> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server. # What works with Zata Zata speaks the Amazon S3 API, so most S3 tools and SDKs work without changes. Use this page to check whether a feature your app needs is supported, and which limits apply. ## Connection | Feature | On Zata | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Path-style URLs (`https://idr01.zata.ai/my-bucket`) | Supported (recommended) | | Virtual-host style URLs (`https://my-bucket.idr01.zata.ai`) | Supported. Bucket names with a dot fail the certificate check in this style, so use path-style for them. | | Signature V4 | Supported (recommended) | | Signature V2 | Supported | | Region name | Not checked. Use `us-east-1`. | | HTTPS | Required. `http://` is redirected to `https://`. The certificates are public (Let's Encrypt), so you never need a custom certificate. | | Endpoints | `https://idr01.zata.ai` (Indore) and `https://bom01.zata.ai` (Mumbai). Each bucket and each access key belongs to one region. | Two things in newer tools need a setting: * **Default checksums in AWS SDKs and the AWS CLI** (versions from January 2025): large uploads fail with `XAmzContentSHA256Mismatch` until you set checksums to "when required". See [Tools built on the AWS SDK](/connect/overview#tools-built-on-the-aws-sdk). * **Tools that sign the `Accept-Encoding` header** get `403 SignatureDoesNotMatch`, because this header changes on the way to Zata. rclone needs `sign_accept_encoding = false` ([rclone on Linux](/connect/command-line/rclone-linux)), and Go apps need a small fix ([Go](/connect/code/go)). Python tools are not affected. ## Features | Feature | Supported | Notes | | ------------------------------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Buckets, objects and folders | Yes | Folders are name prefixes, as on Amazon S3. | | Multipart upload | Yes | See [Limits](#limits). | | Server-side copy (CopyObject) | Yes | | | Presigned URLs | Yes | Download (GET) and upload (PUT) links work. An upload must send the same `Content-Type` that was signed. See [Share a file](/buckets/share-a-file). | | Versioning | Yes | Turn it on in the bucket settings. See [Bucket settings](/buckets/bucket-settings) and [Delete and restore files](/buckets/delete-and-restore-files). | | Object Lock | Yes | Governance mode, compliance mode and legal hold. Can only be turned on when the bucket is created. See [Object Lock](/buckets/object-lock/overview). | | Lifecycle rules | Yes | Rules that filter by object size, or keep the newest N old versions, work in Mumbai only. See [Lifecycle rules](/buckets/lifecycle-rules). | | Bucket and object tags | Yes | See [Tags](/buckets/tags). | | ACLs | Yes | See [Bucket ACL](/access/bucket-acl) and [Object ACL](/access/object-acl). | | Bucket policies | Partly | A subset of the AWS policy language: no IAM policies and no `${...}` variables. Principals are Zata user IDs, not AWS account IDs. See [What policies support](/access/policy-support). | | S3 Select | Yes | | | CORS (browser access) | On request | Ask Zata support. See [Browser and SDK access](/access/browser-access). | | Server-side encryption (SSE-S3, SSE-C, SSE-KMS) | No | Requests with encryption headers are rejected (`InvalidRequest`). Turn the tool's encryption option off, or encrypt files before you upload them. | | Storage classes | Standard only | `GLACIER`, `DEEP_ARCHIVE`, `STANDARD_IA` and other classes are rejected (`InvalidArgument`). Leave the storage class empty or set `STANDARD`. | | STS, temporary credentials, IAM roles, AssumeRole | No | Use [sub-users](/sub-users/overview) to give limited access. | | IAM users and IAM policies | No | Use sub-users and bucket policies. | | Server access logs | No | You cannot see Zata's request logs. Use your tool's debug output; [Zata support](/help/support) can check the logs on Zata's side. | ## Limits | Limit | Value | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | Single upload (one PUT request) | Up to 5 GB. Larger files must use multipart upload, otherwise `EntityTooLarge`. | | Multipart part size | At least 5 MB for every part except the last, otherwise `EntityTooSmall` | | Parts per multipart upload | Up to 10,000 | | Part order | Parts can be uploaded in any order. | | Unfinished multipart uploads | Keep using storage until they are completed or cancelled. See [Large uploads](/help/troubleshooting/large-uploads). | | ETag of a multipart upload | Ends in `-N` (the number of parts) and is not the file's MD5. A different ETag does not mean the file is damaged. | | Clock difference | Requests are rejected with `RequestTimeTooSkewed` when your computer's clock is more than about 15 minutes off. | ## Sub-user keys A sub-user's access key works like the owner's key, with these differences: * It cannot create buckets (`AccessDenied`). * Its bucket list is empty, even for buckets it can use. Open the bucket by its name. * It can only do what the account owner allowed on each bucket. See [Access types](/sub-users/access-types).