> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.detectant.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.detectant.com/_mcp/server.

# Connect OVHcloud Object Storage

Detectant supports current-generation regional OVHcloud S3 Object Storage through the regional `.io` endpoint. Local Zones, legacy Swift-S3 endpoints and `.perf` endpoints are not supported.

## Before you connect

1. Create a dedicated Object Storage user in the OVHcloud project that owns the bucket.
2. Add the dedicated Detectant user to the S3 container with the **Read-only** role.
3. Create S3 credentials for that user. Do not use an Administrator account.
4. Note the bucket's region. Detectant derives the endpoint and signing region and always uses path-style requests.

The supported regions are `gra`, `rbx`, `sbg`, `eu-west-par`, `eu-south-mil`, `de`, `uk`, `waw`, `bhs`, `ca-east-tor`, `sgp`, `ap-southeast-syd` and `ap-south-mum`.

## Connect the bucket

In **Dashboard → Integrations**, choose **Add integration**, select **OVHcloud**, then enter the region, bucket, optional prefix and dedicated user's access key ID and secret access key.

Choose **New files only** to baseline existing objects without scanning them. Choose **Existing and new files** to preview the eligible existing-object count and remaining monthly allowance. Existing objects are not released for scanning until you confirm the preview. Objects beyond the current allowance remain queued until the next billing period; Detectant does not rediscover or enqueue them repeatedly.

Credentials are encrypted and never returned. Replacing credentials verifies the new credentials before deleting the old encrypted credential and schedules an immediate poll.

## Object size limits

S3 objects can be up to **500 MB on Free** and **2 GB on paid plans**. These
storage limits are separate from direct API uploads, which remain limited to
50 MB on Free and 250 MB on paid plans. Objects above the current plan's S3
limit are recorded as too large without being scanned.

Detectant stages readable objects only for the duration of a scan and deletes
the temporary copy immediately after completion, rejection or failure.

## Polling health

* **Baselining:** Detectant is building the initial inventory.
* **Healthy:** The baseline or latest check completed. The dashboard shows the last checked time and next scheduled check.
* Checks currently run every five minutes. A check with no new or changed objects does not create a scan.
* **Temporary failure:** A provider or network request failed. The dashboard keeps the last successful check visible and shows the failed attempt and retry schedule separately.
* **Credentials rejected:** Replace revoked, incorrect or insufficient credentials.
* **Object limit exceeded:** The configured scope exceeds the first-release limit of 100,000 listed entries. Use a narrower prefix or bucket.
* **Allowance paused:** Queued scans resume at the next billing-period boundary without downloading object content first.

## Storage classes and versions

Detectant reads the current object revision only and treats ETags as opaque. Standard, High Performance and other immediately readable objects follow the normal read path. Archived objects are never restored automatically. Restore them in OVHcloud before scanning; an unavailable archived object is recorded as restore required. Access and decryption failures are recorded separately.

## Troubleshooting

* Confirm the bucket is in the selected region and is reachable through `https://s3.<region>.io.cloud.ovh.net`.
* Confirm the dedicated user can list the configured bucket/prefix and read at least one object in that scope.
* If setup succeeds for an empty scope but later reports rejected credentials, verify object-read permission for newly added objects.
* For dotted bucket names, keep the OVHcloud preset selected; Detectant's fixed path-style addressing avoids TLS hostname ambiguity.
* After credential rotation, use **Replace credentials** rather than deleting the integration. Detectant verifies the replacement and polls immediately.