> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Wrong endpoint or region

This page helps when your tool talks to the wrong endpoint, or when the key or the bucket is in the other region. Typical errors are `InvalidAccessKeyId`, `NoSuchBucket` and `PermanentRedirect` (301).

Zata has two regions, and each has its own endpoint. Each bucket is in one region, and each access key works in one region only.

| Region           | Endpoint                |
| ---------------- | ----------------------- |
| Indore (`idr01`) | `https://idr01.zata.ai` |
| Mumbai (`bom01`) | `https://bom01.zata.ai` |

The region **name** in your tool does not matter — Zata does not check it. Use `us-east-1`. What matters is the endpoint. See [Endpoints and regions](/get-started/endpoints-and-regions).

## Quick fixes

| You see                                       | Most likely cause                                                                                                   | Fix                                                                                                                    |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| `InvalidAccessKeyId`                          | The key is from the other region, mistyped or deleted — or no endpoint is set, so the tool sends the request to AWS | [Use a key from the bucket's region](#find-the-region-of-a-bucket-and-a-key) and [set the endpoint](#set-the-endpoint) |
| `NoSuchBucket` (404)                          | A typo in the bucket name, the bucket is in the other region, or it was deleted                                     | Check the name, then [the bucket's region](#find-the-region-of-a-bucket-and-a-key)                                     |
| `PermanentRedirect` or `301`                  | The endpoint starts with `http://`                                                                                  | Use `https://`                                                                                                         |
| AWS CLI: `maximum recursion depth exceeded`   | The endpoint starts with `http://`                                                                                  | Use `https://`                                                                                                         |
| `AccessDenied` (403) on a bucket that exists  | Usually a sub-user permission                                                                                       | See [Access denied](/help/troubleshooting/access-denied)                                                               |
| Certificate error, bucket name contains a dot | Virtual-host style with a dotted bucket name                                                                        | Use path-style — see [Network and certificates](/help/troubleshooting/network-and-certificates)                        |

## Find the region of a bucket and a key

In the Zata console:

* **Buckets** shows each bucket's region in the **Region** column.
* **Access Keys** shows each key's region in the **Region** column. A key is created for one region; the page lists the keys of both regions.

The key file you downloaded when you created the key also lists its **Service URL** and **Region**.

To check from the command line, ask both endpoints for the bucket with the same key:

```bash
aws s3api head-bucket --bucket my-bucket --profile zata --endpoint-url https://idr01.zata.ai
aws s3api head-bucket --bucket my-bucket --profile zata --endpoint-url https://bom01.zata.ai
```

The endpoint that answers without an error is the one to use with this key. The other gives a 403 or 404. If both fail, the key and the bucket are in different regions, or the key cannot use the bucket — check both in the console.

> **Note**
>
> `aws s3 ls` shows bucket names and dates, never the region. You choose a bucket's region when you create it, and you cannot change it later.

## Set the endpoint

The endpoint is only the address: `https://idr01.zata.ai` or `https://bom01.zata.ai`. It must not contain a bucket name, a path or `s3.amazonaws.com`. In apps that ask for a host or server, enter `idr01.zata.ai` (or `bom01.zata.ai`) and turn HTTPS on.

#### AWS CLI

See which endpoint and keys the profile uses:

```bash
aws configure get endpoint_url --profile zata
aws configure list --profile zata
```

Change the endpoint (here to Mumbai):

```bash
aws configure set endpoint_url https://bom01.zata.ai --profile zata
```

AWS CLI versions older than v2.13 ignore this setting: add `--endpoint-url https://idr01.zata.ai` to every command. See [AWS CLI](/connect/command-line/aws-cli).

#### rclone

```bash
rclone config update zata endpoint=https://bom01.zata.ai
```

The key must be from the same region as the endpoint. See [rclone on Linux](/connect/command-line/rclone-linux).

#### boto3

```python
s3 = boto3.client(
    "s3",
    endpoint_url="https://bom01.zata.ai",
    region_name="us-east-1",
    # ... keys and config as on the Python page
)
```

See [Python](/connect/code/python).

#### s3fs

Give the endpoint with `-o url=`:

```bash
sudo s3fs my-bucket /mnt/zata -o passwd_file=/etc/passwd-s3fs -o url=https://bom01.zata.ai -o use_path_request_style
```

See [s3fs](/connect/mount/s3fs).

#### s3cmd

In `~/.s3cfg`, change both lines:

```ini
host_base = bom01.zata.ai
host_bucket = bom01.zata.ai
```

See [s3cmd](/connect/command-line/s3cmd).

## Use both regions

Because each key works in one region, you need a separate profile or remote for each region, each with a key created for that region. For example, a second rclone remote for Mumbai:

```bash
rclone config create zata-mumbai s3 provider=Other access_key_id=YOUR_MUMBAI_ACCESS_KEY secret_access_key=YOUR_MUMBAI_SECRET_KEY region=us-east-1 endpoint=https://bom01.zata.ai force_path_style=true no_check_bucket=true sign_accept_encoding=false
```

With the AWS CLI, create a second profile (for example `zata-mumbai`) with `aws configure --profile zata-mumbai` and set its endpoint to `https://bom01.zata.ai`.

## Checklist

1. The endpoint is exactly `https://idr01.zata.ai` or `https://bom01.zata.ai`.
2. The access key was created in the same region as the bucket.
3. The key is listed on **Access Keys** with the status **Active**.
4. The bucket name is typed exactly: lowercase, no spaces.
5. The key belongs to the account that owns the bucket. A key from another Zata account cannot see your buckets.

## See the real error

Zata's error responses contain an error code but no message text, so look for the code. The debug output contains your access key ID — remove it before you share the output.

| Tool    | Run                              | Look for                                                                                                     |
| ------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| AWS CLI | add `--debug` to the command     | `url=` in the `Sending http request` line shows where the request went; `<Code>` in the `Response body` line |
| rclone  | add `-vv --dump headers`         | the `Host:` line of the request, and `api error` with the code in the last line                              |
| s3fs    | mount with `-f -o dbglevel=info` | the failing request and its HTTP response code                                                               |

If the request goes to an `amazonaws.com` address, the tool has no Zata endpoint set.

## Still stuck?

Contact Zata support (see [Get support](/help/support)) and include:

* the tool and its version (`aws --version`, `rclone version`, `s3fs --version`)
* the endpoint you use, and the region of the bucket and of the key as the console shows them
* the exact error code, and the `RequestId` from the error response
* the debug output from above, with access keys removed