Get S3 Storage

curl --request GET \
  --url https://api.tornadoapi.io/user/s3 \
  --header 'x-api-key: <x-api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<x-api-key>'}};

fetch('https://api.tornadoapi.io/user/s3', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tornadoapi.io/user/s3",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <x-api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tornadoapi.io/user/s3"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<x-api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.tornadoapi.io/user/s3")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<x-api-key>'

response = http.request(request)
puts response.read_body

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "folder_prefix": "videos/",
  "base_folder": "videos",
  "last_modified": 1751980800,
  "source": "keyvault"
}

GET

user

Get S3 Storage

curl --request GET \
  --url https://api.tornadoapi.io/user/s3 \
  --header 'x-api-key: <x-api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<x-api-key>'}};

fetch('https://api.tornadoapi.io/user/s3', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tornadoapi.io/user/s3",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <x-api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tornadoapi.io/user/s3"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<x-api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.tornadoapi.io/user/s3")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<x-api-key>'

response = http.request(request)
puts response.read_body

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "folder_prefix": "videos/",
  "base_folder": "videos",
  "last_modified": 1751980800,
  "source": "keyvault"
}

Overview

Returns the S3-compatible storage configuration currently saved for your API key — whatever was last set via POST /user/s3 (or the deprecated /user/bucket endpoint). Use this to confirm what’s configured, or to check whether the key has a saved S3 configuration, without needing to run a test job.

If nothing is configured, this returns 200 OK with "configured": false — not an error. This describes S3 on this API key only. Other provider entries, organization defaults or inline credentials can still determine delivery.

This endpoint never returns your secret_key, and never returns a full access_key — see Security below.

Header Parameters

string

required

Your API key for authentication

Response

boolean

Whether this key has any S3 storage configured. All other fields are only present when true.

string

Storage provider type: s3

string

The configured bucket name

string

The configured folder prefix, if any

string

The configured base folder (only present when set via the modern /user/s3 path)

string

The configured S3 endpoint URL. Only present in legacy mode (the source field below explains the difference) — the modern, Key Vault-backed path doesn’t hold the endpoint outside the vault.

string

The configured region. Only present in legacy mode.

string

The last 4 characters of your access key ID, prefixed with **** (e.g. ****MPLE). Only present in legacy mode. Never the full key — see Security.

integer

Unix timestamp (seconds) of when this configuration was last saved. Only present in modern (Key Vault) mode.

string

Which storage location this configuration came from:

keyvault — saved via POST /user/s3 with Key Vault enabled (the default, modern path). This response is built from the saved configuration reference without fetching the Key Vault secret, so endpoint, region, and access_key_masked are omitted.
legacy — saved via the fallback path used when Key Vault is disabled (or the deprecated /user/bucket endpoint). Credentials are stored on the API key document; access_key is shown masked, secret_key is never returned.

If both S3 representations exist, this endpoint returns the modern keyvault entry. It does not prove that S3 is the active destination: job options, other providers and organization defaults are resolved separately.

Examples

curl -X GET "https://api.tornadoapi.io/user/s3" \
  -H "x-api-key: sk_your_api_key"

import requests

response = requests.get(
    "https://api.tornadoapi.io/user/s3",
    headers={"x-api-key": "sk_your_api_key"}
)
print(response.json())

const response = await fetch("https://api.tornadoapi.io/user/s3", {
  method: "GET",
  headers: { "x-api-key": "sk_your_api_key" }
});
const data = await response.json();

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "folder_prefix": "videos/",
  "base_folder": "videos",
  "last_modified": 1751980800,
  "source": "keyvault"
}

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "endpoint": "https://s3.us-east-1.amazonaws.com",
  "region": "us-east-1",
  "access_key_masked": "****MPLE",
  "source": "legacy"
}

{
  "configured": false
}

Success Response

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "folder_prefix": "videos/",
  "base_folder": "videos",
  "last_modified": 1751980800,
  "source": "keyvault"
}

Error Responses

{
  "error": "invalid_api_key",
  "message": "Invalid API key"
}

Without an x-api-key header the response is 401 with no JSON body.

Security

secret_key is never returned

There is no secret_key or secret_key_masked field in the response at all, in either mode. It’s write-only from the API’s perspective — set it via POST /user/s3, but it can never be read back.

access_key is never returned in full

In legacy mode, only the last 4 characters are returned (access_key_masked, e.g. ****MPLE). Values 4 characters or shorter are fully masked (****) rather than echoed whole. In Key Vault mode, the access key isn’t returned at all — this response does not fetch credentials from Key Vault.

The Key Vault secret reference is never returned

The internal Key Vault secret name (an infrastructure detail, not a credential, but still sensitive) is never included in the response.

Checking Configuration Programmatically

import requests

def get_storage_config(api_key):
    response = requests.get(
        "https://api.tornadoapi.io/user/s3",
        headers={"x-api-key": api_key}
    )
    response.raise_for_status()
    data = response.json()

    if not data["configured"]:
        print("No custom S3 storage configured on this API key")
        return

    print(f"Bucket: {data['container_or_bucket']}")
    print(f"Source: {data['source']}")  # "keyvault" or "legacy"
    if "access_key_masked" in data:
        print(f"Access key: {data['access_key_masked']}")

get_storage_config("sk_your_api_key")

Configure S3 Storage

Set or update your S3-compatible storage configuration

Remove S3 Storage

Remove this API key’s modern S3 configuration

API Reference

Jobs

Bulk

Metadata

Batch Operations

User

Get S3 Storage

Overview

Header Parameters

Response

Examples

Success Response

Error Responses

Security

Checking Configuration Programmatically

Configure S3 Storage

Remove S3 Storage

​Overview

​Header Parameters

​Response

​Examples

​Success Response

​Error Responses

​Security

​Checking Configuration Programmatically

​Related Endpoints

Configure S3 Storage

Remove S3 Storage

Overview

Header Parameters

Response

Examples

Success Response

Error Responses

Security

Checking Configuration Programmatically

Related Endpoints