Storage Browser

Get project storage summary

Returns aggregated storage analytics for all backup destinations used by a project.

Authorization

Authorization<token>

JWT Bearer token (format: Bearer {token})

In: header

Path Parameters

idRequiredstring

Project ID (UUID)

curl -X GET "//api.ocore.dev/api/projects/<string>/storage" \
  -H "Authorization: <token>"

{
  "destinations": [
    {
      "destinationType": "string",
      "id": "string",
      "name": "string",
      "orphanFiles": 0,
      "orphanSizeBytes": 0,
      "scannedAt": "string",
      "totalFiles": 0,
      "totalSizeBytes": 0
    }
  ],
  "lastScannedAt": "string",
  "orphanFiles": 0,
  "orphanSizeBytes": 0,
  "totalFiles": 0,
  "totalSizeBytes": 0
}

Get storage analytics

Returns the most recent storage scan result for a backup destination.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X GET "//api.ocore.dev/api/storage/destinations/<string>/analytics" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>"

{
  "analytics": {
    "error_message": "string",
    "files_by_environment": {
      "property1": {
        "count": 0,
        "env_name": "string",
        "size_bytes": 0
      },
      "property2": {
        "count": 0,
        "env_name": "string",
        "size_bytes": 0
      }
    },
    "id": "string",
    "largest_files": [
      {
        "modified": "string",
        "path": "string",
        "size": 0
      }
    ],
    "legacyWalFiles": 0,
    "legacyWalSizeBytes": 0,
    "orphan_files": 0,
    "orphan_size_bytes": 0,
    "scan_duration_ms": 0,
    "scanned_at": "string",
    "total_files": 0,
    "total_size_bytes": 0
  }
}

Browse backup destination

Lists files in a backup destination at an optional prefix path.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Query Parameters

prefixstring

Exact opaque directory path returned by a previous browse response

cursorstring

Opaque continuation cursor returned by the previous page

limitinteger

Page size

Default: 150Minimum: 1Maximum: 500

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X GET "//api.ocore.dev/api/storage/destinations/<string>/browse?prefix=%3Cstring%3E&cursor=%3Cstring%3E&limit=150" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>"

{
  "files": [
    {
      "deletionToken": "string",
      "displayPath": [
        "string"
      ],
      "isDir": true,
      "linkedBackupId": "string",
      "linkedEnvName": "string",
      "linkedSnapshotId": "string",
      "modified": "string",
      "path": "string",
      "size": 0
    }
  ],
  "hasMore": true,
  "nextCursor": "string",
  "prefix": "string",
  "totalCount": 0
}

Trigger orphan file cleanup

Enqueues a cleanup job that deletes orphan files (not linked to any backup/snapshot) older than the retention window. Returns 202 Accepted.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Request Body

application/jsonRequired

Requires retention_days, snapshot_token, and exactly one of candidate_ids (maximum 100) or all_eligible=true

all_eligibleboolean

candidate_idsarray<string>

retention_daysRequiredinteger

Minimum: 1Maximum: 3650

snapshot_tokenRequiredstring

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X POST "//api.ocore.dev/api/storage/destinations/<string>/cleanup-orphans" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "all_eligible": true,
    "candidate_ids": [
      "string"
    ],
    "retention_days": 1,
    "snapshot_token": "string"
  }'

Accepted

{
  "message": "Orphan file cleanup enqueued"
}

Download file from destination

Streams file content through the authenticated API from any backup destination provider. Authenticate with the access_token session cookie or an Authorization header containing Bearer ocore_; JWT bearer headers are not supported. Native browser navigation should use the URL returned by the prepare endpoint.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Query Parameters

pathRequiredstring

Exact opaque browser path returned by the browse endpoint

identity_tokenstring

Opaque file identity token returned by the browse endpoint; required when the listed provider exposes exact revision identity

organization_idstring

Validated organization ID returned by the prepare endpoint for cookie-session navigation

curl -X GET "//api.ocore.dev/api/storage/destinations/<string>/download?path=%3Cstring%3E&identity_token=%3Cstring%3E&organization_id=%3Cstring%3E" \
  -H "Cookie: <token>"

"string"

