The API was read-mostly: list buckets, search objects, presigned downloads, trigger jobs. It can now manage the objects themselves, so your scripts and integrations use a BucketPilot key instead of handling raw S3 credentials.

New object endpoints on buckets & objects:

• •Read — object metadata (HEAD), tags, and version history.
• •Write — upload (a presigned PUT, so bytes go straight to your own storage and never through us), delete, copy/move, create folders, set tags, and change storage class.

Anything you upload or delete over the API shows up in search and cost exactly like an action taken in the app — the index stays in sync automatically.

Keys now carry permissions. When you create a key you choose Read-only (list and download, read jobs and usage) or Read/write (also change objects and trigger jobs). Every existing key is read-only, so nothing gained new power on its own — mint a read/write key when you need one. A read-only key that hits a write endpoint gets a clear 403 READ_ONLY_KEY.

Note for existing integrations: triggering a job run, pause, cancel, or a reindex now needs a read/write key (a backup run writes data), so reissue those keys if a script does more than read.