Wrong endpoint or region

This page helps when your tool talks to the wrong endpoint, or when the key or the bucket is in the other region. Typical errors are InvalidAccessKeyId, NoSuchBucket and PermanentRedirect (301).

Zata has two regions, and each has its own endpoint. Each bucket is in one region, and each access key works in one region only.

Region	Endpoint
Indore (`idr01`)	`https://idr01.zata.ai`
Mumbai (`bom01`)	`https://bom01.zata.ai`

The region name in your tool does not matter — Zata does not check it. Use us-east-1. What matters is the endpoint. See Endpoints and regions.

Quick fixes

You see	Most likely cause	Fix
`InvalidAccessKeyId`	The key is from the other region, mistyped or deleted — or no endpoint is set, so the tool sends the request to AWS	Use a key from the bucket’s region and set the endpoint
`NoSuchBucket` (404)	A typo in the bucket name, the bucket is in the other region, or it was deleted	Check the name, then the bucket’s region
`PermanentRedirect` or `301`	The endpoint starts with `http://`	Use `https://`
AWS CLI: `maximum recursion depth exceeded`	The endpoint starts with `http://`	Use `https://`
`AccessDenied` (403) on a bucket that exists	Usually a sub-user permission	See Access denied
Certificate error, bucket name contains a dot	Virtual-host style with a dotted bucket name	Use path-style — see Network and certificates

Find the region of a bucket and a key

In the Zata console:

Buckets shows each bucket’s region in the Region column.
Access Keys shows each key’s region in the Region column. A key is created for one region; the page lists the keys of both regions.

The key file you downloaded when you created the key also lists its Service URL and Region.

To check from the command line, ask both endpoints for the bucket with the same key:

aws s3api head-bucket --bucket my-bucket --profile zata --endpoint-url https://idr01.zata.ai
aws s3api head-bucket --bucket my-bucket --profile zata --endpoint-url https://bom01.zata.ai

The endpoint that answers without an error is the one to use with this key. The other gives a 403 or 404. If both fail, the key and the bucket are in different regions, or the key cannot use the bucket — check both in the console.

aws s3 ls shows bucket names and dates, never the region. You choose a bucket’s region when you create it, and you cannot change it later.

Set the endpoint

The endpoint is only the address: https://idr01.zata.ai or https://bom01.zata.ai. It must not contain a bucket name, a path or s3.amazonaws.com. In apps that ask for a host or server, enter idr01.zata.ai (or bom01.zata.ai) and turn HTTPS on.

AWS CLI

rclone

boto3

s3fs

s3cmd

See which endpoint and keys the profile uses:

aws configure get endpoint_url --profile zata
aws configure list --profile zata

Change the endpoint (here to Mumbai):

aws configure set endpoint_url https://bom01.zata.ai --profile zata

AWS CLI versions older than v2.13 ignore this setting: add --endpoint-url https://idr01.zata.ai to every command. See AWS CLI.

Use both regions

Because each key works in one region, you need a separate profile or remote for each region, each with a key created for that region. For example, a second rclone remote for Mumbai:

rclone config create zata-mumbai s3 provider=Other access_key_id=YOUR_MUMBAI_ACCESS_KEY secret_access_key=YOUR_MUMBAI_SECRET_KEY region=us-east-1 endpoint=https://bom01.zata.ai force_path_style=true no_check_bucket=true sign_accept_encoding=false

With the AWS CLI, create a second profile (for example zata-mumbai) with aws configure --profile zata-mumbai and set its endpoint to https://bom01.zata.ai.

Checklist

The endpoint is exactly https://idr01.zata.ai or https://bom01.zata.ai.
The access key was created in the same region as the bucket.
The key is listed on Access Keys with the status Active.
The bucket name is typed exactly: lowercase, no spaces.
The key belongs to the account that owns the bucket. A key from another Zata account cannot see your buckets.

See the real error

Zata’s error responses contain an error code but no message text, so look for the code. The debug output contains your access key ID — remove it before you share the output.

Tool	Run	Look for
AWS CLI	add `--debug` to the command	`url=` in the `Sending http request` line shows where the request went; `<Code>` in the `Response body` line
rclone	add `-vv --dump headers`	the `Host:` line of the request, and `api error` with the code in the last line
s3fs	mount with `-f -o dbglevel=info`	the failing request and its HTTP response code

If the request goes to an amazonaws.com address, the tool has no Zata endpoint set.

Still stuck?

Contact Zata support (see Get support) and include:

the tool and its version (aws --version, rclone version, s3fs --version)
the endpoint you use, and the region of the bucket and of the key as the console shows them
the exact error code, and the RequestId from the error response
the debug output from above, with access keys removed