mc legalhold set

Syntax

The mc legalhold set command enables legal hold Write-Once Read-Many (WORM) object locking on an object or objects.

mc legalhold requires that the specified bucket has object locking enabled. You can only enable object locking at bucket creation. See mc mb --with-lock for documentation on creating buckets with object locking enabled.

The following command enables legalhold WORM locking on all existing objects in the mydata bucket on the myminio MinIO deployment:

mc legalhold set --recursive myminio/mydata

The command has the following syntax:

mc [GLOBALFLAGS] legalhold set  \
                 [--recursive]  \
                 [--rewind]     \
                 [--version-id] \
                 ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Parameters

`ALIAS`

mc-cmd

Required

The MinIO alias and path to the object or objects on which to enable the legal hold. For example:

mc legalhold set play/mybucket/myobjects/objects.txt

`--recursive, r`

mc-cmd

Optional

Applies the legal hold to all existing objects in the ALIAS bucket or bucket prefix.

--recursive only applies to existing objects

To enable legal hold for future objects, periodically repeat the mc legalhold command as new objects are created.

`--rewind`

mc-cmd

Optional

Directs mc legalhold set to operate only on the object version(s) that existed at specified point-in-time.

To rewind to a specific date in the past, specify the date as an ISO8601-formatted timestamp. For example: --rewind "2020.03.24T10:00".
To rewind a duration in time, specify the duration as a string in #d#hh#mm#ss format. For example: --rewind "1d2hh3mm4ss".

--rewind requires that the specified ALIAS be an S3-compatible service that supports Bucket Versioning. For MinIO deployments, use mc version to enable or disable bucket versioning.

`--version-id, vid`

mc-cmd

Optional

Directs mc legalhold set to operate only on the specified object version.

--version-id requires that the specified ALIAS be an S3-compatible service that supports Bucket Versioning. For MinIO deployments, use mc version to enable or disable bucket versioning.

Global Flags

This command supports any of the global flags.

Examples

Use mc legalhold set to enable legal hold on objects:

mc legalhold set [--recursive] ALIAS/PATH

Replace ALIAS with the alias of the S3-compatible host.
Replace PATH with the path to the bucket or object on the S3-compatible host. If specifying the path to a bucket or bucket prefix, include the --recursive option.

Behavior

Legal Holds Require Explicit Removal

Legal holds are indefinite and enforce complete immutability for locked objects. Only privileged users with the s3:PutObjectLegalHold can set or lift the legal hold.

Legal Holds Complement Other Retention Modes

Legal holds are complementary to both GOVERNANCE Mode and COMPLIANCE Mode retention settings. An object held under both legal hold and a GOVERNANCE/COMPLIANCE retention rule remains WORM locked until the legal hold is lifed and the rule expires.

For GOVERNANCE locked objects, the legal hold prevents mutating the object even if the user has the necessary privileges to bypass retention.

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

Last modified August 2, 2026: init commit (8338d5b)