Glossary

​

Bucket

The top-level storage container. A bucket is bound to a location (datacenterId), has a retention policy, and owns folders and files. The published API can list the buckets a key can reach and read a bucket’s stored size; creation, deletion, and configuration are dashboard operations.

​

Datacenter

The internal identifier for the storage location a bucket is bound to. Treat it as opaque; do not parse it to infer a region.

​

Folder

A container inside a bucket. Folders form a tree with a maximum depth of 8. parentId: null denotes a root-level folder.

​

File

A stored object. Identified by fileId. The display name excludes the extension; extFile holds the lowercased extension.

​

Version

A stored revision of a file. Uploads that match an existing file can create a new version. Versions can be listed, downloaded, restored, and deleted, subject to plan limits.

​

Version ID

The storage-level identifier for a specific version. Persist it alongside fileId if you need to reference an exact revision.

​

Soft delete

Moving a file or folder to trash. Bytes are retained for the trash window and remain billable. The object can be restored during that window.

​

Hard delete

Permanent removal of the object. It cannot be restored.

​

Restore

Returning a soft-deleted object from trash, or promoting an older version to become current.

​

Retention

A policy that controls how long objects and versions are kept. Bucket retention values exclude the shortest windows; file retention can be set per file within the bucket’s policy.

​

Scope

A named capability attached to an API key, such as files:read or folders:write. Scopes are additive, and storage operations typically require a buckets:* scope plus a resource scope.

​

Bucket restriction

An optional limit that constrains a key to specific bucket IDs. It is enforced before the operation and before trial accounting. A key outside its allowed buckets receives 403 API_BUCKET_SCOPE_DENIED.

​

API key

A pk_ / sk_ pair used to authenticate the REST API. The secret is stored as a hash and shown only at creation or rotation.

​

Company workspace

The account boundary for the REST API. Keys authenticate as a company, and can only reach that company’s resources.

​

EverSpark

An individual (non-company) account type. Individual accounts cannot use the REST storage API and receive 403 API_COMPANY_ONLY.

​

SSE

Server-side encryption. Files are encrypted by the platform before storage, and stored objects receive a second, independent encryption-at-rest layer from the storage infrastructure. It is not end-to-end encryption: decryption happens within authorized operations.

​

HPKE

Hybrid Public Key Encryption. Everabyte combines X25519 and ML-KEM-768 to encapsulate per-file keys.

​

Envelope

The stored structure containing the encapsulated per-file key. Envelopes are immutable per version.

​

Recovery phrase

A BIP39 mnemonic that wraps a user’s private key in the browser. It never reaches the backend: the platform stores only the wrapped key material, a salt, and a fingerprint. It restores the key chain through the platform’s recovery flow; a standard email password reset does not require it.

​

Datacenter ID versus region

datacenterId is what the API returns. “Region” is a human concept that maps to it. Do not send human region names to the API.

​

Response envelope

The consistent JSON wrapper around responses. Success uses {status, message, data}; errors vary by layer. See Conventions.

​

Trial

A time-limited account state with reduced limits: maximum file size, one API key, restricted features. Trial API calls are metered separately.

​

Partial run

A backup run that completed with some files skipped, for example because they were locked by another process. It is reported as partial, never as a silent success.

​

Object lock

A storage-level protection that prevents deletion or modification of a retained object until its retention period ends. It protects against logical deletion, not against losing a region. It requires a bucket with Object Lock enabled and a storage location that supports it; where native support is absent, the platform’s applicative WORM enforcement is the only protection.

​

CDN delivery

Optional delivery on enterprise plans, where the CDN edge serves files over signed URLs with configurable validity (5 minutes to 30 days, 6 hours by default). Edge caches hold decrypted objects for up to 30 days. It improves latency and means decrypted content exists at the edge while cached.

​

Related