REFERENCE / FILE 28 + FILE 29

28. CLI and API quick reference

Working tools, not diagrams. Verify flags against your installed versions before a live demo.

Endpoints

S3: https://s3.<region>.backblazeb2.com (copy from bucket details page, e.g. s3.us-west-004.backblazeb2.com, s3.eu-central-003.backblazeb2.com [verify code on bucket page]).
Native API: authorize with b2_authorize_account, which returns the account’s API URL and download URL.
Friendly download URL pattern for public buckets: https://<downloadUrl>/file/<bucket>/<key>.

b2 CLI (v4 style)

pip install --upgrade b2
b2 account authorize
b2 bucket list
b2 bucket create my-bucket allPrivate
b2 file upload my-bucket ./local.bin path/remote.bin
b2 ls b2://my-bucket/path/
b2 sync ./dir b2://my-bucket/dir
b2 key create --bucket my-bucket demo-key listFiles,readFiles,writeFiles

[Commands and capability names vary by CLI version; run b2 --help and b2 key create --help]

aws CLI against B2

aws configure --profile b2                         # keyID / applicationKey
aws --profile b2 --endpoint-url $EP s3 ls
aws --profile b2 --endpoint-url $EP s3 sync ./dir s3://my-bucket/dir
aws --profile b2 --endpoint-url $EP s3api put-object-lock-configuration \
  --bucket locked-bucket \
  --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"GOVERNANCE","Days":7}}}'
aws --profile b2 --endpoint-url $EP s3api get-object-retention --bucket locked-bucket --key k
aws --profile b2 --endpoint-url $EP s3api put-object-legal-hold --bucket locked-bucket --key k --legal-hold Status=ON

Note: default bucket retention must be enabled at bucket creation per Backblaze docs.

boto3 config tips

from botocore.config import Config
cfg = Config(signature_version="s3v4", retries={"max_attempts": 10, "mode": "adaptive"},
             max_pool_connections=128)
s3 = boto3.client("s3", endpoint_url=EP, config=cfg, aws_access_key_id=KID, aws_secret_access_key=KEY)

Use boto3.s3.transfer.TransferConfig(multipart_chunksize=64*1024*1024, max_concurrency=32) for big files.

rclone

rclone config create b2 b2 account=$KID key=$KEY       # native backend
rclone copy src b2:bucket/path --transfers 32 --b2-chunk-size 96M --fast-list --progress
rclone mount b2:bucket /mnt/b2 --vfs-cache-mode full    # convenience, not a POSIX filesystem
rclone config create b2crypt crypt remote=b2:bucket/enc password=$(rclone obscure 'pass')

s5cmd (high parallel)

s5cmd --endpoint-url $EP --numworkers 256 cp 's3://bucket/prefix/*' ./local/

Native API calls worth knowing

Call	Use
b2_authorize_account	Get auth token and URLs
b2_create_bucket / b2_update_bucket	Bucket type, lifecycle rules, Object Lock, encryption, CORS
b2_create_key / b2_delete_key	Scoped keys
b2_update_file_retention / b2_update_file_legal_hold	Object Lock per file
b2_set_bucket_notification_rules	Event Notifications
b2_list_file_versions	Version inventory
b2_hide_file	Hide marker
b2_get_download_authorization	Token for private downloads by prefix
b2_start_large_file / b2_upload_part / b2_finish_large_file	Multipart (large files)

Transaction classes (checked 2026-10-14)

A (free): uploads, deletes, retention/legal hold updates, multipart ops, PutObjectLockConfiguration.
B (free): downloads, GetObject, HeadObject, get retention/legal hold.
C (free): list, copy, bucket ops, key ops, notification rule get/set, CORS, encryption config.
D (paid after 2,500/day): outbound Event Notification calls, $0.004 per 10,000.

Error decoder

Symptom	Likely cause
InvalidAccessKeyId / SignatureDoesNotMatch	Wrong region endpoint, SigV2 client, wrong key
AccessDenied on delete	Object Lock retention or legal hold (working as designed) or key lacks capability
Object Lock options greyed out in backup tool	Bucket created without Object Lock
503 / slow down	Back off and retry; increase parallelism carefully
Tags missing	Tagging unsupported

29. Technical deep Q&A for skeptics

The storage architect in the room will test you. Answer precisely, admit limits, offer a test.

Q: How is a file actually placed? A file goes to one tome in one vault. It is split into 17 data shards plus 3 parity shards (Reed-Solomon), one shard per pod across 20 pods in 20 cabinets. Any 17 rebuild it. Source: durability doc.

Q: What is the storage efficiency? 20/17 ≈ 1.18x raw-to-logical inside a vault, versus 3x for triple replication.

Q: What does “11 nines” assume? It is a calculated annual design durability for the vault architecture. Ask for the methodology under NDA if they need it. It is not a guarantee of availability.

Q: Is data spread across data centers within a region? US West stores data in Sacramento and Phoenix per regions doc. A single vault is described within cabinets; how vaults map across DCs is not documented publicly. [unverified: whether a single object spans DCs] For site-loss survival requirements, design Cloud Replication.

Q: Consistency model? [unverified: Backblaze public docs do not state strong read-after-write for S3 API in pages checked] Test list-after-write in the POC if the app depends on it.

Q: How are uploads handled for big files? Multipart (S3) or large file (Native) with parts uploaded in parallel. Unfinished large files can be auto-cancelled by lifecycle rule daysFromStartingToCancelingUnfinishedLargeFiles.

Q: Throughput scaling? Scale with parallel connections and multiple objects. Standard B2 is shared infrastructure; Overdrive is dedicated vaults and networking with 100 Gbps to 1 Tbps tiers. Hume AI reported ~10 GB/s uploads.

Q: Rate limits? Backblaze returns 503 under load; clients should retry with backoff. [verify published limits]

Q: How do versions and hide markers interact with Object Lock? Hiding a locked file creates a hide marker; the locked version persists until retention expires. You pay for retained versions.

Q: What breaks with Object Lock and replication? Object Lock cannot be enabled on a bucket with a source replication configuration. Destination buckets can apply default retention, computed from the source file’s upload timestamp.

Q: Encryption key hierarchy for SSE-B2? Per-file AES-256 key, wrapped by a global key. Rotation details: [ask Backblaze].

Q: Can we bring our own KMS? Not documented. SSE-C (per-request customer key) or client-side encryption.

Q: IPv6? S3-compatible API supports IPv6 (docs).

Q: CORS? Supported (PutBucketCors etc. in Class C list).

Q: Presigned POST for browser forms? Not supported. Use presigned PUT.

Q: How does billing measure storage? Byte-hours averaged over the month. Hidden versions and locked versions count.

Q: Egress metering? 3x allowance against byte-hour average stored. Partner egress free. Overage $0.01/GB.

Q: Multi-tenant isolation? Per-tenant buckets or prefixes plus per-tenant keys (100M key limit), or separate accounts via Partner API/Groups.

Q: Observability? Usage reports, bucket access logs, Event Notifications, MCP analytics tools (storage growth, egress leaders, largest files, unfinished multipart).

Q: Disaster scenario walk-through? Ransomware encrypts primary and local backup. Attacker has backup admin creds; tries deletes on B2; compliance-locked versions refuse. Team stands up clean environment; restores from B2 at full available bandwidth with no retrieval fee; egress inside 3x allowance.