Skip to main content
A share link is a public, read-only view of a project: titles, descriptions and structure, with free-text notes excluded. Anyone with the URL can open it without logging in, so treat the token as a long-lived secret.
  • expiresInDays is optional. Without it the link never expires and expiresAt is null. If you send it, it must be a JSON number that is a whole number from 1 to 3650. Anything else returns 400 invalid_expires_in_days and nothing is minted: a numeric string ("30"), 0, a negative number, a fraction, or null. The message says what was received and what is valid. An earlier version ignored a bad value and minted a link that never expired, which turned a typo into a permanent public credential.
  • settings.includedGoalIds scopes the shared view to specific goals: { "projectId": "...", "settings": { "includedGoalIds": ["goal-1"] } }. If none of the ids are goals in the project, the link is still minted but the view will be empty, and _meta._tip warns you.
active is false once a link is revoked or expired. Newest first.
Revoking a token that is already revoked, expired, or unknown returns 200 with "revoked": null and a tip saying no active token matched.

Access

Owners and members can mint, list and revoke. A project you cannot access returns 403 { "error": "Not your project" }; an unknown project returns 404. List periodically and revoke anything you do not recognise.