---
name: objects-storage
description: Use when uploading, downloading, sharing, or deleting a small public text report or image through Shubham's screened, expiring object API at objects.yshubham.com.
---

# Objects Storage

Use this skill when a task needs a temporary public URL for a small report, benchmark result, screenshot, or image no larger than 10 MB. The service is backed by Cloudflare R2, puts every upload through a Cloudflare Queue screening gate, deletes public objects after seven days, and never exposes bucket listing or origin credentials.

Accepted types are plain text, Markdown, CSV, JSON, NDJSON, PNG, JPEG, WebP, and AVIF. Archives, compressed blobs, executables, HTML, SVG, packages, and model files are rejected.

## Upload

Upload raw bytes; do not send multipart form data and do not put a user-controlled path in the URL.

~~~bash
curl --fail-with-body --data-binary @benchmark.json \
  -H 'content-type: application/json' \
  https://objects.yshubham.com/v1/objects
~~~

The response is 202 Accepted with an id, a future url, statusUrl, bytes, expiresAt, and a one-time deleteToken. The URL is not public until GET statusUrl returns { "status": "ready" }. Preserve the token only when deletion is needed; it is a capability, not an object identifier.

If status becomes quarantined, the file was never public. Keep the delete token only long enough to remove the quarantined item.

## Download

~~~bash
curl --fail --location https://objects.yshubham.com/v1/objects/OBJECT_ID -o benchmark.json
~~~

Objects always download as an attachment with a safe binary response type, even for text and images. Objects may disappear after seven days. Treat 404 as an expected expiry, not a retryable upload failure.

## Delete

~~~bash
curl --fail -X DELETE \
  -H "authorization: Bearer $OBJECT_DELETE_TOKEN" \
  https://objects.yshubham.com/v1/objects/OBJECT_ID
~~~

Never log the delete token, commit it, or include it in a public issue, URL, or generated documentation. If it is lost, wait for expiry.

## Guardrails

- Enforce the 10 MB limit before uploading.
- Set an accurate accepted content type; the service verifies the bytes again in its Queue consumer.
- Use one object per report or image and let the seven-day lifecycle clean it up.
- Do not upload archives, package builds, executable files, model weights, source archives, HTML, SVG, or compressed blobs. Use Git releases or the Forgejo mirror for software distribution.
- Do not use the service for secrets, credentials, personal data, or durable backups.
- If the API returns 429, wait and retry with backoff; do not parallelize retries.
- If the API returns 503 or the screening state never becomes ready, do not bypass the service with an origin bucket URL.