Get Upload Credentials

Issues temporary credentials for uploading the manifest and customer documents to the batch's private storage prefix (S3-compatible). The credentials work only inside this prefix and are valid for about 12 hours. When they expire, call this method again.

Credentials are issued only while the batch is OPEN or CHANGE_REQUESTED. After a commit, reopen the batch with Request Batch Changes to get new ones.

Endpoint

GET /v2/compliance/batch/{batch_id}/credentials

Link

https://partner.sandbox.delos.financial/openapi/v2.html#/operations/BatchService_GetUploadCredentials

Request

Path Parameters

Parameter	Type	Description	Required	Example
batch_id	string	Batch ID returned by Create Batch.	Yes	"01a0af8b-831f-7dbe-8eaf-459f81998958"

Query Parameters

Parameter	Type	Description	Required	Example
format	string	Omit (or send an empty value) for the standard response. credential_process returns the AWS credential_processdocument instead. Any other value returns 400.	No	"credential_process"

Headers

Key	Value	Required
Authorization	<JWT>	Yes
Accept	application/json	Yes

Response (200 OK)

Returns an UploadCredentialsResponse.

Response Fields

Field	Type	Description	Example
bucket	string	Storage bucket name.	"compliance-batch"
prefix	string	Your batch prefix. Upload all files under it.	"9b3f1e7a-2c44-4d8e-a1b6-7f0c9d2e5a10"
region	string	Storage region.	"eu-central-1"
credentials	object	Temporary credentials.	—
credentials.access_key_id	string	Access key ID.	"ASIA5EXAMPLE7QK4WZ3T"
credentials.secret_access_key	string	Secret access key.	"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
credentials.session_token	string	Session token. Must be sent together with the keys.	"IQoJb3JpZ2luX2VjEJ3..."
credentials.expiration	string (date-time)	When the credentials expire.	"2026-09-28T22:15:30Z"

Example Response:

{
  "bucket": "compliance-batch",
  "prefix": "9b3f1e7a-2c44-4d8e-a1b6-7f0c9d2e5a10",
  "region": "eu-central-1",
  "credentials": {
    "access_key_id": "ASIA5EXAMPLE7QK4WZ3T",
    "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "session_token": "IQoJb3JpZ2luX2VjEJ3...",
    "expiration": "2026-09-28T22:15:30Z"
  }
}

Response with format=credential_process

The body is not the schema above. It is the flat, PascalCase document that the AWS CLI and SDKs expect from a credential_process:

{
  "Version": 1,
  "AccessKeyId": "ASIA5EXAMPLE7QK4WZ3T",
  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "SessionToken": "IQoJb3JpZ2luX2VjEJ3...",
  "Expiration": "2026-09-28T22:15:30Z"
}

Client generators built from the OpenAPI file will not know this shape: OpenAPI 2.0 cannot describe two response schemas for one status code. Handle it manually, or let the AWS CLI/SDK consume it directly.

---

Examples

Request

curl --request GET \
  --url <https://partner.sandbox.delos.financial/v2/compliance/batch/01a0af8b-831f-7dbe-8eaf-459f81998958/credentials> \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer <JWT>'

Upload with the AWS CLI

export AWS_ACCESS_KEY_ID=<access_key_id>
export AWS_SECRET_ACCESS_KEY=<secret_access_key>
export AWS_SESSION_TOKEN=<session_token>

aws s3 cp ./documents s3://<bucket>/<prefix>/ --recursive --region <region>
aws s3 cp ./manifest.json s3://<bucket>/<prefix>/manifest.json --region <region>

Automatic refresh with credential_process

# ~/.aws/config
[profile delos-batch]
region = <region>
credential_process = sh -c 'curl -s -H "Authorization: Bearer $DELOS_TOKEN" "<https://partner.sandbox.delos.financial/v2/compliance/batch/><batch_id>/credentials?format=credential_process"'

aws s3 cp ./documents s3://<bucket>/<prefix>/ --recursive --profile delos-batch

---

Error Responses

Errors are returned as {"code", "message", "details"}, where code is a gRPC status code. Use the HTTP status for error handling.

Invalid Format (400) — format has a value other than empty or credential_process:

{ "code": 3, "message": "unsupported format", "details": [] }

Batch Not Editable (409) — the batch is CLOSED or CANCELLED:

{ "code": 10, "message": "credentials are available only for an editable batch", "details": [] }

Rewrite Failed (500) — credential_process only: the credentials could not be converted to the AWS format:

{ "code": 13, "message": "credentials could not be converted", "details": [] }

Incomplete Credentials (502) — credential_process only: the storage service returned incomplete credentials. Retry:

{ "code": 14, "message": "incomplete credentials", "details": [] }

Batch Not Found (404) — the batch does not exist or belongs to another partner:

{ "code": 5, "message": "batch not found", "details": [] }

Authorization fail (401):

{ "code": 16, "message": "Unauthorized", "details": [] }

---

Notes

• Scope: credentials are limited to your batch prefix. Requests outside it are denied by storage.
• Folder structure: any structure inside the prefix is fine. File paths in the manifest are relative to the prefix and must match exactly.
• manifest.json location: the manifest must be at the prefix root.
• Files: PDF, JPEG or PNG (content is checked, not the extension), up to 50 MB each. Corrupted, password-protected or truncated files are rejected.
• report.json: after the commit, a per-row report appears in the prefix. You can download it with credentials issued before the commit, while they are still valid.
• Keep secrets safe: never log or share the secret key and session token.