GetObjectTagging

GetObjectTagging returns the tag set of an object. Objects on STRG carry no tags, so the answer is always an empty tag set. That keeps tools and SDKs which read object tags as part of their normal flow - backup and sync tools, infrastructure-as-code - working without any changes, and it matches DeleteObjectTagging, which always succeeds.

Good to know on STRG

• Objects have no tags, so <TagSet> is always empty.
• PutObjectTagging is answered with 501 NotImplemented, so a client knows straight away, and so is x-amz-tagging on an upload or a copy.
• A bucket in another region answers 404 NoSuchBucket rather than a redirect: each bucket is reached through its own regional endpoint.
• x-amz-expected-bucket-owner is welcome and has nothing to check: a key only ever reaches buckets of its own account.

When you'd use it

• Backup and sync tools. A tool copying objects from one store to another may read each object's tags so it can carry them along. On STRG it gets an empty tag set and copies the object as usual.
• Infrastructure-as-code. Tools that compare an object with its description - content, metadata and tags - read the tags to see whether anything changed. An empty tag set matches a description that sets none, so the run carries on.
• Scripts written for Amazon S3. A script that looks at an object's tags before deciding what to do with it keeps running unchanged, and finds no tags.

Request

GET /photos/2024/cat.jpg?tagging HTTP/1.1
Host: my-bucket.s3.eu-central-1.strg.com
Authorization: AWS4-HMAC-SHA256 Credential=...
x-amz-date: 20260926T120000Z
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

The path-style form is GET /my-bucket/photos/2024/cat.jpg?tagging on s3.eu-central-1.strg.com, which is what a bucket name containing a dot needs - Addressing explains both.

Permissions

The access key needs Read objects (objects:read). For a key limited to certain buckets or to an object prefix, the bucket and the object key need to fall within them. Access keys has the details.

URI parameters

Name	Type	Required	Description
Bucket	String	Yes	The bucket containing the object.
Key	String	Yes	The object key.
tagging	Flag	Yes	Selects this operation. Sent with no value.
versionId	String	No	The version to read the tag set of. Its tag set is empty too.

Any other query parameter is answered with 501 NotImplemented.

Request headers

Name	Type	Required	Description
x-amz-expected-bucket-owner	String	No	Welcome, with nothing to check: an access key only ever reaches its own account's buckets.
x-amz-request-payer	String	No	Has no effect: STRG has no Requester Pays buckets.

Request body

None.

Response

A successful request answers 200 OK with an XML body.

Response headers

Name	Description
x-amz-version-id	S3's header naming the version whose tag set was read. The tag set is empty whichever version it is.
x-amz-request-id	The request ID, handy for a support request.

Response body

Element	Type	Description
Tagging	Container	The root element.
TagSet	Container	The object's tags. Always empty on STRG.

<?xml version="1.0" encoding="UTF-8"?>
<Tagging xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
  <TagSet/>
</Tagging>

Errors

These are the errors this request can return, and the situation behind each one.

Code	HTTP status	When
NoSuchBucket	404	The bucket does not exist, it is in a region other than the endpoint's, or the account has no storage in this endpoint's region.
AccessDenied	403	The access key lacks Read objects, the bucket or key is outside the key's buckets or object prefix, an x-amz-* header is not signed, or a presigned URL has expired.
InvalidAccessKeyId	403	The access key does not exist, has expired or been revoked - or it was created moments ago and is not usable yet in a region where the account already stores data, in which case the same request works shortly afterwards.
InvalidURI	400	The key contains a . or .. path segment.
SignatureDoesNotMatch	403	The request signature does not match.
RequestTimeTooSkewed	403	The request time is more than 15 minutes from the server's.
AuthorizationHeaderMalformed	400	The signature's credential scope names a region other than the endpoint's.
NotImplemented	501	The request carries a query parameter this operation does not use.
SlowDown	503	Too many requests. The Retry-After header says when a retry is welcome; the AWS SDKs retry on their own.
ServiceUnavailable	503	A temporary failure; the same request can be retried.

Differences from Amazon S3

The table lists each place where STRG behaves differently, and what that means for a client.

Aspect	Amazon S3	STRG
Object tags	Stored and returned	Objects have no tags; <TagSet> is always empty
Setting tags	PutObjectTagging, or x-amz-tagging on PutObject, CopyObject and CreateMultipartUpload	501 NotImplemented for each, so a client knows straight away
Bucket in another region	301 redirect with x-amz-bucket-region	404 NoSuchBucket. A bucket is reached through its own regional endpoint.
x-amz-expected-bucket-owner	Checked against the bucket owner	Welcome, with nothing to check

Examples

AWS CLI

aws s3api get-object-tagging \
  --bucket my-bucket \
  --key photos/2024/cat.jpg \
  --endpoint-url https://s3.eu-central-1.strg.com \
  --region eu-central-1

The output:

{
    "TagSet": []
}

Python (boto3)

import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.eu-central-1.strg.com",
    region_name="eu-central-1",
)

response = s3.get_object_tagging(Bucket="my-bucket", Key="photos/2024/cat.jpg")
print(response["TagSet"])  # []

JavaScript (AWS SDK v3)

import { GetObjectTaggingCommand, S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://s3.eu-central-1.strg.com",
  region: "eu-central-1",
});

const response = await client.send(
  new GetObjectTaggingCommand({ Bucket: "my-bucket", Key: "photos/2024/cat.jpg" }),
);
console.log(response.TagSet); // []

Related

• DeleteObjectTagging
• GetBucketTagging
• GetObject
• HeadObject
• Access keys
• S3 API overview - including the other S3 operations