S3 API Compatibility

SILO 20261109 contract: This page retains the inherited S3 API catalog. The target is SILO 20261109 (RELEASE.2026-11-09T00-00-00Z), including locked bulk-version deletion, two-phase restore, multi-pool lifecycle quorum checks, and current-object multipart conditions. Apply the documented limits and error behavior for ordinary LIST, Object Lock, and multipart listing. Checksum message text can change; see the checksum contract.

This page documents S3 APIs supported by MinIO Object Storage. For reference documentation on any given API, see the corresponding documentation for Amazon S3.

Object APIs

• CopyObject
  • SILO 20261109: aligns single-pool writes and deletes with the object’s own erasure-set lock (#298), fixes self-lock deadlocks on normalized path aliases (#299), and prevents destination lock starvation while waiting on the source (#300).
• DeleteObject
• DeleteObjects
  • Conditional DELETE: published Server 20260903 ignores If-Match. Server 20260916 supports nonempty If-Match on single DeleteObject (#145/#178), including addressed-version comparison. Batch DeleteObjects still ignores <Object><ETag> and provides no per-item conditional guard. See scope and limitations.
  • SILO 20261109: checks physical version removals sequentially under the mutation lock across all pools (6ef3a52fc) so concurrent legal-hold or retention updates cannot be bypassed, checks Object Lock on directory null versions (aa2d79daf), and runs ordinary bulk-delete erasure-set groups concurrently (#301).
• DeleteObjectTagging
• GetObject
  • SILO 20261109: returns retryable 503 ServiceUnavailable instead of 404 NoSuchKey when a node sees only a partial drive view of an existing object (#302). Known limitation (#293): reads authorized solely by object tags still return 403 AccessDenied when the object is unreadable.
• GetObjectAttributes
• GetObjectTagging
• HeadObject
  • SILO 20261109: returns retryable 503 ServiceUnavailable instead of 404 NoSuchKey on known partial drive views (#302); tag-only authorization on an unreadable object still returns 403 (#293).
• ListObjects
• ListObjectsV2
• ListObjectVersions
• PutObject
• PutObjectTagging
• RestoreObject
  • SILO 20261109 (POST ?restore): executes two-phase in-place restores without holding the object write lock during remote-tier download (#284, #289). Canceled or failed restores return immediately after a 100 ms marker-cleanup attempt and finish cleanup in the background. During mixed-version rolling upgrades, upgraded nodes return 503 ServiceUnavailable while any peer is on an older version or unreachable.
• SelectObjectContent

Write commit errors

PR #232, included in the Server 20261018 candidate, returns HTTP 503 SlowDownWrite when staged xl.meta disappears at the final commit of PUT or multipart completion. Earlier code could report 400 IncompleteBody for PUT or 404 NoSuchKey for completion. Actual incomplete client uploads retain their existing error handling. This classification allows SDK retries; it does not restore lost staging data. See the source and release boundary.

Object Locking

• GetObjectRetention
• PutObjectRetention
• GetObjectLegalHold
• PutObjectLegalHold
• GetObjectLockConfiguration
• PutObjectLockConfiguration

Unsupported API Object Endpoints

GetObjectAcl
PutObjectAcl

Multipart Uploads

• AbortMultipartUpload
• CompleteMultipartUpload
  • SILO 20261109: a failed ordinary CompleteMultipartUpload attempt leaves the multipart upload usable for retry (#327).
• CreateMultipartUpload
  • SILO 20261109: evaluates If-Match and If-None-Match against the current object across multiple pools (#291, PR #292).
• ListMultipartUploads
• ListParts
• UploadPart
• UploadPartCopy

Differences from S3 APIs for Multipart Uploads

• Published Server 20260903 treats a non-empty ListMultipartUploads prefix as an exact object name. An empty prefix uses node-local volatile state without complete pagination, marker or delimiter semantics.
• Server 20260916 adds persistent scanning as an opt-in strict mode while retaining legacy exact-key/cache behavior by default. Its historical upgrade contract still applies to those binaries.
• SILO 20261109 (since Server 20261018): withdraw default persistent scanning and restore node-local cache listing for an empty prefix and exact-key lookup otherwise (#79). Restart omissions, true-prefix and cache-pagination defects remain. Ignore the retired mode switch with a warning and tolerate its obsolete shared key; existing strict users lose optional durable listing and strict cancellation. Diagnostic scans retain resource limits without gating public operations. Preserve identity fields, safety checks, default best-effort Abort and cleanup repairs. See the decision, capacity and limits.
• The AbortIncompleteMultipartUpload lifecycle action is not supported with PutBucketLifecycle.

