Create a grant

POST

/v1/workspaces/{workspaceId}/grants

curl --request POST \
  --url https://shareout.site/v1/workspaces/example/grants \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "subject_type": "sharee", "subject_id": "example", "resource_type": "folder", "resource_id": "example", "capability": "view" }'

• Production

Workspace admins, with the external-sharing entitlement (403 EXTERNAL_SHARING_NOT_ENTITLED otherwise).

Authorizations

• bearerAuth

Parameters

Path Parameters

workspaceId

required

string

Workspace ID or slug.

Request Body^required

Media typeapplication/json

object

subject_type

required

string

Allowed values: sharee external_user

subject_id

required

string

resource_type

required

string

Allowed values: folder artifact file

resource_id

required

string

capability

required

string

Allowed values: view comment create edit

Responses

201

Created

Media typeapplication/json

object

id

string

subject_type

string

Allowed values: sharee external_user guest

subject_id

Sharee id, users.id, or for a guest grant the guest’s email.

string

resource_type

string

Allowed values: folder artifact file

resource_id

string

capability

string

Allowed values: view comment create edit

granted_by

string

created_at

string format: date-time

expires_at

When access ends (share-with-a-person expiry); null = never. A lapsed grant is denied at read time.

string | null format: date-time

subject_label

The person’s email or the client’s name (list endpoint).

string

Example

{
  "subject_type": "sharee",
  "resource_type": "folder",
  "capability": "view"
}

400

Invalid request

Media typeapplication/json

object

success

required

boolean

error

required

Human-readable message.

string

code

required

Machine-readable error code.

string

request_id

Correlation id (also the X-Request-Id header). Quote it in support tickets.

string

reason

Finer cause under code. For UNAUTHORIZED: missing, invalid, revoked or expired.

string

hint

What to do next, in plain words.

string

suggestion

string

param

The request field at fault.

string

docs

Doc page for this error.

string

redirect_url

string

support

Present on 5xx — how to reach a human.

object

how

string

include

Array<string>

Example

{
  "success": false,
  "support": {
    "how": "POST /v1/support/tickets",
    "include": [
      "request_id"
    ]
  }
}

403

Access denied

Media typeapplication/json

object

success

required

boolean

error

required

Human-readable message.

string

code

required

Machine-readable error code.

string

request_id

Correlation id (also the X-Request-Id header). Quote it in support tickets.

string

reason

Finer cause under code. For UNAUTHORIZED: missing, invalid, revoked or expired.

string

hint

What to do next, in plain words.

string

suggestion

string

param

The request field at fault.

string

docs

Doc page for this error.

string

redirect_url

string

support

Present on 5xx — how to reach a human.

object

how

string

include

Array<string>

Example

{
  "success": false,
  "support": {
    "how": "POST /v1/support/tickets",
    "include": [
      "request_id"
    ]
  }
}