S3 API Compatibility

This page documents S3 APIs supported by MinIO AIStor. For reference documentation on any given API, see the corresponding documentation for Amazon S3.

Object APIs

Conditional headers

MinIO AIStor supports conditional operations using the following HTTP headers:

HeaderSupported operations
If-MatchGetObject, HeadObject, PutObject, CopyObject, DeleteObject, CreateMultipartUpload
If-None-MatchGetObject, HeadObject, PutObject, CopyObject, CreateMultipartUpload
If-Modified-SinceGetObject, HeadObject
If-Unmodified-SinceGetObject, HeadObject
x-amz-copy-source-if-matchCopyObject, UploadPartCopy
x-amz-copy-source-if-none-matchCopyObject, UploadPartCopy
x-amz-copy-source-if-modified-sinceCopyObject, UploadPartCopy
x-amz-copy-source-if-unmodified-sinceCopyObject, UploadPartCopy

DeleteObjects supports conditional deletes using the <ETag> element in the request body.

Object locking

Unsupported object APIs

  • GetObjectAcl
  • PutObjectAcl

Multipart uploads

Differences from S3 APIs for multipart uploads

  • ListMultipartUploads requires the exact object name as a prefix.

  • The AbortIncompleteMultipartUpload lifecycle action is not supported with PutBucketLifecycle.

Bucket APIs

Bucket replication

Bucket lifecycle

Bucket notifications

Bucket policies

Unsupported bucket API operations

  • GetBucketInventoryConfiguration
  • PutBucketInventoryConfiguration
  • DeleteBucketInventoryConfiguration
  • GetBucketMetricsConfiguration
  • PutBucketMetricsConfiguration
  • DeleteBucketMetricsConfiguration
  • PutBucketWebsite
  • GetBucketLogging
  • PutBucketLogging
  • PutBucketAccelerateConfiguration
  • DeleteBucketAccelerateConfiguration
  • PutBucketRequestPayment
  • DeleteBucketRequestPayment
  • PutBucketAcl
  • HeadBucketAcl
  • GetPublicAccessBlock
  • PutPublicAccessBlock
  • DeletePublicAccessBlock
  • GetBucketOwnershipControls
  • PutBucketOwnershipControls
  • DeleteBucketOwnershipControls
  • GetBucketIntelligentTieringConfiguration
  • PutBucketIntelligentTieringConfiguration
  • ListBucketIntelligentTieringConfigurations
  • DeleteBucketIntelligentTieringConfiguration
  • GetBucketAnalyticsConfiguration
  • PutBucketAnalyticsConfiguration
  • ListBucketAnalyticsConfigurations
  • DeleteBucketAnalyticsConfiguration

MinIO AIStor alternatives for unsupported bucket API operations

  • For calls to BucketACL or ObjectACL operations, use Policies.
  • For calls to BucketWebsite operations, use caddy or nginx.
  • For calls to BucketAnalytics, BucketMetrics, or BucketLogging operations, use Bucket notifications.

S3 extensions

MinIO AIStor extends the S3 API with additional capabilities.

Object checksums

MinIO AIStor accepts a checksum on write, returns it on read, and reports it through GetObjectAttributes. Send the digest in the header for the algorithm you are using, and name that algorithm in x-amz-checksum-algorithm.

AlgorithmHeader
CRC32x-amz-checksum-crc32
CRC32Cx-amz-checksum-crc32c
CRC64NVMEx-amz-checksum-crc64nvme
SHA1x-amz-checksum-sha1
SHA256x-amz-checksum-sha256
MD5x-amz-checksum-md5
SHA512x-amz-checksum-sha512
XXHASH64x-amz-checksum-xxhash64
XXHASH3x-amz-checksum-xxhash3
XXHASH128x-amz-checksum-xxhash128

CRC32, CRC32C, CRC64NVME, SHA1, and SHA256 are the algorithms AWS S3 defines. MD5, SHA512, XXHASH64, XXHASH3, and XXHASH128 are a MinIO AIStor extension, so a client written against AWS S3 will not recognize them.

x-amz-checksum-type reports how the checksum covers the object:

  • FULL_OBJECT — the digest covers the whole object.
  • COMPOSITE — the digest is a hash of the individual part digests, so it changes when the part layout changes, even if the content does not.

