Stream a Sia object, with byte-range support.
An object of a public asset needs nothing. An object of a private asset needs the `expires` and `sig` of a signed url (GET /api/v1/playback/{id}/signed); a manifest served that way has the urls of its children signed with the same expiry. Access follows only the asset tier: a signed playback ID gates its own /v1/stream entry, not these objects. HEAD answers the same headers without a body. A public answer carries `ETag` (the object id) and `Cache-Control: public, no-cache`, and a conditional request (`If-None-Match`) is answered 304 only after access is checked again, so a cache never keeps serving an object after its asset turns private or is deleted; the shipped nginx keeps small public objects for at most 60 seconds between checks. Objects over 8 MB are streamed and never cached.
An object of a public asset needs nothing. An object of a private asset needs the expires and sig of a signed url (GET /api/v1/playback/{id}/signed); a manifest served that way has the urls of its children signed with the same expiry. Access follows only the asset tier: a signed playback ID gates its own /v1/stream entry, not these objects. HEAD answers the same headers without a body. A public answer carries ETag (the object id) and Cache-Control: public, no-cache, and a conditional request (If-None-Match) is answered 304 only after access is checked again, so a cache never keeps serving an object after its asset turns private or is deleted; the shipped nginx keeps small public objects for at most 60 seconds between checks. Objects over 8 MB are streamed and never cached.
objectId*stringSia object ID.
type?stringContent-type hint.
"manifest""playlist""thumbnail""poster""video""segment""data"expires?integerExpiry (unix seconds) of a signed url. Required for a private object.
sig?stringSignature of a signed url. Required for a private object.
Range?stringByte range, e.g. bytes=0-1023.
Full object.
curl -X GET 'https://sluby.example.com/v1/objects/string'Trigger a reconciliation run. POST
A run scans the whole deployment, so only an admin may start one. It is queued unless one, manual or scheduled, is already waiting or running, so repeated calls never stack runs.
Master HLS manifest for an asset or playback ID. GET
A private asset or a signed-policy playback ID needs the `expires` and `sig` of the asset’s signed master url; the child urls in the answer are then signed too. A signed playback ID gates only this entry: on a public asset its objects stay public, so the bytes are not private (make the asset private for that), and other embeds of the asset keep playing. A public answer carries an ETag and `public, no-cache`, but no shared cache keeps it: each 200 GET counts as a play (see `play_count` on an asset); HEAD and 304 do not.