[{"data":1,"prerenderedAt":445},["ShallowReactive",2],{"docs:\u002Fdocs":3,"docs:nav":401},{"id":4,"title":5,"badge":6,"body":7,"description":392,"extension":393,"meta":394,"navigation":395,"order":77,"path":396,"section":397,"seo":398,"stem":399,"__hash__":400},"docs\u002Fdocs\u002Findex.md","Overview",null,{"type":8,"value":9,"toc":382},"minimark",[10,19,31,44,49,59,62,66,93,96,100,125,129,299,302,306,309,348,352,378],[11,12,13,14,18],"p",{},"Tessera stores objects as ",[15,16,17],"strong",{},"15 encrypted shards distributed across 15 independent storage\nproviders",". Any 10 shards reconstruct the original. Your client does the encryption and the\nerasure coding; the API coordinates placement, holds the record of where things are, funds the\nstorage contracts, and repairs shards when providers fail.",[11,20,21,22,25,26,30],{},"The consequence for you as an integrator is unusual and worth understanding before you start:\n",[15,23,24],{},"Tessera is not in the data path."," Object bytes never transit our servers. You call our API to\nfind out ",[27,28,29],"em",{},"where"," to write, you write directly to providers, and then you tell us what you did.",[32,33,36],"app-callout",{"title":34,"tone":35},"What this means in practice","info",[11,37,38,39,43],{},"You are writing a storage client, not calling a storage endpoint. There is no\n",[40,41,42],"code",{},"PUT \u002Fobjects\u002Fmy-file.txt"," that accepts a body. If you want one, you build it — the primitives\nbelow are what you build it from, and they are deliberately small.",[45,46,48],"h2",{"id":47},"the-shape-of-an-upload","The shape of an upload",[50,51,56],"pre",{"className":52,"code":54,"language":55},[53],"language-text","1. POST \u002Fprepare-write   → 15 providers, with an access token and contract for each\n2. (your client)           encrypt → Reed–Solomon split into 15 shards\n3. (your client)           write each shard directly to its provider\n4. POST \u002Fslabs           → register the shards as a slab, get a slab ID back\n5. POST \u002Fobjects         → register the object as an ordered list of slabs\n","text",[40,57,54],{"__ignoreMap":58},"",[11,60,61],{},"A download is the same in reverse: read the object, read its slabs, fetch any 10 shards per slab\ndirectly from providers, reconstruct, decrypt.",[45,63,65],{"id":64},"base-url-and-versioning","Base URL and versioning",[50,67,71],{"className":68,"code":69,"language":70,"meta":58,"style":58},"language-bash shiki shiki-themes github-dark-default github-dark-default","export TESSERA_API=\"https:\u002F\u002Fapi.PLACEHOLDER_DOMAIN.example\"\n","bash",[40,72,73],{"__ignoreMap":58},[74,75,78,82,86,89],"span",{"class":76,"line":77},"line",1,[74,79,81],{"class":80},"srH4v","export",[74,83,85],{"class":84},"sb7RM"," TESSERA_API",[74,87,88],{"class":80},"=",[74,90,92],{"class":91},"skZ57","\"https:\u002F\u002Fapi.PLACEHOLDER_DOMAIN.example\"\n",[11,94,95],{},"Endpoints are unversioned in the path today. Breaking changes will be introduced as new paths, not\nas silent changes to existing ones.",[45,97,99],{"id":98},"authentication-in-one-paragraph","Authentication in one paragraph",[11,101,102,103,106,107,110,111,114,115,118,119,124],{},"Every authenticated request carries three ",[15,104,105],{},"query parameters",": ",[40,108,109],{},"credential"," (your ed25519 public\nkey), ",[40,112,113],{},"validUntil"," (a unix expiry you choose), and ",[40,116,117],{},"signature"," (an ed25519 signature over a\nblake2b hash of the method, host, path, expiry, and body). There are no sessions, no bearer\ntokens, and no cookies. See ",[120,121,123],"a",{"href":122},"\u002Fdocs\u002Fauthentication","Authentication"," for the exact construction and\nworking code — you will need it before anything else works.",[45,126,128],{"id":127},"the-endpoints","The