Checksums in listings

ListObjects, ListObjectsV2, and ListObjectVersions report the checksum algorithm and type for each object, matching AWS S3.

Returning the digest itself is a MinIO AIStor extension. A listing returns digests only when it requests object metadata and the caller is permitted to read the object. A caller holding s3:ListBucket alone receives the algorithm and type, but no digest.

Checksums on objects encrypted with SSE-S3 or SSE-KMS are decrypted for the listing. An SSE-C checksum is sealed as a whole, so neither the digest nor the algorithm is readable without the client key.

S3 over RDMA

On a deployment running the RDMA build, GetObject, PutObject, and UploadPart can transfer object data directly between client memory and the server over RDMA, using the AWS S3 RDMA protocol. GetObject writes into the client’s buffer; PutObject and UploadPart read from it. That buffer is usually GPU memory, which is where RDMA pays off most, but host memory works too and needs no GPU.

The client opts in per request with a header; there is no server setting.

HeaderDirectionDescription
x-amz-rdma-tokenRequestThe client’s RDMA buffer descriptor.
x-amz-rdma-replyResponse200 or 206 when the transfer used RDMA, 501 when the server declined.
x-amz-rdma-bytes-transferredResponseBytes transferred out of band, when non-zero.

On a successful RDMA transfer the server sets Content-Length: 0, because the object bytes did not travel in the HTTP response.

When the server declines, it returns an S3 error response rather than serving the object over HTTP. Retrying without the x-amz-rdma-token header is the client’s responsibility. The MinIO SDKs below handle this automatically.

Reliable Connection clients first perform a handshake at POST /rdma/connect, exchanging descriptors through the same x-amz-rdma-token header. Dynamically Connected clients do not use this route.

SDK support

S3 over RDMA is supported by the MinIO SDKs for Go, C++, Rust, and Python.

Each of them uses NVIDIA cuObjClient to move the object payload between GPU memory and the network adapter.

For worked examples in each language, see Transfer Objects over RDMA.

For deployment, see RDMA acceleration.

S3 Express mode

When MinIO AIStor runs in S3 Express mode, the supported S3 API surface differs from the default S3 API mode. S3 Express mode also adds the AppendObject behavior, which lets a client append data to an existing object by issuing a PutObject request with the x-amz-write-offset-bytes header. For the list of operations supported and disabled in S3 Express mode, see S3 Express mode.

MinIO-specific error codes

In addition to the standard S3 error codes, MinIO AIStor returns the following MinIO-specific error codes:

CodeHTTP statusDescription
NotSupported501API operation not implemented.
NotImplemented501KMS not configured or feature unavailable.
XMinioHealNotImplemented400Healing not available in this mode.
XMinioLDAPNotEnabled501LDAP must be enabled for this operation.
InvalidToken400Object Lambda output token mismatch.
LambdaFunctionStatusError400Object Lambda function returned an invalid status.
RDMATransferError503An S3-over-RDMA transfer failed. Retry the request, without the x-amz-rdma-token header to fall back to HTTP.

KMS error codes

KMS-backed operations return these codes, including when the KMS itself is unreachable:

CodeHTTP statusDescription
kms:NotAuthorized403The KMS credentials lack permission for the operation.
kms:KeyNotFound404No key exists with the given key ID.
kms:KeyAlreadyExists409A key already exists with the given key ID.
kms:InvalidCiphertextException400The ciphertext could not be decrypted. The key material does not match.
kms:DecryptionFailed503The decryption request could not be completed at all, for example because the KMS was unreachable. Unlike kms:InvalidCiphertextException, this does not imply invalid ciphertext. Retry the request.
kms:NotSupported501The configured KMS does not support the requested functionality.
kms:KeyCreationFailed503The KMS could not create the key.
kms:KeyDeletionFailed503The KMS could not delete the key.
kms:KeyListingFailed503The KMS could not list keys.
kms:KeyGenerationFailed503The KMS could not generate a data key.

A request that the client cancels while a KMS operation is in flight returns status 499 rather than a KMS error.

Changed in RELEASE.2026-08-07T18-34-35Z

A KMS-backed request previously returned 500 whatever the cause. It now returns 503 when the KMS is unreachable, which distinguishes a retryable outage from an invalid ciphertext, and 499 when the client cancels the request.

Update any client retry logic or alerting rule that keys on a 500 response to a KMS-backed operation.

On this page