Objects: copy

Copies a source object to a destination object. Optionally overrides metadata.

Generally, you should use therewrite method instead of thecopy method: thecopy method uses therewrite method, but calls it exactly once. Larger objects can require multiplerewrite calls, so copy attempts of such objects can lead toPayload too large errors.

Note: The copied object does not retain the ACLs of the original object. Instead, it gains any ACLs you specify in thecopy method or, if you don't specify any ACLs, the default object ACLs of the bucket it is stored in.

Required permissions

Theauthenticated user must have the following IAM permissionsto use this method:

  • storage.objects.create on the destination bucket
  • storage.objects.delete on the destination bucket, if overwriting an existing object
  • storage.objects.setRetention on the destination bucket, if the request body includes theretention property
  • storage.objects.get on the source bucket
  • storage.objects.createContext on the destination bucket, if the request body includes a non-emptycontexts.custom property

Request

HTTP request

POST https://storage.googleapis.com/storage/v1/b/sourceBucket/o/sourceObject/copyTo/b/destinationBucket/o/destinationObject

In addition tostandard query parameters, the following query parameters apply to this method.

To see an example of how to include query parameters in a request, see theJSON API Overview page.

Parameters

Parameter nameValueDescription
Path parameters
destinationBucketstring Name of the bucket in which to store the new object. Overrides the provided object metadata'sbucket value, if any. For information about how to URL encode object names to be path safe, seeEncoding URI path parts.
destinationObjectstring Name of the new object. Required when the object metadata is not otherwise provided. Overrides the object metadata'sname value, if any.
sourceBucketstring Name of the bucket in which to find the source object.
sourceObjectstring Name of the source object. For information about how to URL encode object names to be path safe, seeEncoding URI path parts.
Optional query parameters
destinationKmsKeyNamestringResource name of the Cloud KMS key that will be used to encrypt the object. The Cloud KMS key must be located in same location as the object.

If the parameter is not specified, the request uses the destination bucket's default encryption key, if any, or else it usesstandard Cloud Storage encryption.

If the object is large, re-encryption with the key may take too long and result in aDeadline exceeded error. For large objects, consider using therewrite method instead.
destinationPredefinedAclstring Apply a predefined set of access controls to the destination object.

Acceptable values are:
  • authenticatedRead: Object owner getsOWNER access, andallAuthenticatedUsers getREADER access.
  • bucketOwnerFullControl: Object owner getsOWNER access, and project team owners getOWNER access.
  • bucketOwnerRead: Object owner getsOWNER access, and project team owners getREADER access.
  • private: Object owner getsOWNER access.
  • projectPrivate: Object owner getsOWNER access, and project team members get access according to their roles.
  • publicRead: Object owner getsOWNER access, andallUsers getREADER access.
IfiamConfiguration.uniformBucketLevelAccess.enabled is set totrue, requests that include this parameter fail with a400 Bad Request response.
ifGenerationMatchlong Makes the operation conditional on there being a live destination object with a generation number that matches the given value. SettingifGenerationMatch to 0 makes the operation succeed only if there is no live destination object.
ifGenerationNotMatchlong Makes the operation conditional on there being a live destination object with a generation number that does not match the given value. If no live destination object exists, the precondition fails. SettingifGenerationNotMatch to 0 makes the operation succeed if there is a live version of the object.
ifMetagenerationMatchlong Makes the operation conditional on there being a live destination object with a metageneration number that matches the given value.
ifMetagenerationNotMatchlong Makes the operation conditional on there being a live destination object with a metageneration number that does not match the given value.
ifSourceGenerationMatchlong Makes the operation conditional on whether the source object's generation matches the given value.
ifSourceGenerationNotMatchlong Makes the operation conditional on whether the source object's generation does not match the given value.
ifSourceMetagenerationMatchlong Makes the operation conditional on whether the source object's current metageneration matches the given value.
ifSourceMetagenerationNotMatchlong Makes the operation conditional on whether the source object's current metageneration does not match the given value.
projectionstring Set of properties to return. Defaults tonoAcl, unless the object resource specifies theacl property, when it defaults tofull.

Acceptable values are:
  • full: Include all properties.
  • noAcl: Omit theowner,acl property.
sourceGenerationlong If present, selects a specific revision of the source object (as opposed to the latest version, the default).
Optional extension headers
X-Goog-Copy-Source-Encryption-Algorithmstring The encryption algorithm to use, which must beAES256. Used if the source object was encrypted with acustomer-supplied encryption key.
X-Goog-Copy-Source-Encryption-Keystring AnRFC 4648 Base64-encoded string of the AES-256 encryption key used to encrypt the source object, if it was encrypted with acustomer-supplied encryption key.
X-Goog-Copy-Source-Encryption-Key-Sha256string AnRFC 4648 Base64-encoded string of the SHA256 hash of the encryption key used to encrypt the source object, if it was encrypted with acustomer-supplied encryption key.
X-Goog-Encryption-Algorithmstring The encryption algorithm to use, which must beAES256. Used for encrypting the destination object with acustomer-supplied encryption key.
X-Goog-Encryption-Keystring AnRFC 4648 Base64-encoded string of your AES-256 encryption key. Used for encrypting the destination object with acustomer-supplied encryption key.
X-Goog-Encryption-Key-Sha256string AnRFC 4648 Base64-encoded string of the SHA256 hash of your encryption key. Used for encrypting the destination object with acustomer-supplied encryption key.

Request body

In the request body, supply metadata to apply to the destination object by using anobject resource. If the request body is empty,editable metadata from the source object is applied to the destination object, with the exception of any ACLs, object holds, orretention configuration set on the source object. If you want to retain these from the original object, they must be included in the request body.

Response

If successful, this method returns anobject resource in the response body.

For information about status and error codes returned by this API, see thereference page.

Try it!

Use the APIs Explorer below to call this method on live data and see the response.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-17 UTC.