Swift API

In addition to the primary S3 API, Infomaniak Ceph Object Storage supports the OpenStack Swift API for bucket and object operations.

API Compatibility

Swift API operations are handled by Ceph RGW (RadosGW). Both S3 and Swift APIs operate on the same underlying storage system.

When to use Swift API

• You have existing applications or scripts using the OpenStack Swift SDK
• You prefer Keystone token-based authentication over S3 signature-based authentication
• You need container-level operations using Swift semantics

Authentication

Swift API uses Keystone v3 tokens for authentication. See the Authentication page for details on obtaining tokens, user/project IDs, and creating EC2 credentials.

For quick reference:

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)

Endpoints

Region	Swift Endpoint
gva1	https://s3.gva1.infomaniak.cloud/swift/v1/AUTH_<tenant_id>
gva2	https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>

Tenant ID

Your tenant ID is your OpenStack project ID (e.g., f70d2db9834e402e8792703009904c65). You can find it with: openstack project show <project-name> --os-cloud <cloud>

Basic Operations

List Buckets (Containers)

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)
curl -H "X-Auth-Token: $TOKEN" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/

Create a Bucket (Container)

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)
curl -X PUT -H "X-Auth-Token: $TOKEN" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/mybucket

On success, returns HTTP 201 Created.

Delete a Bucket (Container)

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)
curl -X DELETE -H "X-Auth-Token: $TOKEN" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/mybucket

Non-empty buckets

Swift requires buckets to be empty before deletion. Remove all objects first.

Upload an Object

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)
curl -X PUT -T myfile.txt -H "X-Auth-Token: $TOKEN" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/mybucket/myfile.txt

Download an Object

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)
curl -O -H "X-Auth-Token: $TOKEN" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/mybucket/myfile.txt

List Objects in a Bucket

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)
curl -H "X-Auth-Token: $TOKEN" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/mybucket

Delete an Object

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)
curl -X DELETE -H "X-Auth-Token: $TOKEN" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/mybucket/myfile.txt

Container Metadata

Swift supports container metadata via headers:

TOKEN=$(openstack token issue -c id -f value --os-cloud <your-cloud>)
curl -X PUT \
  -H "X-Auth-Token: $TOKEN" \
  -H "X-Container-Meta-Purpose: backups" \
  -H "X-Container-Meta-Project: myproject" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/mybucket

Retrieve metadata with HEAD:

curl -I -H "X-Auth-Token: $TOKEN" \
  https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>/mybucket

Swift-Specific Features

Feature	Description
Containers (Buckets)	Swift terminology for S3 buckets
Objects	Same concept as S3 objects
Metadata	X-Container-Meta-* and X-Object-Meta-* headers
Account	The top-level namespace (tenant project)
TempURL	Not supported on Ceph RGW
Static Website	Use S3 API static website hosting instead

Swift vs S3 API Comparison

Feature	S3 API	Swift API
Authentication	Access Key + Signature	Keystone Token
Bucket Terminology	Bucket	Container
Multipart Upload	Supported	Supported (SLO/DLO)
Versioning	Native	Via versions container
Object Lock	Supported	Not supported
Server-Side Encryption	SSE-C	Not supported
Cross-Region Replication	Supported	Not supported via Swift API

Client Tools

Python (python-swiftclient)

pip install python-swiftclient

from swiftclient import client as swift_client

# Direct Ceph RGW cluster endpoint
tenant_id = '<tenant_id>'
storage_url = f'https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_{tenant_id}'

auth_url = 'https://api.pub1.infomaniak.cloud/identity/v3'
auth_version = '3'
os_options = {
    'object_storage_url': storage_url,  # Direct URL, bypassing catalog discovery
    'project_id': tenant_id,
    'user_domain_name': 'Default',
    'project_domain_name': 'Default'
}

conn = swift_client.Connection(
    authurl=auth_url,
    user='<username>',
    key='<password>',
    auth_version=auth_version,
    os_options=os_options
)

# List containers
resp_headers, containers = conn.get_account()
for container in containers:
    print(container['name'])

Direct URL

Using object_storage_url in os_options bypasses endpoint discovery via the Keystone catalog. This is necessary when the gva2 region is not listed in the catalog for the object-store service.

swift CLI

# Configure
export OS_AUTH_URL=https://api.pub1.infomaniak.cloud/identity/v3
export OS_USERNAME=<your-username>
export OS_PASSWORD=<your-password>
export OS_PROJECT_NAME=<your-project>
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default

# Swift endpoint URL (bypasses Keystone catalog discovery)
export OS_STORAGE_URL=https://s3.gva2.infomaniak.cloud/swift/v1/AUTH_<tenant_id>

# List containers
swift list

# Upload
swift upload mybucket myfile.txt

# Download
swift download mybucket myfile.txt

Keystone Catalog

The swift client uses the Keystone catalog by default to discover the endpoint. If the catalog does not list a gva2 endpoint for object-store, specify OS_STORAGE_URL explicitly.

Limitations

• No TempURL support: Ceph RGW does not implement Swift TempURL authentication
• No account metadata via Swift: Account-level operations use S3 API
• No SwiftFormPost: Direct browser uploads not supported
• Object Lock: Use S3 API to configure Object Lock and retention policies
• Encryption: SSE-C is only available via S3 API
• Lifecycle: Object lifecycle policies must be configured via S3 API
• CORS: CORS configuration must be done via S3 API
• Replication: Multi-site replication configured at the S3 layer

Troubleshooting

AccessDenied on bucket creation

• Verify your token is valid: openstack token issue
• Check the endpoint URL format: /swift/v1/AUTH_<tenant_id>/

NoSuchBucket errors

• Verify you're using the correct tenant ID in the URL
• Ensure the bucket exists: curl -I -H "X-Auth-Token: $TOKEN" <url>/<bucket>
• Check for typos in the endpoint path

Related Documentation

• Quick Start Guide (S3 API)
• Object Storage Features & Limitations
• Access Control and Cross-Tenant Sharing