Reference

Field-level detail, seven pages. The Guides show a task front to back; these pages are what you open when you already know the task and need the exact value.

Page	Answers
The S3 surface	Which S3 operations ship, how they authenticate, what is not implemented, and what every object read carries back.
Headers, status codes, 401 and 429	The x-amz-meta-permafrost-* headers, and every status this instance returns — including why one 401 covers every credential failure.
Limits: rate, quota, parts, timeouts	What bounds a request: the per-tenant rate ceiling, the custody size check, the multipart part rule, the route timeout.
Tenancy	A tenant is a Sui address. What that isolates, and the one thing that is visible across tenants.
Encryption at rest	On by default for single objects, the per-object opt-out, why a read can refuse, and the two cases it does not cover.
On-chain objects	The package ids, the receipt and certificate fields, and how to open one in an explorer.
HTTP API	The routes beside the S3 surface — certification status, custody, verify, your keys — generated from the API specification.

Where to start

• Writing against the storage endpoint for the first time → The S3 surface, then Headers, status codes, 401 and 429.
• Debugging a refusal → Headers, status codes, 401 and 429. Almost every surprise on this instance is a 401, a 404 that is really “not yours”, or a 429.
• Deciding whether the isolation is enough → Tenancy and Encryption at rest, in that order. The second one depends on the first.
• Verifying something on chain → On-chain objects.

Each page carries a badge. Proven means somebody ran that path on the hosted instance and the run is named; unexercised means the code is deployed and nobody has driven it there yet. One page on this group is amber, and it says why.