Bucket APIs

• CreateBucket
• DeleteBucket
• DeleteBucketEncryption
• DeleteBucketTagging
• GetBucketEncryption
• GetBucketLocation
• GetBucketTagging
• GetBucketVersioning
• HeadBucket
• ListBuckets
• ListDirectoryBuckets
• PutBucketEncryption
• PutBucketTagging
• PutBucketVersioning

Bucket Replication

• GetBucketReplication
• PutBucketReplication
  • SILO 20261109: replicated deletes preserve target Object Lock retention and legal hold (7e9ee6bef); a source version purge that bypassed GOVERNANCE retention is refused when the target copy still carries active retention, and replication retries until the target lock allows removal.
• DeleteBucketReplication

Bucket Lifecycle

• GetBucketLifecycle
• GetBucketLifecycleConfiguration
• PutBucketLifecycle
  • SILO 20261109: lifecycle expiration evaluates authoritative version history and Object Lock protection across all pools under the object lock (#278), restricts ExpiredObjectAllVersions and DelMarkerExpiration to the exact expired key rather than child keys (#297), executes rules whose only action is DelMarkerExpiration (#268), expires only the cached restored copy of a tiered current version instead of the underlying object (#281), and does not replicate lifecycle-generated delete markers or version purges (1bd0b1b04).
• PutBucketLifecycleConfiguration
• DeleteBucketLifecycle

Bucket Notifications

• GetBucketNotification
• GetBucketNotificationConfiguration
• PutBucketNotification
• PutBucketNotificationConfiguration

Bucket Policies

• GetBucketPolicy
• GetBucketPolicyStatus
• PutBucketPolicy
• DeleteBucketPolicy
• GetBucketCors
• PutBucketCors
• DeleteBucketCors

Unsupported API Bucket Operations

GetBucketInventoryConfiguration
PutBucketInventoryConfiguration
DeleteBucketInventoryConfiguration
GetBucketMetricsConfiguration
PutBucketMetricsConfiguration
DeleteBucketMetricsConfiguration
PutBucketWebsite
GetBucketLogging
PutBucketLogging
PutBucketAccelerateConfiguration
DeleteBucketAccelerateConfiguration
PutBucketRequestPayment
DeleteBucketRequestPayment
PutBucketAcl
HeadBucketAcl
GetPublicAccessBlock
PutPublicAccessBlock
DeletePublicAccessBlock
GetBucketOwnershipControls
PutBucketOwnershipControls
DeleteBucketOwnershipControls
GetBucketIntelligentTieringConfiguration
PutBucketIntelligentTieringConfiguration
ListBucketIntelligentTieringConfigurations
DeleteBucketIntelligentTieringConfiguration
GetBucketAnalyticsConfiguration
PutBucketAnalyticsConfiguration
ListBucketAnalyticsConfigurations
DeleteBucketAnalyticsConfiguration
CreateSession

MinIO alternatives for unsupported Bucket resources

• For calls to BucketACL or ObjectACL operations, use Policies.
• BucketCORS operations are supported since RELEASE.2026-09-03T13-18-01Z. A bucket with its own CORS configuration is served only by that configuration; buckets without one use the server-wide MINIO_API_CORS_ALLOW_ORIGIN policy, which allows every origin by default.
• For calls to BucketWebsite operations, use caddy or nginx.
• For calls to BucketAnalytics, BucketMetrics, or BucketLogging operations, use Bucket Notifications.