> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tape.network/llms.txt
> Use this file to discover all available pages before exploring further.

# S3 Compatibility

The gateway implements the S3 operations that storage tooling actually uses. This page is the honest list: what works, what returns an error code instead of pretending, and the places where Tapedrive's model shows through the S3 API.

## Supported operations

| Operation                                                  | Notes                                                                                                                               |
| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| ListBuckets                                                | Signed only. A bucket-scoped credential lists its allow-listed buckets; an own-tape credential lists your tape. Anonymous gets 403. |
| ListObjectsV2                                              | `prefix`, `delimiter` (common prefixes), `start-after`, continuation tokens, `max-keys` up to 1000.                                 |
| ListObjects (V1)                                           | Legacy fallback with `marker` paging, same parameters otherwise.                                                                    |
| ListMultipartUploads                                       | The bucket's in-flight uploads.                                                                                                     |
| HeadBucket                                                 | 200 if the bucket's tape resolves on-chain, otherwise 404 `NoSuchBucket`.                                                           |
| GetObject / HeadObject                                     | Full headers; Range on any object, streamed included ([downloads](/tools/s3-gateway/downloads)).                                    |
| PutObject                                                  | Buffered or streamed by payload mode ([uploads](/tools/s3-gateway/uploads)).                                                        |
| DeleteObject                                               | Real on-chain delete, idempotent ([deletions](/tools/s3-gateway/deletions)).                                                        |
| Multipart (Create, UploadPart, ListParts, Complete, Abort) | Durable across gateway restarts; 5 MiB minimum part size.                                                                           |

Recognized-but-unsupported S3 subresources (versioning, ACLs, and similar) return `501`. On supported operations the gateway reads only the SigV4 headers (`x-amz-date`, `x-amz-content-sha256`, and `x-amz-decoded-content-length` for chunked uploads) plus `Content-Type` on PutObject; every other request header, including `x-amz-meta-*`, storage-class, and encryption headers, is ignored rather than rejected.

## ETags are on-chain commitments

ETag values here are the object's on-chain commitment, and that's the divergence your tooling is most likely to notice. The value is deterministic, identical across every gateway and every operation, and a valid opaque ETag, which is all S3 itself guarantees for multipart uploads.

It is not an MD5 of your file. A client that compares ETag against a local MD5 will report mismatches that don't indicate corruption. Change-detection tooling that treats ETags as opaque (rclone's default behavior) works correctly.

<Note>
  If your client warns on ETag mismatch, disable its MD5-checksum verification. The data is verified far more strongly than MD5 on every read ([how reads verify](/protocol/architecture/gateways)).
</Note>

## Signing

The gateway accepts SigV4 via headers or presigned URLs. Signed payloads are hash-verified against `x-amz-content-sha256`, and presigned-URL expiry is enforced. Anonymous GET, HEAD, and LIST are allowed.

SigV2 is not supported; a SigV2 request is treated as unsigned.

## Semantics differences

Three behaviors come from the object layer underneath. Know them before you build on it:

* **Overwrite is last-write-wins.** Writing to an existing key creates a new track under the same name; there is no versioning ([objects](/protocol/architecture/objects)).
* **Deletes are real and idempotent.** Deleted capacity returns to the tape.
* **Buckets can expire.** An object lives as long as its bucket's tape. AWS has no concept for this, so your tooling won't warn you: watch tape expiry and extend in time ([tapes](/protocol/architecture/tapes)).