# Objects

Storage object operations: list, download, retrieve metadata, delete, and public access.

**Scope:** `vibe:storage` | **Base URL:** `https://vibecode.bitrix24.com/v1` | **Authorization:** API key (`X-Api-Key`); public endpoints work without authorization

## Operations

- [List objects](./objects/list.md) — `GET /v1/storage/objects`
- [Download object](./objects/get.md) — `GET /v1/storage/objects/:key`
- [Object metadata](./objects/head.md) — `HEAD /v1/storage/objects/:key`
- [Delete object](./objects/delete.md) — `DELETE /v1/storage/objects/:key`
- [Public download](./objects/public-get.md) — `GET /v1/public-storage/:portalId/:objectId`
- [Public metadata](./objects/public-head.md) — `HEAD /v1/public-storage/:portalId/:objectId`

## Scenarios

**Getting a download link.** `GET /v1/storage/objects/:key` returns HTTP 302 with a `Location` header. Browsers follow the redirect automatically. In server-side code use `redirect: 'manual'` and read `response.headers.get('location')`. The link is valid for 10 minutes.

**Listing by prefix.** The `prefix` parameter filters objects by the start of the key. For example, `prefix=users/42` returns all objects with keys starting with `users/42`. To page through results, use the `cursor` from the previous response.

**Key in the URL.** The `/` characters in the key must be encoded: `encodeURIComponent('users/42/report.csv')` returns `'users%2F42%2Freport.csv'`. Without encoding, the request will route to a different path.

**Public access.** An object with `visibility=PUBLIC` is available via a permanent URL without authorization. The URL is built from `portalId` (the Bitrix24 portal identifier, not `appId`) and `objectId` — this is the object's `id` field from create or list responses, not the logical key.

## See also

- [Storage](/docs/storage)
- [Upload](/docs/storage/upload)
- [Keys and authorization](/docs/keys-auth)