2, and other S3-compatible storage.

Disable

Sends only enabled: false to disable the storage and delete the credentials from the database. To re-enable later, all fields must be sent again.

Success response

200 OK
secretKey does not appear in the response, the server never returns the key in plaintext.

Path parameters

string
required
Instance name.

Headers

string
required
TokenAccount or TokenInstance.
string
required
application/json.

Request body

boolean
required
Enables/disables the instance S3. false clears all fields.
string
Region (e.g., us-east-1).
string
Bucket name (must exist; no creation is performed).
string
Access Key ID.
string
Secret Access Key. Encrypted at-rest.
string
Custom endpoint (MinIO, DO Spaces, Backblaze). Empty for official AWS S3.
string
Path prefix (e.g., media/myinstance/).

Notes

There is no credential testing. The endpoint saves the config without validating whether the bucket exists or whether the credentials work, the error only appears when the next media upload tries to authenticate (visible in the server logs).
Disabling (enabled=false) deletes the credentials from the database. To re-enable later, all fields must be sent again.

Errors