---
title: "Set or change the share-link password"
method: POST
path: "/reports/{id}/password"
tags: ["Sharing"]
---

# Set or change the share-link password

`POST /reports/{id}/password`

## Request

- Base URL: `https://commareports.com/api/v1`
- URL: `https://commareports.com/api/v1/reports/{id}/password`
- Auth: HTTP bearer

Owner only. NOTE: unlike the rest of this API, the password endpoints authenticate with a Supabase user-session JWT (the signed-in browser path), not a `comma_sk_…` API token — an API token gets 401 here.

## Request body

- object
  - `password` string, required: Minimum length enforced server-side.

## Response `200`

Password set.

- PasswordResult
  - `ok` boolean, required
  - `password_set` boolean, required

## Other responses

- `400`: Malformed body or invalid field.
- `401`: Missing, invalid, revoked, or expired token.
- `403`: Token missing the required scope, or no access to the resource.
- `404`: Resource not found (also returned instead of 403 where existence must not leak).
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/commareports/apis/comma-api.md) · [All operations](https://skmtc.dev/commareports/apis/comma-api/llms.txt) · [OpenAPI document](https://skmtc.dev/commareports/apis/comma-api/revisions/cd5263522ade?raw)