Share links let a report run or decision trace be viewed at a /share/{token} URL without a
login — the token itself is the credential, like a password. Management endpoints are tenant-scoped
and RBAC-gated; the public read endpoint is auth-free and validates the token itself.
POST /api/v1/shares
Issue a new share token. Editor or admin.
Request body
kind does not accept "dashboard". Dashboards are config-driven (there is no Dashboard
entity to resolve), so a dashboard token would always 404. The value is intentionally excluded
from the create schema.
Response 201
The token is returned only once, at creation time. Store it — list responses omit it.
Errors
GET /api/v1/shares
List this tenant’s share links. Viewer, editor, or admin.
The token is never returned here — only metadata and usage counters.
Response 200
DELETE /api/v1/shares/:id
Revoke a share link. Editor or admin. Revocation is soft — the row stays with revoked: true
so the audit trail is preserved, and the public read endpoint immediately refuses the token.
Response 200
GET /api/v1/public/shares/:token
Auth-free read of a previously issued share. No tenant header, no API key — the token in the path
is the credential. Per-IP rate limited (60 requests / 60 s, fail-open).
Response 200
For report_run the payload excludes raw artifact bytes (metadata, section data, and narrative
only). Each successful read increments the link’s viewCount.
Every failure mode returns 404 — token not found, revoked, expired, or the underlying resource
deleted — so a caller can never enumerate which tokens exist.
