> ## Documentation Index > Fetch the complete documentation index at: https://docs.wherobots.com/llms.txt > Use this file to discover all available pages before exploring further. # Get Storage Credentials > Return temporary AWS credentials for an S3 path your organization can reach. `access_mode` sets whether they can write. With the `Minimal` privilege, the default, they cover the requested path. With `Default`, they cover a wider authorized scope returned as `matchedGrantTarget`, and you may reuse them for paths under it with the same access mode until they expire. An identical request may return the same credentials until they near expiry. IAM restrictions still apply. User files paths are refused. ## OpenAPI ````yaml https://api.cloud.wherobots.com/openapi.json post /storage/credentials openapi: 3.1.0 info: title: Wherobots Cloud API description: |- Wherobots Cloud API OpenAPI specification. These are the API docs for the Wherobots API. You can use this to test out the API and see what it does. The underlying OPENAPI spec can be found at /openapi.json. This can be used to generate clients for the API. The Authorize button below will allow you to input an access token to authenticate to our API. Then all of the requests on the page should work. version: 0.0.1 servers: - url: https://api.cloud.wherobots.com description: Wherobots Cloud API security: [] paths: /storage/credentials: post: tags: - storage summary: Get Storage Credentials description: >- Return temporary AWS credentials for an S3 path your organization can reach. `access_mode` sets whether they can write. With the `Minimal` privilege, the default, they cover the requested path. With `Default`, they cover a wider authorized scope returned as `matchedGrantTarget`, and you may reuse them for paths under it with the same access mode until they expire. An identical request may return the same credentials until they near expiry. IAM restrictions still apply. User files paths are refused. operationId: getStorageCredentials requestBody: content: application/json: schema: $ref: '#/components/schemas/StorageCredentialsRequest' required: true responses: '200': description: >- Temporary AWS credentials; OPERA sources use provider-scoped read-only ASF sessions content: application/json: schema: $ref: '#/components/schemas/StorageCredentialsResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorBody' '404': description: No storage source matches the requested path '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/ErrorBody' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/ErrorBody' '429': description: >- Rate limited: the per-organization cap, the credential-issuance cap, or AWS STS throttling. Retry after the delay in the Retry-After header '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/ErrorBody' security: - bearerToken: [] - wherobotsApiKey: [] components: schemas: StorageCredentialsRequest: properties: path: type: string maxLength: 1024 minLength: 6 pattern: ^s3:\/\/([a-zA-Z0-9._\-]{3,63})(?:\/?|\/([a-zA-Z0-9!_.*'()/&=-]+))?$ title: Path description: S3 URI (e.g. s3://bucket/prefix) to obtain credentials for. access_mode: type: string enum: - read - read_write title: Access Mode description: >- Access mode for the credentials. 'read' returns read-only credentials; 'read_write' returns credentials that also allow writing. default: read privilege: type: string enum: - Minimal - Default title: Privilege description: >- Minimal preserves requested-path scoping. Default opts into credentials for a server-selected authorized scope, returned as matchedGrantTarget. Underlying IAM restrictions still apply within that scope. default: Minimal duration_seconds: type: integer maximum: 3600 minimum: 900 title: Duration Seconds description: Requested credential lifetime in seconds. default: 3600 type: object required: - path title: StorageCredentialsRequest description: Request body for the unified storage credentials endpoint. StorageCredentialsResponse: properties: accessKeyId: type: string title: Accesskeyid secretAccessKey: type: string title: Secretaccesskey sessionToken: type: string title: Sessiontoken expiration: type: string format: date-time title: Expiration region: type: string title: Region matchedGrantTarget: anyOf: - type: string - type: 'null' title: Matchedgranttarget description: >- Returned for Default privilege when the scope has no competing credential sources. If absent, cache only for the exact request. A trailing slash denotes descendants only; otherwise match the exact path or slash-delimited descendants. Reuse requires the same access mode and unexpired credentials. type: object required: - accessKeyId - secretAccessKey - sessionToken - expiration - region title: StorageCredentialsResponse description: >- Credentials with an optional server-selected target for client cache reuse. ErrorBody: properties: errors: items: $ref: '#/components/schemas/ErrorInfo' type: array title: Errors description: A list of errors that occurred requestId: type: string title: Requestid description: A unique identifier for the request that caused the error type: object required: - errors - requestId title: ErrorBody ErrorInfo: properties: code: $ref: '#/components/schemas/ErrorClass' description: The error code message: type: string title: Message description: A human-readable message describing the error details: type: string title: Details description: Details about the error path: type: string title: Path description: The path to the field that caused the error suggestion: type: string title: Suggestion description: Suggested action to resolve the error default: >- Contact us at support@wherobots.com to get help with resolving your error. documentation_url: anyOf: - type: string - type: 'null' title: Documentation Url description: URL to related documentation field: anyOf: - type: string - type: 'null' title: Field description: The field that caused the error if applicable data: anyOf: - additionalProperties: anyOf: - type: string - type: integer type: object - type: 'null' title: Data description: >- Machine-readable facts about the error a client can act on, when there are any type: object required: - code - message - details - path title: ErrorInfo ErrorClass: type: string enum: - BAD_REQUEST_ERROR - CONFLICT_ERROR - INVALID_INPUT_ERROR - INTERNAL_SERVER_ERROR - UNAUTHORIZED_ERROR - INSUFFICIENT_PERMISSIONS_ERROR - THIRD_PARTY_PERMISSIONS_ERROR - NOT_FOUND_ERROR - INSUFFICIENT_QUOTA_ERROR - REQUEST_ENTITY_TOO_LARGE - FOREIGN_CATALOG_CONNECTION_FAILED - RATE_LIMIT_ERROR - RESOURCE_BUSY - TIMEOUT_ERROR - ACCOUNT_NOT_PROVISIONED - BAD_GATEWAY_ERROR - GATEWAY_TIMEOUT_ERROR - NOT_IMPLEMENTED_ERROR - GONE_ERROR - SCRIPT_OWNER_MISMATCH title: ErrorClass securitySchemes: bearerToken: type: http scheme: bearer wherobotsApiKey: type: apiKey description: A Wherobots-generated API key in: header name: X-API-Key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.