endpoints",[130,131,132,145],"table",{},[133,134,135],"thead",{},[136,137,138,142],"tr",{},[139,140,141],"th",{},"Endpoint",[139,143,144],{},"Purpose",[146,147,148,159,169,179,189,199,209,219,229,239,249,259,269,279,289],"tbody",{},[136,149,150,156],{},[151,152,153],"td",{},[40,154,155],{},"POST \u002Fauth\u002Fprovision",[151,157,158],{},"Create a credential. The only unauthenticated endpoint.",[136,160,161,166],{},[151,162,163],{},[40,164,165],{},"GET \u002Fauth\u002Fcheck",[151,167,168],{},"Verify a credential is valid and active.",[136,170,171,176],{},[151,172,173],{},[40,174,175],{},"DELETE \u002Fauth\u002Frevoke",[151,177,178],{},"Revoke a credential immediately.",[136,180,181,186],{},[151,182,183],{},[40,184,185],{},"POST \u002Fprepare-write",[151,187,188],{},"Get providers, contracts, and access tokens for a write.",[136,190,191,196],{},[151,192,193],{},[40,194,195],{},"GET \u002Fhosts",[151,197,198],{},"List providers currently good for upload.",[136,200,201,206],{},[151,202,203],{},[40,204,205],{},"POST \u002Fslabs",[151,207,208],{},"Register erasure-coded shards as a slab.",[136,210,211,216],{},[151,212,213],{},[40,214,215],{},"GET \u002Fslabs",[151,217,218],{},"List your slab IDs.",[136,220,221,226],{},[151,222,223],{},[40,224,225],{},"GET \u002Fslabs\u002F{id}",[151,227,228],{},"Read a slab: shard roots, providers, EC parameters.",[136,230,231,236],{},[151,232,233],{},[40,234,235],{},"DELETE \u002Fslabs\u002F{id}",[151,237,238],{},"Unpin a slab.",[136,240,241,246],{},[151,242,243],{},[40,244,245],{},"POST \u002Fslabs\u002Fprune",[151,247,248],{},"Reclaim slabs no object references.",[136,250,251,256],{},[151,252,253],{},[40,254,255],{},"POST \u002Fobjects",[151,257,258],{},"Register an object as an ordered list of slab segments.",[136,260,261,266],{},[151,262,263],{},[40,264,265],{},"GET \u002Fobjects",[151,267,268],{},"List object change events since a timestamp.",[136,270,271,276],{},[151,272,273],{},[40,274,275],{},"GET \u002Fobjects\u002F{key}",[151,277,278],{},"Read an object's placement record.",[136,280,281,286],{},[151,282,283],{},[40,284,285],{},"DELETE \u002Fobjects\u002F{key}",[151,287,288],{},"Delete an object.",[136,290,291,296],{},[151,292,293],{},[40,294,295],{},"GET \u002Faccount",[151,297,298],{},"Storage and transfer counters.",[11,300,301],{},"Administrative and internal operator endpoints exist but are not part of the customer API surface,\nare not documented here, and are not reachable with a customer credential.",[45,303,305],{"id":304},"what-is-not-here","What is not here",[11,307,308],{},"Being direct about the gaps is more useful than making you find them:",[310,311,312,319,330,336,342],"ul",{},[313,314,315,318],"li",{},[15,316,317],{},"No S3 compatibility."," No bucket API, no presigned URLs, no multipart upload protocol.",[313,320,321,324,325,329],{},[15,322,323],{},"No filenames or directories."," The object model has no such fields. Names live in an encrypted\nmetadata blob that only your keys can interpret — see ",[120,326,328],{"href":327},"\u002Fdocs\u002Fconcepts","Concepts",".",[313,331,332,335],{},[15,333,334],{},"No server-side encryption."," Encryption happens in your client, by design.",[313,337,338,341],{},[15,339,340],{},"No resumable upload protocol."," Resumption is per-shard and is your client's concern; a failed\nshard write is retried against a different provider.",[313,343,344,347],{},[15,345,346],{},"No browser-only integration."," The API sets no CORS headers, so a browser cannot call it\ncross-origin. Call it from a server or a native client, or proxy it through your own backend.",[45,349,351],{"id":350},"where-to-go-next","Where to go next",[310,353,354,361,366,371],{},[313,355,356,360],{},[120,357,359],{"href":358},"\u002Fdocs\u002Fquickstart","Quickstart"," — a working upload and download, end to end.",[313,362,363,365],{},[120,364,328],{"href":327}," — slabs, sectors, objects, and why the