> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Regions and endpoints

> Which host to call, and which services are global rather than regional.

Every Basaltic API is addressed by service, on its own hostname. There is no
single API gateway host.

## Region codes

A region code is `<continent>-<metro>-<n>` — the geographic prefix is a strict
continent, and the metro token is what carries the legal jurisdiction your data
sits in.

| Region          | Location          |
| --------------- | ----------------- |
| `sa-saopaulo-1` | São Paulo, Brazil |

`GET https://iam.basaltic.sh/v1/regions` returns the live catalogue. It needs no
authentication, so it is a safe first call to confirm connectivity.

## Global and regional services

Your account, its identity and its bill are **global** — one of each, wherever
you build. The resources you create are **regional**, and so are most of the
APIs that manage them.

<Tabs>
  <Tab title="Regional">
    Addressed as `https://<service>.<region>.basaltic.sh`, for example
    `https://compute.sa-saopaulo-1.basaltic.sh`.

    | Service       | Host                                 |
    | ------------- | ------------------------------------ |
    | Compute       | `compute.<region>.basaltic.sh`       |
    | Network       | `network.<region>.basaltic.sh`       |
    | Load balancer | `loadbalancer.<region>.basaltic.sh`  |
    | Storage       | `storage.<region>.basaltic.sh`       |
    | Database      | `database.<region>.basaltic.sh`      |
    | Registry      | `registry.<region>.basaltic.sh`      |
    | Certificate   | `certificate.<region>.basaltic.sh`   |
    | KMS           | `kms.<region>.basaltic.sh`           |
    | Secrets       | `secrets.<region>.basaltic.sh`       |
    | Queue         | `queue.<region>.basaltic.sh`         |
    | Notifications | `notifications.<region>.basaltic.sh` |
    | Email         | `email.<region>.basaltic.sh`         |
    | Telemetry     | `telemetry.<region>.basaltic.sh`     |

    Sign these with the region code in the credential scope.
  </Tab>

  <Tab title="Global">
    Addressed as `https://<service>.basaltic.sh` — one endpoint, no region
    segment.

    | Service | Host                  | Why it is global                         |
    | ------- | --------------------- | ---------------------------------------- |
    | IAM     | `iam.basaltic.sh`     | One identity across every region         |
    | Billing | `billing.basaltic.sh` | One bill per account                     |
    | Quota   | `quota.basaltic.sh`   | Limits are set per account               |
    | Audit   | `audit.basaltic.sh`   | One trail per account                    |
    | DNS     | `dns.basaltic.sh`     | The public DNS namespace is not regional |

    Sign these with `global` in the credential scope instead of a region code.
  </Tab>
</Tabs>

## Object storage

S3-compatible object storage is the one endpoint that is not on `basaltic.sh`:

```
https://objects.<region>.basaltic.cloud
```

It sits on a separate domain deliberately, off the product domain, because it
is driven by ordinary AWS SDKs and signed as S3 rather than with the Basaltic
scheme. Point any S3 client at it as a custom endpoint.

The *management* side of storage — volumes, snapshots, bucket lifecycle — is on
`storage.<region>.basaltic.sh` with the rest of the platform API.

## Choosing the scope when you sign

The `<region>` element of the credential scope must match the endpoint you are
calling:

```
Credential=<access_key_id>/<date>/sa-saopaulo-1/basaltic/basaltic_request   ← regional
Credential=<access_key_id>/<date>/global/basaltic/basaltic_request          ← global
```

Getting this wrong is a `401`, not a redirect.