Prepare a native storage download

Validates the destination, exact opaque browser path, tenant ownership, and provider access before returning a same-origin relative download URL. This browser-navigation endpoint requires the access_token session cookie; API-key clients should call the direct GET download endpoint with their Authorization header.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Request Body

application/jsonRequired

Exact opaque browser path and identity_token returned by the browse endpoint

identity_tokenstring

pathRequiredstring

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X POST "//api.ocore.dev/api/storage/destinations/<string>/download/prepare" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "identity_token": "string",
    "path": "backups/production/backup.dump"
  }'

{
  "download_url": "/api/storage/destinations/550e8400-e29b-41d4-a716-446655440000/download?organization_id=550e8400-e29b-41d4-a716-446655440001&path=backups%2Fproduction%2Fbackup.dump"
}

Delete file from destination

Permanently removes the exact listed provider object. Listed-identity providers such as S3 require the opaque deletion token returned by the browse endpoint.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Request Body

application/jsonRequired

Listed file path and opaque deletion identity token

deletion_tokenstring

pathRequiredstring

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X DELETE "//api.ocore.dev/api/storage/destinations/<string>/files" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "deletion_token": "string",
    "path": "backups/production/backup.dump"
  }'

{
  "message": "File deleted successfully"
}

List scan-confirmed orphan files

Returns a bounded, point-in-time cleanup preview. Candidate IDs and cursors are opaque and bound to the caller, organization, destination, scan, and retention window.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Query Parameters

retention_daysinteger

Minimum orphan age in days

Default: 30Minimum: 1Maximum: 3650

cursorstring

Opaque continuation cursor

limitinteger

Page size

Default: 100Minimum: 1Maximum: 100

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X GET "//api.ocore.dev/api/storage/destinations/<string>/orphans?retention_days=30&cursor=%3Cstring%3E&limit=100" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>"

{
  "candidates": [
    {
      "displayPath": [
        "string"
      ],
      "eligible": true,
      "id": "string",
      "ineligibleReason": "string",
      "modified": "string",
      "size": 0
    }
  ],
  "eligibleCount": 0,
  "eligibleSizeBytes": 0,
  "hasMore": true,
  "nextCursor": "string",
  "retentionDays": 0,
  "scanId": "string",
  "scannedAt": "string",
  "snapshotToken": "string",
  "totalCount": 0,
  "totalSizeBytes": 0,
  "trackedCount": 0,
  "untrackedCount": 0
}

Trigger storage scan

Enqueues a correlated background storage scan job for the destination. Returns 202 Accepted.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X POST "//api.ocore.dev/api/storage/destinations/<string>/scan" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>"

Accepted

{
  "message": "Storage scan enqueued",
  "operation_id": "550e8400-e29b-41d4-a716-446655440000"
}

Scan and cleanup stale records

Enqueues a correlated storage scan that also removes stale backup/snapshot records whose remote files no longer exist. Returns 202 Accepted.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X POST "//api.ocore.dev/api/storage/destinations/<string>/scan-cleanup" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>"

Accepted

{
  "message": "Storage scan enqueued",
  "operation_id": "550e8400-e29b-41d4-a716-446655440000"
}

Get storage scan operation status

Returns the stable public lifecycle state for one correlated storage scan. Missing and cross-tenant operations are concealed as not found.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Path Parameters

destIdRequiredstring

Backup Destination ID (UUID)

operationIdRequiredstring

Opaque scan operation ID (UUID)

Header Parameters

X-Organization-IDstring

Organization selector for a non-default membership

curl -X GET "//api.ocore.dev/api/storage/destinations/<string>/scan-operations/<string>" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>"

{
  "status": "running"
}

Upload file to destination

Uploads a file to the specified path in a backup destination.

Authorization

Cookie<token>

Browser session JWT sent as the access_token cookie. Swagger 2 represents this cookie through the Cookie header.

In: header

Authorization<token>

oCore API key sent as Authorization: Bearer ocore_. JWT bearer tokens are not accepted in this header for these operations.

In: header

Request Body

multipart/form-dataRequired

fileRequiredfile

File to upload (maximum request size 20 GB)

Format: "binary"

curl -X POST "//api.ocore.dev/api/storage/destinations/<string>/upload?path=%3Cstring%3E" \
  -H "X-Organization-ID: <string>" \
  -H "Cookie: <token>" \
  -F file="string"

{
  "message": "string",
  "path": "string",
  "size": 0
}

Storage Browser

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript

Response

TypeScript