# Set bucket visibility

> Make a whole bucket public or private.

`PATCH https://api.codebuckets.clatterlabs.xyz/v1/buckets/{bucket_id}/visibility` (key permission: `buckets:write`)

Sets the bucket's default to `public` or `private` (new buckets are private). Every stored file whose own setting is `inherit` follows it; files set to `private` or `public` keep their own setting. The code preview tree is never public. Recorded as a `bucket.visibility_changed` event.

## Authorizations

- `Authorization` (string, required): Your API key as a bearer token: `Bearer clsk_...`. Create keys in the [Console](https://console.clatterlabs.com/api-keys) with the Code Buckets permissions you need.
- `X-Clatter-Account` (string, required): The Account ID that owns the key, like `CL-7K2M9QXA`. Find it in Console › Settings. A missing value answers `401 missing_account_id`; someone else's answers `401 account_mismatch`.

## Path parameters

- `bucket_id` (string, required): The bucket id (`cbk_…`).

## Body

- `visibility` (string, required): `public` or `private`.

## Response

- `object` (string): Always `bucket`.
- `id` (string): The bucket id, like `cbk_q7c1r9t2y6u0i3o8p5a4`.
- `project_id` (string): The Project ID it belongs to.
- `name / description` (string): Your name and description.
- `preview` (boolean): Whether uploaded zips are unpacked into a browsable code tree.
- `visibility` (string): `private` (default) or `public`. In a public bucket, every stored file that follows the bucket default has a public link. See [Public files](/code-buckets/public-files).
- `code` (object): `{ ref, files, bytes }`: the current code tree. `ref` is `null` until the first zip is unpacked.
- `storage` (object): `{ used_bytes, pending_bytes, limit_bytes }`. `used_bytes` counts stored zips and assets; `pending_bytes` is reserved by unfinished uploads; the limit is 10 GB (10,737,418,240 bytes).
- `encryption` (object): How stored files are encrypted.
- `created_at / updated_at` (string): ISO 8601 timestamps.

## Example request

```bash
curl -X PATCH "https://api.codebuckets.clatterlabs.xyz/v1/buckets/BUCKET_ID/visibility" \
  -H "Authorization: Bearer $CLATTER_API_KEY" \
  -H "X-Clatter-Account: $CLATTER_ACCOUNT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "visibility": "public"
  }'
```

## Errors

| Status | Code | When |
| --- | --- | --- |
| `400` | `bad_request` | `visibility` isn't `public` or `private`. |
| `401` | `invalid_api_key / missing_account_id / account_mismatch` | The key or Account ID is wrong. |
| `402` | `quota_exceeded` | This month's free tokens are used up. |
| `403` | `insufficient_scope` | The key lacks the permission. |
| `404` | `not_found` | No bucket with that id on your account. |

## Example response

```json
{
  "object": "bucket",
  "id": "cbk_q7c1r9t2y6u0i3o8p5a4",
  "project_id": "cbp_4k9x2m7q1n8v3c6z0b5w",
  "name": "web",
  "description": null,
  "preview": true,
  "visibility": "public",
  "code": {
    "ref": "9b1f0c5e2a7d43e8b6c1f0a9d2e5b7c4a1f3e8d0",
    "files": 1284,
    "bytes": 18734211
  },
  "storage": {
    "used_bytes": 131204115,
    "pending_bytes": 0,
    "limit_bytes": 10737418240
  },
  "encryption": {
    "algorithm": "AES-256-GCM",
    "key": "per-bucket data key, wrapped by a Clatter Labs master key"
  },
  "created_at": "2026-10-28T14:05:11.482Z",
  "updated_at": "2026-10-28T14:05:11.482Z"
}
```