data model looks like this.",[313,367,368,370],{},[120,369,123],{"href":122}," — the signing scheme, with code you can copy.",[313,372,373,377],{},[120,374,376],{"href":375},"\u002Fdocs\u002Frecovery","Recovery without Tessera"," — retrieving your data if we are not here.",[379,380,381],"style",{},"html pre.shiki code .srH4v, html code.shiki .srH4v{--shiki-default:#FF7B72;--shiki-dark:#FF7B72}html pre.shiki code .sb7RM, html code.shiki .sb7RM{--shiki-default:#E6EDF3;--shiki-dark:#E6EDF3}html pre.shiki code .skZ57, html code.shiki .skZ57{--shiki-default:#A5D6FF;--shiki-dark:#A5D6FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":58,"searchDepth":383,"depth":383,"links":384},3,[385,387,388,389,390,391],{"id":47,"depth":386,"text":48},2,{"id":64,"depth":386,"text":65},{"id":98,"depth":386,"text":99},{"id":127,"depth":386,"text":128},{"id":304,"depth":386,"text":305},{"id":350,"depth":386,"text":351},"Tessera is an HTTP API for storing encrypted, erasure-coded objects across independent storage providers. This is the reference for it.","md",{},true,"\u002Fdocs","Introduction",{"title":5,"description":392},"docs\u002Findex","UmPiOD4xRC55zehvGl0Nz2ib1ZbPv8HbI-QT0UECSyM",[402,408,413,417,421,425,428,431,436,437,441,443],{"path":403,"title":404,"description":405,"section":406,"order":407,"badge":6},"\u002Fdocs\u002Fapi\u002Faccount","Account","GET \u002Faccount — stored, read, and written byte counters for your credential.","API reference",5,{"path":409,"title":410,"description":411,"section":406,"order":412,"badge":6},"\u002Fdocs\u002Fapi\u002Fobjects","Objects","Register, read, list, and delete objects — ordered lists of slab segments with encrypted keys and opaque metadata.",4,{"path":414,"title":415,"description":416,"section":406,"order":386,"badge":6},"\u002Fdocs\u002Fapi\u002Fplacement","Placement","POST \u002Fprepare-write — get the providers, contracts, and access tokens for writing a slab's shards.",{"path":418,"title":419,"description":420,"section":406,"order":77,"badge":6},"\u002Fdocs\u002Fapi\u002Fprovisioning","Credentials","Provision, verify, and revoke the ed25519 credential that is both your API identity and your account.",{"path":422,"title":423,"description":424,"section":406,"order":383,"badge":6},"\u002Fdocs\u002Fapi\u002Fslabs","Slabs","Register, read, list, unpin, and prune erasure-coded slabs — the layer that records which provider holds which shard.",{"path":122,"title":123,"description":426,"section":427,"order":386,"badge":6},"Every request is signed with ed25519 over a blake2b hash of the method, host, path, expiry, and body. Here is the exact construction, with working code.","Guides",{"path":327,"title":429,"description":430,"section":397,"order":386,"badge":6},"Concepts & data model","Sectors, shards, slabs, objects, and accounts — what each one is, why the model has no filenames, and what that means for your integration.",{"path":432,"title":433,"description":434,"section":435,"order":77,"badge":6},"\u002Fdocs\u002Ferrors","Errors","Status codes, the two different error body formats, and the one case where a failure arrives with a 200.","Reference",{"path":396,"title":5,"description":392,"section":397,"order":77,"badge":6},{"path":438,"title":439,"description":440,"section":435,"order":386,"badge":6},"\u002Fdocs\u002Flimits","Limits & quotas","Rate limits, storage caps, geometry constraints, and the size and encoding limits that apply to every request.",{"path":358,"title":359,"description":442,"section":427,"order":77,"badge":6},"Provision a credential, upload an object across 15 providers, and read it back. Fifteen minutes, one file of code.",{"path":375,"title":376,"description":444,"section":427,"order":383,"badge":6},"How to retrieve your data if Tessera is unavailable, unwilling, or permanently gone — and what you need to keep on hand for that to work.",1786190911453]