> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataraven.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Storage Backends

> Add and configure cloud storage locations as sources and destinations for transfer tasks.

Locations define cloud storage endpoints — buckets and containers — used as sources or destinations
in transfer tasks. Each location references a [Secret](/secrets) for credentials, and
connects to a specific bucket in a specific region.

<Note>
  RClone configuration options (transfers, chunk sizes, etc.) are set at the **Task** level, not on
  locations. Locations define *where* to connect — tasks define *how*.
</Note>

## Supported Providers

<CardGroup cols={3}>
  <Card title="AWS S3" icon="aws">
    Amazon Simple Storage Service
  </Card>

  <Card title="Azure Blob Storage" icon="microsoft">
    Azure Blob containers
  </Card>

  <Card title="Google Cloud Storage" icon="google">
    GCS buckets
  </Card>

  <Card title="Cloudflare R2" icon="cloud">
    S3-compatible object storage
  </Card>

  <Card title="Backblaze B2" icon="cloud">
    Cloud storage with generous free tier
  </Card>

  <Card title="Wasabi" icon="cloud">
    Hot cloud storage, S3-compatible
  </Card>

  <Card title="Railway" icon="train">
    Railway-provided S3 buckets
  </Card>

  <Card title="Oracle Object Storage" icon="database">
    Oracle S3-compatible endpoint
  </Card>

  <Card title="Tigris" icon="cloud">
    Globally distributed S3-compatible storage
  </Card>

  <Card title="DigitalOcean Spaces" icon="cloud">
    DigitalOcean Spaces Object Storage
  </Card>

  <Card title="Hetzner" icon="cloud">
    Hetzner Object Storage
  </Card>

  <Card title="Rabata" icon="cloud">
    Rabata Object Storage
  </Card>

  <Card title="S3 Compatible" icon="plug">
    Any S3-compatible provider
  </Card>
</CardGroup>

## Creating a Location

<Steps>
  <Step title="Create a secret first">
    Every location needs credentials. If you haven't already, [create a secret](/secrets) for your cloud provider. The secret's `secret_type` must match the location's `location_type`.
  </Step>

  <Step title="Navigate to Locations">
    Go to **Locations** in your team dashboard and click **Add Location**.
  </Step>

  <Step title="Configure the location">
    Fill in the required fields:

    | Field              | Description                                            | Required           |
    | ------------------ | ------------------------------------------------------ | ------------------ |
    | **name**           | Descriptive unique name (e.g., "Production S3 Bucket") | Yes                |
    | **description**    | Optional notes about this location                     | No                 |
    | **location\_type** | Cloud provider — must match the secret's `secret_type` | Yes                |
    | **secret\_id**     | Reference to the credentials secret                    | Yes                |
    | **bucket\_name**   | Bucket or container name                               | Yes                |
    | **region**         | Provider region (e.g., `us-east-1`, `westus2`)         | Varies             |
    | **endpoint\_url**  | Custom endpoint URL                                    | S3-compatible only |

    See [Provider-Specific Configuration](#provider-specific-configuration) for which fields each provider requires.
  </Step>

  <Step title="Verify the connection">
    After creation, DataRaven auto-redirects to the detail page and runs a [connection verification](#connection-verification) automatically.
  </Step>
</Steps>

## Connection Verification

DataRaven verifies that a location is reachable and properly configured by testing the actual
connection.

Verification checks:

* **bucket\_exists** — confirms the bucket/container is accessible
* **permissions** — tests list, read, write, and delete operations

### Verification Status

| Status           | Meaning                                         |
| ---------------- | ----------------------------------------------- |
| **Verified**     | Successfully tested within the last 24 hours    |
| **Stale**        | Last successful test was more than 24 hours ago |
| **Never tested** | Verification has not been run                   |

<Tip>
  Verification runs automatically after creation. Re-run it anytime from the location detail page or
  via the API to confirm connectivity — especially after rotating credentials or changing bucket
  settings.
</Tip>

<Note>
  For locations using [external vault (BYOV)](/vault-integration) credentials, verification
  resolves the vault references to test the connection. If resolution fails, you'll receive specific
  error codes: `VAULT_FIELD_NOT_FOUND`, `VAULT_ITEM_NOT_FOUND`, `VAULT_ACCESS_DENIED`, etc.
</Note>

## Provider-Specific Configuration

<Tabs>
  <Tab title="AWS S3">
    | Field             | Value                                     |
    | ----------------- | ----------------------------------------- |
    | **region**        | Required — e.g., `us-east-1`, `eu-west-1` |
    | **endpoint\_url** | Not needed                                |

    Standard S3 configuration. Region must match where your bucket was created.
  </Tab>

  <Tab title="Azure Blob">
    | Field             | Value                                               |
    | ----------------- | --------------------------------------------------- |
    | **region**        | Required — Azure region (e.g., `eastus`, `westus2`) |
    | **endpoint\_url** | Not needed                                          |

    Use the Azure region where your storage account is deployed.
  </Tab>

  <Tab title="GCS">
    | Field             | Value      |
    | ----------------- | ---------- |
    | **region**        | Optional   |
    | **endpoint\_url** | Not needed |

    GCS handles routing automatically. Region is optional but can be specified for documentation purposes.
  </Tab>

  <Tab title="Cloudflare R2">
    | Field             | Value                                                      |
    | ----------------- | ---------------------------------------------------------- |
    | **region**        | Not needed                                                 |
    | **endpoint\_url** | Required — `https://<account_id>.r2.cloudflarestorage.com` |

    Replace `<account_id>` with your Cloudflare account ID, found in the R2 dashboard.
  </Tab>

