---
title: "Publish / unpublish and set the link audience"
method: PUT
path: "/reports/{id}/share"
tags: ["Sharing"]
---

# Publish / unpublish and set the link audience

`PUT /reports/{id}/share`

## Request

- Base URL: `https://commareports.com/api/v1`
- URL: `https://commareports.com/api/v1/reports/{id}/share`
- Auth: HTTP bearer

Change `visibility` (`private`, `team`, `registered`, `domain`, `public`), `public_permission` (`none`, `view`, `comment`, `edit`), `show_approved_only` (staged publishing: view-only audiences see the last approved revision), and/or `allowed_embed_origins` (the origins allowed to iframe the report via `/embed/{id}`; `[]` or `null` turns embedding off). `domain` (anyone signed in with a verified email on a listed domain) requires `allowed_email_domains`, e.g. `["acme.com"]`; send it again with the full list to change it. Requires manage access (`can_manage_report`: owner or admin) — an editor cannot flip a private report public. Scope: `sharing`.

## Request body

- SharePutRequest: At least one property must be present.
  - `visibility` 'private' | 'team' | 'registered' | 'domain' | 'public'
  - `allowed_email_domains` string[]: Required with, and only accepted with, visibility 'domain'. Bare domains (e.g. 'acme.com'); lowercased and de-duplicated. Replaces the existing list.
  - `public_permission` 'none' | 'view' | 'comment' | 'edit'
  - `show_approved_only` boolean
  - `allowed_embed_origins` string[], nullable: Bare origins (scheme + host + optional port, no path) allowed to iframe the report via `/embed/{id}`. https is required except for http://localhost and http://127.0.0.1. `[]` or `null` turns embedding off.

## Response `200`

Updated share settings.

- ShareUpdated
  - `id` string, uuid, required
  - `visibility` string, required
  - `public_permission` string, required
  - `allowed_email_domains` string[]
  - `show_approved_only` boolean, required
  - `allowed_embed_origins` string[], required
  - `embed_url` string, nullable, required: `/embed/{id}`, or null when embedding is off.
  - `embed_snippet` string, nullable, required: Markup to paste into the host page, or null when embedding is off. Renders only while the report is public, its link permission isn't `none`, and it has no share password.
  - `updated_at` string, date-time, required
  - `share_url` string, required

## Other responses

- `400`: Malformed body or invalid field.
- `401`: Missing, invalid, revoked, or expired token.
- `403`: Token missing the required scope, or no access to the resource.
- `404`: Resource not found (also returned instead of 403 where existence must not leak).
- `429`: Rate limit exceeded. Rate limit: per-token sliding window (plan-aware — Free 60 req/min, Pro 600, Team/Enterprise 6000 by default); 429 responses carry a Retry-After header.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/commareports/apis/comma-api.md) · [All operations](https://skmtc.dev/commareports/apis/comma-api/llms.txt) · [OpenAPI document](https://skmtc.dev/commareports/apis/comma-api/revisions/cd5263522ade?raw)