> For the complete documentation index, see [llms.txt](https://docs.delos.financial/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.delos.financial/batchservice/get-upload-credentials.md). # Get Upload Credentials Issues temporary credentials for uploading the manifest and customer documents to the batch's private storage prefix (S3-compatible). The credentials work only inside this prefix and are valid for about **12 hours**. When they expire, call this method again. Credentials are issued only while the batch is `OPEN` or `CHANGE_REQUESTED`. After a commit, reopen the batch with Request Batch Changes to get new ones. **Endpoint** `GET /v2/compliance/batch/{batch_id}/credentials` **Link** **Request** **Path Parameters** | Parameter | Type | Description | Required | Example | | -------------- | -------- | ---------------------------------- | -------- | ---------------------------------------- | | **`batch_id`** | `string` | Batch ID returned by Create Batch. | Yes | `"01a0af8b-831f-7dbe-8eaf-459f81998958"` | **Query Parameters** | Parameter | Type | Description | Required | Example | | ------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ---------------------- | | **`format`** | `string` | Omit (or send an empty value) for the standard response. `credential_process` returns the AWS `credential_process`document instead. Any other value returns `400`. | No | `"credential_process"` | **Headers** | Key | Value | Required | | --------------- | ------------------ | -------- | | `Authorization` | `` | Yes | | `Accept` | `application/json` | Yes | **Response (200 OK)** Returns an `UploadCredentialsResponse`. **Response Fields** | Field | Type | Description | Example | | ----------------------------------- | -------------------- | --------------------------------------------------- | -------------------------------------------- | | **`bucket`** | `string` | Storage bucket name. | `"compliance-batch"` | | **`prefix`** | `string` | Your batch prefix. Upload all files under it. | `"9b3f1e7a-2c44-4d8e-a1b6-7f0c9d2e5a10"` | | **`region`** | `string` | Storage region. | `"eu-central-1"` | | **`credentials`** | `object` | Temporary credentials. | — | | **`credentials.access_key_id`** | `string` | Access key ID. | `"ASIA5EXAMPLE7QK4WZ3T"` | | **`credentials.secret_access_key`** | `string` | Secret access key. | `"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"` | | **`credentials.session_token`** | `string` | Session token. Must be sent together with the keys. | `"IQoJb3JpZ2luX2VjEJ3..."` | | **`credentials.expiration`** | `string (date-time)` | When the credentials expire. | `"2026-09-28T22:15:30Z"` | **Example Response:** ```json { "bucket": "compliance-batch", "prefix": "9b3f1e7a-2c44-4d8e-a1b6-7f0c9d2e5a10", "region": "eu-central-1", "credentials": { "access_key_id": "ASIA5EXAMPLE7QK4WZ3T", "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "session_token": "IQoJb3JpZ2luX2VjEJ3...", "expiration": "2026-09-28T22:15:30Z" } } ``` **Response with `format=credential_process`** The body is **not** the schema above. It is the flat, PascalCase document that the AWS CLI and SDKs expect from a `credential_process`: ```json { "Version": 1, "AccessKeyId": "ASIA5EXAMPLE7QK4WZ3T", "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "SessionToken": "IQoJb3JpZ2luX2VjEJ3...", "Expiration": "2026-09-28T22:15:30Z" } ``` Client generators built from the OpenAPI file will not know this shape: OpenAPI 2.0 cannot describe two response schemas for one status code. Handle it manually, or let the AWS CLI/SDK consume it directly. *** **Examples** **Request** ```bash curl --request GET \ --url \ --header 'Accept: application/json' \ --header 'Authorization: Bearer ' ``` **Upload with the AWS CLI** ```bash export AWS_ACCESS_KEY_ID= export AWS_SECRET_ACCESS_KEY= export AWS_SESSION_TOKEN= aws s3 cp ./documents s3://// --recursive --region aws s3 cp ./manifest.json s3:////manifest.json --region ``` **Automatic refresh with `credential_process`** ``` # ~/.aws/config [profile delos-batch] region = credential_process = sh -c 'curl -s -H "Authorization: Bearer $DELOS_TOKEN" "/credentials?format=credential_process"' ``` ```bash aws s3 cp ./documents s3://// --recursive --profile delos-batch ``` *** **Error Responses** Errors are returned as `{"code", "message", "details"}`, where `code` is a gRPC status code. Use the HTTP status for error handling. **Invalid Format (400)** — `format` has a value other than empty or `credential_process`: ```json { "code": 3, "message": "unsupported format", "details": [] } ``` **Batch Not Editable (409)** — the batch is `CLOSED` or `CANCELLED`: ```json { "code": 10, "message": "credentials are available only for an editable batch", "details": [] } ``` **Rewrite Failed (500)** — `credential_process` only: the credentials could not be converted to the AWS format: ```json { "code": 13, "message": "credentials could not be converted", "details": [] } ``` **Incomplete Credentials (502)** — `credential_process` only: the storage service returned incomplete credentials. Retry: ```json { "code": 14, "message": "incomplete credentials", "details": [] } ``` **Batch Not Found (404)** — the batch does not exist or belongs to another partner: ```json { "code": 5, "message": "batch not found", "details": [] } ``` **Authorization fail (401)**: ```json { "code": 16, "message": "Unauthorized", "details": [] } ``` *** **Notes** * **Scope**: credentials are limited to your batch prefix. Requests outside it are denied by storage. * **Folder structure**: any structure inside the prefix is fine. File paths in the manifest are relative to the prefix and must match exactly. * **`manifest.json` location**: the manifest must be at the prefix root. * **Files**: PDF, JPEG or PNG (content is checked, not the extension), up to 50 MB each. Corrupted, password-protected or truncated files are rejected. * **`report.json`**: after the commit, a per-row report appears in the prefix. You can download it with credentials issued before the commit, while they are still valid. * **Keep secrets safe**: never log or share the secret key and session token. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.delos.financial/batchservice/get-upload-credentials.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.