  <Tab title="Backblaze B2">
    | Field             | Value      |
    | ----------------- | ---------- |
    | **region**        | Optional   |
    | **endpoint\_url** | Not needed |

    B2 locations automatically receive optimized defaults: `transfers: 32`, `fast_list: true`, `b2_hard_delete: false`. These are applied at the task level.
  </Tab>

  <Tab title="Wasabi">
    | Field             | Value                                          |
    | ----------------- | ---------------------------------------------- |
    | **region**        | Required — e.g., `us-east-1`, `eu-central-1`   |
    | **endpoint\_url** | Required — `https://s3.<region>.wasabisys.com` |

    Both region and endpoint URL are required. The endpoint URL must include the region.
  </Tab>

  <Tab title="Railway">
    | Field             | Value                                   |
    | ----------------- | --------------------------------------- |
    | **region**        | Depends on Railway config               |
    | **endpoint\_url** | Required — Railway-provided S3 endpoint |

    Use the S3-compatible endpoint URL provided by Railway for your bucket.
  </Tab>

  <Tab title="Oracle">
    | Field             | Value                                    |
    | ----------------- | ---------------------------------------- |
    | **region**        | Required                                 |
    | **endpoint\_url** | Required — Oracle S3-compatible endpoint |

    Oracle Object Storage uses an S3-compatible API. Both region and endpoint URL are required.
  </Tab>

  <Tab title="Tigris">
    | Field             | Value                                       |
    | ----------------- | ------------------------------------------- |
    | **region**        | Not needed                                  |
    | **endpoint\_url** | Required — `https://fly.storage.tigris.dev` |

    Tigris is a globally distributed, S3-compatible object storage service. The standard endpoint is `https://fly.storage.tigris.dev`.
  </Tab>

  <Tab title="DigitalOcean Spaces">
    | Field             | Value                                    |
    | ----------------- | ---------------------------------------- |
    | **region**        | Not needed (embedded in endpoint)        |
    | **endpoint\_url** | Required — `nyc3.digitaloceanspaces.com` |

    DigitalOcean Spaces is S3-compatible object storage. The endpoint URL includes the region (e.g., `nyc3.digitaloceanspaces.com`, `sfo3.digitaloceanspaces.com`).
  </Tab>

  <Tab title="Hetzner">
    | Field             | Value                                    |
    | ----------------- | ---------------------------------------- |
    | **region**        | Not needed (embedded in endpoint)        |
    | **endpoint\_url** | Required — `hel1.your-objectstorage.com` |

    Hetzner Object Storage is S3-compatible. The endpoint URL includes the region (e.g., `hel1.your-objectstorage.com`, `nbg1.your-objectstorage.com`, `fsn1.your-objectstorage.com`).
  </Tab>

  <Tab title="Rabata">
    | Field             | Value                              |
    | ----------------- | ---------------------------------- |
    | **region**        | Required — e.g., `us-east-1`       |
    | **endpoint\_url** | Required — `s3.<region>.rabata.io` |

    Rabata Object Storage is S3-compatible. Both region and endpoint URL are required. The endpoint includes the region (e.g., `s3.us-east-1.rabata.io`).
  </Tab>

  <Tab title="S3 Compatible">
    | Field             | Value               |
    | ----------------- | ------------------- |
    | **region**        | Depends on provider |
    | **endpoint\_url** | Required            |

    For any S3-compatible provider not listed above. Endpoint URL is always required; region requirements vary by provider.
  </Tab>
</Tabs>

## Provider Defaults

DataRaven applies sensible default rclone configuration per provider at the task level. Query
defaults via the API:

<CodeGroup>
  ```json Backblaze B2 theme={"theme":{"light":"github-light","dark":"poimandres"}}
  {
    "transfers": 32,
    "b2_hard_delete": false,
    "fast_list": true
  }
  ```

  ```json S3-Compatible Providers theme={"theme":{"light":"github-light","dark":"poimandres"}}
  {
    "s3_no_check_bucket": true
  }
  ```
</CodeGroup>

<Tip>
  Provider defaults are starting points. You can override any of these settings in the task's rclone
  configuration.
</Tip>

## Updating Locations

You can update the following fields on an existing location:

* `name`, `description`
* `bucket_name`, `region`, `endpoint_url`
* `secret_id` (new secret must have the same `secret_type` as the location's `location_type`)

<Warning>
  **`location_type` is immutable.** You cannot change a location's provider after creation. Create a
  new location instead.
</Warning>

<Warning>
  Changing `bucket_name`, `region`, `endpoint_url`, or `secret_id` affects **all tasks** currently
  using this location. Verify the connection after making changes.
</Warning>

## Deletion

A location **cannot be deleted** while it is referenced by any tasks. Attempting to delete returns a
`409 Conflict` error.

To delete a location:

1. Navigate to the location detail page to see linked tasks
2. Delete or reassign all tasks using this location
3. Delete the location

## Linked Tasks

The location detail page shows all tasks using this location — grouped by whether it's the
**source** or **destination**. Click any task to navigate directly to its configuration.

## Tier Limits

| Plan     | Locations |
| -------- | --------- |
| **Free** | 4         |
| **Pro**  | 100       |

Need more? [Upgrade your plan](https://app.dataraven.io/#/subscription) from the billing page.

## Required Roles

| Action                   | Minimum Role |
| ------------------------ | ------------ |
| View locations           | VIEWER       |
| Create / Update / Delete | ADMIN        |
| Verify connection        | OPERATOR     |

<Tip>
  The OPERATOR role can run verification without full admin access — useful for on-call engineers
  troubleshooting connectivity issues.
</Tip>