---
title: "Set who can view or edit a session"
method: PUT
path: "/api/sessions/{rootTaskId}/shares"
tags: ["Sessions"]
---

# Set who can view or edit a session

`PUT /api/sessions/{rootTaskId}/shares`

## Request

- Base URL: `http://localhost:3013`
- URL: `http://localhost:3013/api/sessions/{rootTaskId}/shares`
- Auth: HTTP bearer

Owner only. The body is the full desired state: users left out lose access. Changed targets have their active share revoked and a new one inserted in one transaction; shares are never deleted.

## Path parameters

- `rootTaskId` string, required

## Request body

- object
  - `everyone` 'none' | 'read' | 'write', required
  - `users` object[], required
    - `userId` string, required
    - `access` 'read' | 'write', required

## Response `200`

Active shares after the change

- SessionShares
  - `everyone` 'none' | 'read' | 'write', required
  - `users` object[], required
    - `userId` string, required
    - `access` 'read' | 'write', required
    - `createdAt` string, required

## Other responses

- `400`: Validation error or unknown user
- `401`: Unauthorized
- `403`: Only the session owner can share it
- `404`: Root task not found
- `409`: The session has no owner, so it is already open to everyone

## Changes

- **2026-10-19** `47fc2bbb7544`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/desplega-ai/apis/agent-swarm-api/changes/api/sessions/:rootTaskId/shares/put.md)

---

[API](https://skmtc.dev/desplega-ai/apis/agent-swarm-api.md) - [All operations](https://skmtc.dev/desplega-ai/apis/agent-swarm-api/llms.txt) - [OpenAPI document](https://skmtc.dev/desplega-ai/apis/agent-swarm-api/revisions/7e4c7198192a?raw)