S3 · Versioning & retention

PutObjectLockConfiguration

PUT/{bucket}?object-lock

Turns on object lock, and sets the default retention for new versions.

Object lock keeps each retained version until its retain-until date. Nobody can delete the version or shorten the date before then. This call also turns on versioning.

View as Markdown

Role: Editor or higher
Support: Partial
Auth: SigV4 with your API key

COMPLIANCE mode with a default in days. Years, GOVERNANCE, and legal hold return 501.
Without Rule, object lock is on and new versions get no default retention.

Request

https://wspq7ws2np5l8z4.storage.beta.graphon.sh/support-tickets?object-lock

PUT /support-tickets?object-lock HTTP/1.1
Host: wspq7ws2np5l8z4.storage.beta.graphon.sh
x-amz-date: 20261007T093000Z
x-amz-content-sha256: be1d386947f4b964967aa4630b0d590afad147a465c9a88adf8c80b44335b12a
Authorization: AWS4-HMAC-SHA256 Credential=<ACCESS_KEY_ID>/20261007/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=<SIGNATURE>
Content-Length: 267

<ObjectLockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
  <ObjectLockEnabled>Enabled</ObjectLockEnabled>
  <Rule>
    <DefaultRetention>
      <Mode>COMPLIANCE</Mode>
      <Days>30</Days>
    </DefaultRetention>
  </Rule>
</ObjectLockConfiguration>

Replace wspq7ws2np5l8z4 with your workspace ID. HTTP shows the signed request on the wire. The aws CLI and the SDKs sign for you. The CLI uses the graphon profile, and the SDK samples read GRAPHON_API_KEY.

Response

200

Storage saved the settings.

HTTP/1.1 200 OK
x-amz-request-id: 4F8A2C7D1E6B4093A5C2D8E1F7B3A960

Path parameters

bucketstringrequired

The bucket name.

Query parameters

object-lockflagrequired

Selects this operation. Send it with no value.

Headers

x-amz-expected-bucket-ownerstringoptional

The workspace ID that must own the bucket. Another owner returns 403 AccessDenied.

Request body

ObjectLockConfigurationobjectrequired

The root element.

ObjectLockEnabledstringrequired

Send Enabled.

Rule.DefaultRetentionobjectoptional

The default retention for new versions.

Responses

200OK

Storage saved the settings.

This response has no body.

Errors

Select an error in the response example to see its XML body. Any request can also get the common errors, such as SignatureDoesNotMatch.

501NotImplemented

The body uses Years, GOVERNANCE mode, or legal hold.

What to do: Send COMPLIANCE mode with Days.

404NoSuchBucket

No bucket has this name, or the bucket was deleted.

What to do: Check the bucket name. ListBuckets shows the buckets of the workspace.

403AccessDenied

The key does not have the role for this operation, or the bucket is in another workspace.

What to do: Use a key of the workspace that owns the bucket, with the role above.

Was this page helpful?