---
title: "Control API Object Storage and Hosted Git | Tarka Docs"
description: "Provision Tarka Object Storage buckets, scoped S3 credentials, Hosted Git identities, and private repositories through the Control API."
url: "https://tarkahq.com/docs/control-api/data/"
---

Available Control API · Data

# Object Storage and Hosted Git

Manage private data and source resources through the Control API, then connect standard S3 and Git clients directly to their data planes.

Object Storage

## Provision a private, versioned bucket

Bucket display names are lowercase DNS labels of at most 40 characters and are unique within an organization. The response contains a generated `s3_bucket_name`, endpoint, region, versioning state, and lifecycle status.

Create bucket `Control API`

```
curl -X POST \
  "https://tarka.rest/control/v1/orgs/$TARKA_ORG_ID/storage/buckets" \
  -H "Authorization: Bearer $TARKA_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"training-data"}'
```

**Use the returned S3 name.**

Do not construct or predict `s3_bucket_name`. Its format is an implementation detail that prevents cross-organization collisions.

S3 credentials

## Create one access key ID and secret per workload

A credential is bound to exactly one bucket. The creation response returns `access_key_id`, `secret_access_key`, endpoint, and region. The secret is never returned again.

Create credential `one-time secret`

```
curl -X POST \
  "https://tarka.rest/control/v1/orgs/$TARKA_ORG_ID/storage/buckets/$BUCKET_ID/credentials" \
  -H "Authorization: Bearer $TARKA_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"label":"training uploader"}'
```

**Endpoint** `https://storage.tarka.rest`

Standard HTTPS on port 443. Configure the custom endpoint explicitly.

**Addressing** `path style`

Configure S3-compatible clients to address the returned bucket name by path.

**Rotation** `replace, then revoke`

Create a replacement, update and verify the workload, then revoke the old credential.

To save model inputs and outputs automatically, configure [inference capture](https://tarkahq.com/docs/control-api/inference-capture/). It creates or reuses the organization’s `inference-history` bucket and is off by default.

**Bucket deletion requires an empty versioned bucket.**

Remove current objects, historical versions, and delete markers through S3 before calling the Control API delete method. Deletion is rejected while data remains.

Hosted Git

## Prepare identity before creating repositories

`EnsureHostedGitAccess` idempotently provisions or reconciles the authenticated account's Forgejo identity and returns its stable username, state, and web URL.

Prepare Git identity `POST /me/git-access`

```
curl -X POST "https://tarka.rest/control/v1/me/git-access" \
  -H "Authorization: Bearer $TARKA_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

Create repository `private + LFS`

```
curl -X POST \
  "https://tarka.rest/control/v1/orgs/$TARKA_ORG_ID/git-repositories" \
  -H "Authorization: Bearer $TARKA_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"agent-source",
    "description":"Private source for the research agent",
    "initialize":true,
    "default_branch":"main"
  }'
```

Repository responses contain Tarka and Forgejo identifiers, web URL, SSH and HTTPS clone URLs, default branch, private/LFS flags, status, and timestamps. Names are organization-scoped and validated as Git repository names.

**Git authentication is separate.**

Add an SSH public key or create a personal access token in Hosted Git settings. Neither a Tarka account token nor a `tk_live_` key authenticates clone, fetch, or push.

Deletion and state

## Product-specific deletion retains auditable control state

Storage and Git deletion methods require owner, admin, or operator and the matching product entitlement. Successful deletion removes the data-plane resource and records final lifecycle state. Credential revocation is permanent and safe to repeat.

**Deletion is destructive.**

Confirm required objects or repository data have been copied elsewhere. Deleted repository content and revoked credential secrets cannot be recovered through the Control API.

Reference

## REST routes

Prefix every path with `https://tarka.rest/control/v1`. See the detailed [Object Storage](https://tarkahq.com/docs/data/object-storage/) and [Hosted Git](https://tarkahq.com/docs/data/hosted-git/) guides for client configuration.

### Object Storage

| Method | Path | Ability |
| --- | --- | --- |
| `GET` | `/orgs/{org_id}/inference-capture` | Read customer capture settings and delivery health |
| `PUT` | `/orgs/{org_id}/inference-capture` | Enable or disable customer capture and choose expiry |
| `POST` | `/orgs/{org_id}/storage/buckets` | Provision a private versioned bucket |
| `GET` | `/orgs/{org_id}/storage/buckets` | List buckets |
| `DELETE` | `/orgs/{org_id}/storage/buckets/{bucket_id}` | Delete an empty bucket |
| `POST` | `/orgs/{org_id}/storage/buckets/{bucket_id}/credentials` | Create a bucket-scoped access key and secret |
| `GET` | `/orgs/{org_id}/storage/buckets/{bucket_id}/credentials` | List redacted credential metadata |
| `POST` | `/orgs/{org_id}/storage/buckets/{bucket_id}/credentials/{credential_id}:revoke` | Permanently revoke a credential |

### Hosted Git

| Method | Path | Ability |
| --- | --- | --- |
| `POST` | `/me/git-access` | Provision or reconcile the account Git identity |
| `POST` | `/orgs/{org_id}/git-repositories` | Create a private LFS-enabled repository |
| `GET` | `/orgs/{org_id}/git-repositories` | List repositories and clone URLs |
| `DELETE` | `/orgs/{org_id}/git-repositories/{repository_id}` | Delete a repository |