To perform a single-request upload with the XML API, you make a PUT request
that is scoped with a bucket name and the object's name, and you put the object
data into the request body. The uploaded object replaces any existing object
with the same name. For tips on uploading to Cloud Storage, see
Best Practices. For a quick guide to simple uploads using tools such as
the XML API, see Uploading Objects.
The PUT Object request uses several standard HTTP headers. Content-Length
specifies the object's size in bytes and is required unless you are using
chunked transfer encoding. Optional headers include Content-Type,
Content-MD5, and those listed below. Cloud Storage stores these
headers as part of the object's metadata, except for Content-MD5, which
Cloud Storage uses to check for data integrity. See
Editing object metadata for information on changing metadata values for
objects.
You also use a PUT Object request when you want to change the storage class
of an existing object, because you must rewrite the existing object to do so.
The request should contain the x-goog-storage-class request header,
as well as the object in the request body.
This request does not typically include query string parameters.
See signed URL query string parameters for information on the parameters you include when creating and using signed URLs.
In addition to common request headers, the following can be used.
Cache-ControlCache-Control is also used to determine whether an
object can be transformed.Content-DispositionContent-EncodingContent-Languagex-goog-aclx-goog-custom-timex-goog-encryption-kms-key-namex-goog-meta-x-goog-object-lock-modeMode of the object's retention
configuration. GOVERNANCE corresponds to unlocked mode,
and COMPLIANCE corresponds to locked mode.
If this header is specified,
x-goog-object-lock-retain-until-date must also be
specified.
x-goog-object-lock-retain-until-date
A date and time represented in RFC 3339 UTC format that determines the time until which the object is retained as immutable.
If this header is specified, x-goog-object-lock-mode must
also be specified.
x-goog-storage-classTo provide a customer-supplied encryption key along with the object upload, use the headers listed on the Customer-Supplied Encryption Key page in your request.
The request body contains the data.
The following syntax applies to PUT Object requests that don't use any query
string parameters and excludes the x-goog-copy-source request
header.
PUT /OBJECT_NAME HTTP/1.1 Host: BUCKET_NAME.storage.googleapis.com Date: DATE Content-Length: REQUEST_BODY_LENGTH Content-Type: MIME_TYPE Content-MD5: MD5_DIGEST Authorization: AUTHENTICATION_STRING x-goog-storage-class: STORAGE_CLASS
The request can return a variety of response headers depending on the request headers you use.
The response does not include an XML document in the response body.
The following sample uploads an object named paris.jpg to a bucket named travel-maps.
Request
PUT /paris.jpg HTTP/1.1 Host: travel-maps.storage.googleapis.com Date: Sat, 20 Feb 2010 16:31:08 GMT Content-Type: image/jpg Content-MD5: iB94gawbwUSiZy5FuruIOQ== Content-Length: 554 Authorization: Bearer ya29.AHES6ZRVmB7fkLtd1XTmq6mo0S1wqZZi3-Lh_s-6Uw7p8vtgSwg
Response
HTTP/1.1 200 OK ETag: "881f7881ac1bc144a2672e45babb8839" Date: Sat, 20 Feb 2010 16:31:09 GMT Content-Length: 0 Content-Type: text/html
If you try to upload an object into a bucket that does not exist, you get a
404 Not Found status code and the body of the error response has
NoSuchBucket in the Code element.
If the supplied MD5 digest is malformed, you get a 400 Bad Request status
code and the body of the error response has InvalidDigest in the Code
element.
If the digest does not match the digest we compute from the body, you get a
400 Bad Request status code and the body of the error response has
BadDigest in the Code element.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-07-22 UTC.