curl or any other HTTP client. The AI Object Storage API allows users to set organization-wide access policies, configure bucket settings, and manage access keys.
- The API server is
https://api.coreweave.com. - Replace
[API-ACCESS-TOKEN]in the following examples with your CoreWeave API access token.
Operations
| Action | Method | Endpoint | Description |
|---|---|---|---|
| AuthCanI | POST | /v1/cwobject/auth/can-i | Check whether the current user is allowed to perform a set of actions on a set of resources. |
| CreateAccessKeyFromJWT | POST | /v1/cwobject/access-key | Create an access key through an API access token. |
| ListAccessKeyInfo | GET | /v1/cwobject/access-key | List information about all access keys. |
| GetAccessKeyInfo | GET | /v1/cwobject/access-key/[ACCESS-KEY-ID] | Get information about a specific access key. |
| ListAccessPolicies | GET | /v1/cwobject/access-policy | List all Object Storage access policies in the organization. |
| EnsureAccessPolicy | POST | /v1/cwobject/access-policy | Apply or update access policies. |
| DeleteAccessPolicy | DELETE | /v1/cwobject/access-policy/[POLICY-NAME] | Delete an access policy. |
| SetBucketSettings | PUT | /v1/cwobject/bucket/settings | Configure bucket settings that aren’t exposed in the S3-compatible API. |
| ListBucketInfo | GET | /v1/cwobject/bucket-info | List information about all buckets. |
| GetBucketInfo | GET | /v1/cwobject/bucket-info/[BUCKET-NAME] | Get information about a specific bucket. |
| SetOrganizationSettings | PUT | /v1/cwobject/organization/settings | Configure settings related to your organization and CoreWeave AI Object Storage. |
| RevokeAccessKeyByAccessKey | POST | /v1/cwobject/revoke-access-key/access-key | Revoke a specific access key. |
| RevokeAccessKeysByPrincipal | POST | /v1/cwobject/revoke-access-key/principal | Revoke all access keys for a principal. |
| CreateAccessKeyFromSAML | POST | /v1/cwobject/temporary-credentials/saml | Generate temporary access keys for CoreWeave AI Object Storage access through a SAML assertion. |
CWObject service:
| gRPC method | Documentation |
|---|---|
ListAccessKeyInfo | List access keys |
CreateAccessKeyFromJWT | Create access key |
UpdateAccessKeyStatus | Update access key status |
GetAccessKeyInfo | Get access key |
ListAccessPolicies | List access policies |
EnsureAccessPolicy | Apply or update access policy |
DeleteAccessPolicy | Delete access policy |
AuthCanI | Check authorization |
ListBucketInfo | List bucket info |
GetBucketInfo | Get bucket info |
SetBucketSettings | Set bucket settings |
SetOrganizationSettings | Set organization settings |
RevokeAccessKeyByAccessKey | Revoke an access key |
RevokeAccessKeysByPrincipal | Revoke a principal’s access keys |
CreateAccessKeyFromOIDC | Create access key from OIDC |
CreateAccessKeyFromContainerCreds | Create access key from container credentials |
CreateAccessKeyFromSAML | Create access key from SAML |
Authentication
Most requests authenticate with a CoreWeave API access token sent as a bearer token in theAuthorization header (the TokenAuth scheme). For required permissions on each operation, see IAM Access Policies.
Three endpoints are special and call out their own authentication requirements on the per-operation page:
POST /v1/cwobject/temporary-credentials/samlandPOST /v1/cwobject/temporary-credentials/oidcare anonymous on the CoreWeave side. They exchange an external IdP assertion for a CoreWeave access key, so no CoreWeave bearer token is required.GET /v1/cwobject/temporary-credentials/oidc/{orgId}uses theContainerCredentialsAuthscheme: send a raw JWT/OIDC token as theAuthorizationheader value with noBearerprefix. This shape matches the AWS container-credentials provider for in-cluster workloads.
gRPC schema and SDKs (Buf)
The AI Object Storage API is also exposed as a gRPC service defined in Protobuf. Use the same API host,https://api.coreweave.com, with token-based authentication.
- Service:
CWObject(packagecoreweave.cwobject.v1) - Public BSR module:
buf.build/coreweave/cwobject - TypeScript SDK namespace:
@buf/coreweave_cwobject.bufbuild_es
Access-key status values
Thestatus field on access keys uses the proto-3 enum AccessKeyStatus. The wire format is the symbolic name:
| Value | Meaning |
|---|---|
ACCESS_KEY_STATUS_ACTIVE | The key can be used to authenticate. |
ACCESS_KEY_STATUS_SUSPENDED | The key exists but cannot authenticate; reactivate it to restore access. |
ACCESS_KEY_STATUS_UNSPECIFIED | Proto zero value (field not set). Do not send it — the server treats it as missing and rejects the request. The ListAccessKeyInfo filter treats it as “no filter applied”. |
Access policies
Access policies use a small grammar that maps cleanly to the AWS IAM shape. Policies are documented in IAM Access Policies; the canonical list of actions (cwobject:*, s3:*) lives in the the CoreWeave AI Object Storage actions reference.
Two fields on the policy schema are open strings on the wire today (upstream emits them as type: string with no enum: list):
| Field | Valid values |
|---|---|
CWObjectPolicyStatement.effect | Allow, Deny |
CWObjectPolicy.version | v1alpha1 |
enum constraint, because upstream would have to renegotiate that constraint every time it adds a new effect or policy version. See the storage overlay report for the upstream recommendation.
Pagination
Thelimit parameter on ListAccessKeyInfo and ListBucketInfo accepts values from 1 to 1000 (declared in the proto, reasserted in the overlay because protoc-gen-openapi strips the bound). Use offset for zero-based pagination.