Object Storage and Hosted Git

Manage private data and source resources through the Control API, then connect standard S3 and Git clients directly to their data planes.

Object Storage

Provision a private, versioned bucket

Bucket display names are lowercase DNS labels of at most 40 characters and are unique within an organization. The response contains a generated s3_bucket_name, endpoint, region, versioning state, and lifecycle status.

Create bucketControl API

curl -X POST \
  "https://tarka.rest/control/v1/orgs/$TARKA_ORG_ID/storage/buckets" \
  -H "Authorization: Bearer $TARKA_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"training-data"}'

Use the returned S3 name.

Do not construct or predict s3_bucket_name. Its format is an implementation detail that prevents cross-organization collisions.

S3 credentials

Create one access key ID and secret per workload

A credential is bound to exactly one bucket. The creation response returns access_key_id, secret_access_key, endpoint, and region. The secret is never returned again.

Create credentialone-time secret

curl -X POST \
  "https://tarka.rest/control/v1/orgs/$TARKA_ORG_ID/storage/buckets/$BUCKET_ID/credentials" \
  -H "Authorization: Bearer $TARKA_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"label":"training uploader"}'

Endpointhttps://storage.tarka.rest

Standard HTTPS on port 443. Configure the custom endpoint explicitly.

Addressingpath style

Configure S3-compatible clients to address the returned bucket name by path.

Rotationreplace, then revoke

Create a replacement, update and verify the workload, then revoke the old credential.

To save model inputs and outputs automatically, configure inference capture. It creates or reuses the organization’s inference-history bucket and is off by default.

Bucket deletion requires an empty versioned bucket.

Remove current objects, historical versions, and delete markers through S3 before calling the Control API delete method. Deletion is rejected while data remains.

Hosted Git

Prepare identity before creating repositories

EnsureHostedGitAccess idempotently provisions or reconciles the authenticated account's Forgejo identity and returns its stable username, state, and web URL.

Prepare Git identityPOST /me/git-access

curl -X POST "https://tarka.rest/control/v1/me/git-access" \
  -H "Authorization: Bearer $TARKA_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

Create repositoryprivate + LFS

curl -X POST \
  "https://tarka.rest/control/v1/orgs/$TARKA_ORG_ID/git-repositories" \
  -H "Authorization: Bearer $TARKA_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"agent-source",
    "description":"Private source for the research agent",
    "initialize":true,
    "default_branch":"main"
  }'

Repository responses contain Tarka and Forgejo identifiers, web URL, SSH and HTTPS clone URLs, default branch, private/LFS flags, status, and timestamps. Names are organization-scoped and validated as Git repository names.

Git authentication is separate.

Add an SSH public key or create a personal access token in Hosted Git settings. Neither a Tarka account token nor a tk_live_ key authenticates clone, fetch, or push.

Deletion and state

Product-specific deletion retains auditable control state

Storage and Git deletion methods require owner, admin, or operator and the matching product entitlement. Successful deletion removes the data-plane resource and records final lifecycle state. Credential revocation is permanent and safe to repeat.

Deletion is destructive.

Confirm required objects or repository data have been copied elsewhere. Deleted repository content and revoked credential secrets cannot be recovered through the Control API.

Reference

REST routes

Prefix every path with https://tarka.rest/control/v1. See the detailed Object Storage and Hosted Git guides for client configuration.

Object Storage

Method	Path	Ability
`GET`	`/orgs/{org_id}/inference-capture`	Read customer capture settings and delivery health
`PUT`	`/orgs/{org_id}/inference-capture`	Enable or disable customer capture and choose expiry
`POST`	`/orgs/{org_id}/storage/buckets`	Provision a private versioned bucket
`GET`	`/orgs/{org_id}/storage/buckets`	List buckets
`DELETE`	`/orgs/{org_id}/storage/buckets/{bucket_id}`	Delete an empty bucket
`POST`	`/orgs/{org_id}/storage/buckets/{bucket_id}/credentials`	Create a bucket-scoped access key and secret
`GET`	`/orgs/{org_id}/storage/buckets/{bucket_id}/credentials`	List redacted credential metadata
`POST`	`/orgs/{org_id}/storage/buckets/{bucket_id}/credentials/{credential_id}:revoke`	Permanently revoke a credential

Hosted Git

Method	Path	Ability
`POST`	`/me/git-access`	Provision or reconcile the account Git identity
`POST`	`/orgs/{org_id}/git-repositories`	Create a private LFS-enabled repository
`GET`	`/orgs/{org_id}/git-repositories`	List repositories and clone URLs
`DELETE`	`/orgs/{org_id}/git-repositories/{repository_id}`	Delete a repository