Get S3 Storage

curl --request GET \
  --url https://api.tornadoapi.io/user/s3 \
  --header 'x-api-key: <x-api-key>'

import requests

url = "https://api.tornadoapi.io/user/s3"

headers = {"x-api-key": "<x-api-key>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {'x-api-key': '<x-api-key>'}};

fetch('https://api.tornadoapi.io/user/s3', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tornadoapi.io/user/s3",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <x-api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tornadoapi.io/user/s3"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<x-api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.tornadoapi.io/user/s3")
  .header("x-api-key", "<x-api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tornadoapi.io/user/s3")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<x-api-key>'

response = http.request(request)
puts response.read_body

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "folder_prefix": "videos/",
  "base_folder": "videos",
  "last_modified": 1751980800,
  "source": "keyvault"
}

GET

user

Get S3 Storage

curl --request GET \
  --url https://api.tornadoapi.io/user/s3 \
  --header 'x-api-key: <x-api-key>'

import requests

url = "https://api.tornadoapi.io/user/s3"

headers = {"x-api-key": "<x-api-key>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {'x-api-key': '<x-api-key>'}};

fetch('https://api.tornadoapi.io/user/s3', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tornadoapi.io/user/s3",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <x-api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tornadoapi.io/user/s3"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<x-api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.tornadoapi.io/user/s3")
  .header("x-api-key", "<x-api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tornadoapi.io/user/s3")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<x-api-key>'

response = http.request(request)
puts response.read_body

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "folder_prefix": "videos/",
  "base_folder": "videos",
  "last_modified": 1751980800,
  "source": "keyvault"
}

Overview

Returns the S3-compatible storage configuration currently saved for your API key — whatever was last set via POST /user/s3 (or the deprecated /user/bucket endpoint). Use this to confirm what’s configured, or to check whether a key has any custom storage at all, without needing to run a test job.

If nothing is configured, this returns 200 OK with "configured": false — not an error. A key with no custom storage is a normal state; it simply falls back to Tornado’s managed storage.

This endpoint never returns your secret_key, and never returns a full access_key — see Security below.

Header Parameters

string

required

Your API key for authentication

Response

boolean

Whether this key has any S3 storage configured. All other fields are only present when true.

string

Storage provider type: s3

string

The configured bucket name

string

The configured folder prefix, if any

string

The configured base folder (only present when set via the modern /user/s3 path)

string

The configured S3 endpoint URL. Only present in legacy mode (the source field below explains the difference) — the modern, Key Vault-backed path doesn’t hold the endpoint outside the vault.

string

The configured region. Only present in legacy mode.

string

The last 4 characters of your access key ID, prefixed with **** (e.g. ****MPLE). Only present in legacy mode. Never the full key — see Security.

integer

Unix timestamp (seconds) of when this configuration was last saved. Only present in modern (Key Vault) mode.

string

Which storage location this configuration came from:

keyvault — saved via POST /user/s3 with Key Vault enabled (the default, modern path). Credentials live in Azure Key Vault; this service never holds them outside of upload time, so endpoint, region, and access_key_masked aren’t available to return.
legacy — saved via the fallback path used when Key Vault is disabled (or the deprecated /user/bucket endpoint). Credentials are stored on the API key document; access_key is shown masked, secret_key is never returned.

If both happen to exist for a key, keyvault always wins — this matches exactly which one is actually used for uploads.

Examples

curl -X GET "https://api.tornadoapi.io/user/s3" \
  -H "x-api-key: sk_your_api_key"

import requests

response = requests.get(
    "https://api.tornadoapi.io/user/s3",
    headers={"x-api-key": "sk_your_api_key"}
)
print(response.json())

const response = await fetch("https://api.tornadoapi.io/user/s3", {
  method: "GET",
  headers: { "x-api-key": "sk_your_api_key" }
});
const data = await response.json();

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "folder_prefix": "videos/",
  "base_folder": "videos",
  "last_modified": 1751980800,
  "source": "keyvault"
}

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "endpoint": "https://s3.us-east-1.amazonaws.com",
  "region": "us-east-1",
  "access_key_masked": "****MPLE",
  "source": "legacy"
}

{
  "configured": false
}

Success Response

{
  "configured": true,
  "provider": "s3",
  "container_or_bucket": "my-tornado-downloads",
  "folder_prefix": "videos/",
  "base_folder": "videos",
  "last_modified": 1751980800,
  "source": "keyvault"
}

Error Responses

{
  "error": "Invalid API Key"
}

Security

secret_key is never returned

There is no secret_key or secret_key_masked field in the response at all, in either mode. It’s write-only from the API’s perspective — set it via POST /user/s3, but it can never be read back.

access_key is never returned in full

In legacy mode, only the last 4 characters are returned (access_key_masked, e.g. ****MPLE). Values 4 characters or shorter are fully masked (****) rather than echoed whole. In Key Vault mode, the access key isn’t returned at all — this service doesn’t hold it outside of upload time.

The Key Vault secret reference is never returned

The internal Key Vault secret name (an infrastructure detail, not a credential, but still sensitive) is never included in the response.

Checking Configuration Programmatically

import requests

def get_storage_config(api_key):
    response = requests.get(
        "https://api.tornadoapi.io/user/s3",
        headers={"x-api-key": api_key}
    )
    data = response.json()

    if not data["configured"]:
        print("No custom S3 storage configured — using Tornado's managed storage")
        return

    print(f"Bucket: {data['container_or_bucket']}")
    print(f"Source: {data['source']}")  # "keyvault" or "legacy"
    if "access_key_masked" in data:
        print(f"Access key: {data['access_key_masked']}")

get_storage_config("sk_your_api_key")

Configure S3 Storage

Set or update your S3-compatible storage configuration

Remove S3 Storage

Remove your S3 configuration and revert to Tornado’s managed storage

Configure S3 Storage Remove S3 Storage

API Reference

Jobs

Bulk

Metadata

Batch Operations

User

Get S3 Storage

Overview

Header Parameters

Response

Examples

Success Response

Error Responses

Security

Checking Configuration Programmatically

Configure S3 Storage

Remove S3 Storage

​Overview

​Header Parameters

​Response

​Examples

​Success Response

​Error Responses

​Security

​Checking Configuration Programmatically

​Related Endpoints

Configure S3 Storage

Remove S3 Storage

Overview

Header Parameters

Response

Examples

Success Response

Error Responses

Security

Checking Configuration Programmatically

Related Endpoints