Skip to content
QuantCDN

Attach a resource to an application environment

POST
/api/v3/organizations/{organisation}/resources/{resource}/attachments
curl --request POST \
  --url https://dashboard.quantcdn.io/api/v3/organizations/test-org/resources/res-abc123/attachments \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "application": "test-app", "environment": "production", "envVarPrefix": "MEDIA", "accessLevel": "scoped" }'

Object storage credentials are written immediately and take effect on the environment’s next deploy. Cache variables are rendered at the next deploy, so a cache may be attached while it is still provisioning. An environment accepts one attachment per resource type.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
organisation
required
string

The organisation ID

Example
test-org
resource
required
string

The resource ID

Example
res-abc123

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
application
required
string
Example
test-app
environment
required
string
Example
production
envVarPrefix

Namespaces every injected variable, so MEDIA yields MEDIA_S3_BUCKET

string
Example
MEDIA
accessLevel

Cache only. scoped injects an RBAC user limited to this environment’s CACHE_PREFIX (plain and {hash-tag} forms) with FLUSHALL and FLUSHDB denied. admin injects the cache-wide credential for integrations that require FLUSHDB, such as Laravel Cache::flush() or the WordPress object cache without selective flush; it can read, write and flush every attached environment’s keys.

string
default: scoped
Allowed values: scoped admin

Responses

Section titled “Responses”

200

Section titled “200”

The attachment

Media typeapplication/json
Resource attachment
object
appName
string
envName
string
envVarPrefix

Namespaces every injected variable, so MEDIA yields MEDIA_S3_BUCKET

string
accessKeyId

Object storage only. The secret half is written to the environment’s secrets and never returned.

string
cacheUserId

Cache only. This environment’s own RBAC user, limited to its CACHE_PREFIX with FLUSHALL and FLUSHDB denied, so it cannot touch another environment’s keys.

string
accessLevel

Cache only. scoped: the environment holds its own RBAC user. admin: it holds the cache-wide credential and can read, write and flush every attached environment’s keys. Absent on attachments made before access levels existed (treated as scoped).

string
Allowed values: scoped admin
injectedKeys

The exact variable names this attachment wrote, removed precisely on detach

Array<string>
createdAt
string format: date-time
note

When the credentials take effect

string
Example
{
  "appName": "test-app",
  "envName": "production",
  "envVarPrefix": "MEDIA",
  "accessLevel": "scoped"
}

409

Section titled “409”

An attachment of this type already exists for the environment