Skip to content

WebDAV and S3 interfaces (optional)

Some Sites deployments enable additional ways to manage content.

This page explains what those interfaces are for and how to connect to them. They are optional applications and may not be enabled for every site.

WebDAV

What it is

WebDAV lets some tools treat a remote site like a folder you can browse and edit.

How to know if your site has it

If enabled, the Hub shows an ecBox URL in the site's Overview. Use that full URL in a WebDAV client. Do not rely on a guessed URL if the Hub does not show one.

Authenticate with Basic Authentication: any username works (it is ignored — the Hub suggests ecbox), and the password must be the site's Master Token or an HTTP Access Token. This is required on a private site, and on any site for operations that change content. On a public site, paths not covered by a .htpasswd file can be browsed and downloaded anonymously. A .htpasswd file does not add accounts to WebDAV: it only removes anonymous access on that tree, and you still authenticate with a site token (see 03-managing-access.md).

Point your client at the URL with the trailing slash (…/s/dav/): the slash-less address redirects, and some mount helpers do not follow the redirect. Clients that probe the server's DAV support find it advertised (MS-Author-Via: DAV).

When to use it

Use WebDAV if:

  • you prefer interactive file management
  • you want to mount the site as a network drive

Otherwise, use the Site API or the Sites CLI.

S3 interface

What it is

Some sites expose a lightweight S3-compatible endpoint.

This can be convenient if you already use S3 tooling.

How to know if your site has it

If enabled, the Hub shows an S3 Interface URL in the site's Overview. Use that URL as the endpoint in your S3 client.

When to use it

Use the S3 interface if:

  • you’re integrating with S3 clients
  • you want an S3-like abstraction over site storage

Provide a site Master Token or HTTP Access Token through the S3 session token slot:

  • For curl, send it in the X-Amz-Security-Token header.
  • For Amazon Web Services (AWS) CLI, s5cmd, or rclone, set it as AWS_SESSION_TOKEN.

The value must carry a token-type prefix: Master <token> or Bearer <token>. A bare token without the prefix is not recognised and the request fails with 403. (The hint shown on the Hub's Overview page omits the prefix — add it yourself.)

The interface serves the site content itself: buckets map to top-level folders of the site, and object keys are paths inside them.

Treat this token like a password. See Site settings for token permissions and rotation.

Important notes

  • These interfaces are optional and may be disabled on your site. Check the URLs shown in the Hub's Overview section.
  • The interface URL and authentication method are specific to the selected interface. Do not use a WebDAV password prompt as an S3 credential.
  • If you run into authentication prompts or unexpected 404s, check:
  • site is public/private
  • you’re in allowed groups
  • .htpasswd behaviour (see 03-managing-access.md)

If in doubt, use the Site API cookbook: 05-site-api-cookbook.md The interface paths are listed in Understanding Sites URLs.