API

MinIO exposes four HTTP API surfaces. They are all served from the same listener (default :9000), routed by cmd/routers.go.

Surface	Path prefix	Implemented in
S3	/{bucket}/{object}	cmd/api-router.go, cmd/object-handlers.go, cmd/bucket-handlers.go, cmd/object-multipart-handlers.go, cmd/bucket-listobjects-handlers.go, cmd/bucket-policy-handlers.go, cmd/bucket-notification-handlers.go, cmd/bucket-lifecycle-handlers.go, cmd/bucket-replication-handlers.go, cmd/bucket-encryption-handlers.go, cmd/bucket-versioning-handler.go
Admin	/minio/admin/v3	cmd/admin-router.go, cmd/admin-handlers*.go, cmd/admin-bucket-handlers.go, cmd/admin-heal-ops.go
STS	/?Action=AssumeRole...	cmd/sts-handlers.go
KMS	/minio/kms/v1	cmd/kms-router.go, cmd/kms-handlers.go
Health	/minio/health/{live,ready,cluster}	cmd/healthcheck-router.go, cmd/healthcheck-handler.go
Metrics	/minio/metrics/v2, /minio/metrics/v3/...	cmd/metrics-router.go, cmd/metrics-v2.go, cmd/metrics-v3*.go
Listen	/minio/listen/v1	cmd/listen-notification-handlers.go

Each is described in its own page:

• S3 API
• Admin API
• STS
• KMS
• Health and metrics

Authentication

• S3 routes accept SigV4 (preferred), SigV2 (legacy), pre-signed URLs (V2/V4), POST policy, and JWT cookies (browser console). See Object API and HTTP.
• Admin and KMS routes require SigV4-signed credentials with the matching admin policy actions.
• STS routes either accept SigV4 (for AssumeRole) or are unauthenticated and validate the supplied IDP token instead.
• Health and metrics endpoints are unauthenticated by default; metrics can be locked behind SigV4 via MINIO_PROMETHEUS_AUTH_TYPE.

Versioning conventions

• The S3 API tracks the official AWS spec wherever practical.
• Admin uses an explicit /v3/ segment that has remained stable since the v3 redesign; older v1/v2 paths are gone.
• Metrics has two coexisting endpoints (v2 monolithic and v3 grouped); v2 is being kept around for clients that scrape it but new metrics go to v3.

Wire formats

• S3 uses XML for request/response bodies, with JSON for the ?select Select API events.
• Admin uses JSON.
• STS responds with XML (matching AWS).
• KMS uses JSON.
• Metrics uses Prometheus text exposition.

See the per-surface pages for endpoint inventories.