---
title: "Read the public share URL of a file"
method: GET
path: "/v1/files/{uuid}/share"
tags: ["Files"]
---

# Read the public share URL of a file

`GET /v1/files/{uuid}/share`

## Request

- Base URL: `https://contentmaschine.ai/api`
- URL: `https://contentmaschine.ai/api/v1/files/{uuid}/share`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://contentmaschine.ai/api/oauth/authorize`, token URL `https://contentmaschine.ai/api/oauth/token`)

A READ. It returns the URL of an already-public file; it does not publish anything.
Make the file public first with PUT /v1/files/{uuid}/visibility, or this answers 409.

**The returned URL is PERMANENT, UNAUTHENTICATED and has NO EXPIRY.** It is not a
signed link and it carries no token. Anyone who receives it - forwarded, scraped,
logged, pasted into a chat - can fetch the file, with no credentials, indefinitely.
**Handing this URL to anyone is publishing the file.**

Do not confuse it with the presigned URL that GET /v1/files/{uuid}/download returns.
Those two look superficially similar and are opposites: one expires in an hour, this
one never does.

Setting the file private again removes the public file page but does NOT retroactively
unpublish bytes already fetched or cached, and does not stop the legacy serve and
thumbnail routes. The same three facts are returned as DATA below - `is_permanent`,
`requires_authentication`, `expires_at` - so a caller that never reads prose still
gets them.

The share-count beacon that the web app posts is deliberately NOT exposed on this
API: it is unauthenticated product analytics and exposing it would hand a token
holder a counter to inflate.

## Path parameters

- `uuid` string, uuid, required

## Response `200`

The share URL, with its properties stated as data.

- object
  - `success` boolean
  - `data` object
    - `share_url` string: Permanent, unauthenticated URL.
    - `is_permanent` true: Always true.
    - `requires_authentication` false: Always false.
    - `expires_at` string, date-time, nullable: Always null. There is no expiry.
    - `warning` string: The same warning in one sentence.
    - `affiliate_code` string, nullable: Appended to the URL as ?ref= when present.
  - `timestamp` string, date-time

## Other responses

- `401`: Missing or invalid API key.
- `404`: Unknown file, or not yours.
- `409`: The file is private and therefore has no share URL. The message names the exact call that fixes it.
- `default`: Any other error. Every failure this API emits uses the same envelope; branch on `error.type`, never on `error.message`, and quote `error.correlation_id` to support.

---

[API](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api.md) · [All operations](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api/revisions/28c74f46051c?raw)