docs · delivery

Delivery to your bucket

Outputs go to your bucket and nowhere else. We write; you own.

Set an output bucket#

python

client.batches.create(
    input_file_id=f.id,
    endpoint="/v1/chat/completions",
    completion_window="24h",
    extra_body={"deadline": "24h", "output_bucket": "s3://your-bucket/maksa"},
)

Without output_bucket, outputs are available through the Files API for 72 hours and then deleted.

What lands#

s3://your-bucket/maksa/<receipt-id>/

outputs-00000.jsonl   # one line per request, OpenAI batch output format
outputs-00001.jsonl
errors.jsonl          # only if any request failed validation
receipt.json          # the receipt, with field digests and root hash

Permissions#

store	grant	scope
Amazon S3	s3:PutObject, s3:AbortMultipartUpload	arn:aws:s3:::your-bucket/maksa/*, via a role we assume with an external id
Google Cloud Storage	roles/storage.objectCreator	a service account we provide, on the bucket
Azure Blob	Storage Blob Data Contributor	a managed identity, on one container
Cloudflare R2	Object Write	an API token scoped to one bucket

aws · bucket policy

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::<maksa-account>:role/maksa-delivery" },
    "Action": ["s3:PutObject", "s3:AbortMultipartUpload"],
    "Resource": "arn:aws:s3:::your-bucket/maksa/*",
    "Condition": { "StringEquals": { "sts:ExternalId": "<your-external-id>" } }
  }]
}

We never need read or list access. Delivery is confirmed by the store's own write acknowledgement; that timestamp is delivered_at on the receipt.