Home / OCI

OCITroubleshootingBeginner

OCI Object Storage: BucketNotFound, 403s and pre-authenticated request problems

Why OCI returns 404 when you lack permission, how to check namespace, region and policies, and how to create and debug pre-authenticated requests for customers.

Deepak Bhardwaj2 min read

Applies toOCI Object Storage, OCI CLI 3.x

404 BucketNotFound often means "no permission"

OCI returns 404 BucketNotFound or ObjectNotFound both when the resource doesn't exist and when you aren't authorized to see it. Check these before concluding it's missing:

  • Namespace: every tenancy has one. URLs and CLI calls must use the correct namespace.
    oci os ns get
  • Region: buckets are regional. --region on the CLI or the endpoint in the URL must match.
  • Compartment: listing needs the right --compartment-id, but get/put by name works across compartments in the namespace if policy allows.
  • Policy: the user's group needs at least:
    Allow group DataReaders to read buckets in compartment Data
Allow group DataReaders to read objects in compartment Data
    Writing needs manage objects, or use plus specific permissions.

Test as the caller

oci os object list -bn reports --prefix 2026/10/ --limit 5
oci os object head -bn reports --name 2026/10/summary.csv

NotAuthorizedOrNotFound → policy, compartment or region. InvalidParameter → wrong bucket or object name format.

Pre-authenticated requests (PARs)

PARs give time-limited access without OCI credentials, which is useful for sharing a file with a customer.

oci os preauth-request create -bn reports --name share-oct-summary \
  --access-type ObjectRead --object-name 2026/10/summary.csv \
  --time-expires "2026-10-29T00:00:00Z"

The response includes access-uri. The full URL is:

https://objectstorage.<region>.oraclecloud.com<access-uri>
PAR problem Cause
404 with a correct-looking URL PAR expired or deleted, or the URL is for the wrong region
Upload fails with a read PAR Access type must be ObjectWrite or ObjectReadWrite (or AnyObjectWrite on the bucket)
Customer can't list files Bucket-level PARs need --bucket-listing-action ListObjects
PAR "suddenly" stops working The creator lost the permissions. PARs only work while the creator still has access.

Warning

Anyone with a PAR URL can use it until it expires. Use short expiry times, scope PARs to single objects where you can, and delete them when the customer is done: oci os preauth-request delete -bn reports --par-id <id>.

Large uploads

oci os object put -bn reports --file ./big.tar --part-size 128 --parallel-upload-count 8
oci os multipart list -bn reports        # abandoned multipart uploads still consume storage

Add a lifecycle rule to clean up uncommitted multipart uploads automatically (see the lifecycle post).

Related fixes