---
title: "Unlock Shared Doc"
method: POST
path: "/api/doc/{slug}/unlock"
---

# Unlock Shared Doc

`POST /api/doc/{slug}/unlock`

## Request

- Base URL: `https://api.drillflow.de` (the document declares no server; this is the origin it was published from)
- URL: `https://api.drillflow.de/api/doc/{slug}/unlock`
- Auth: none declared

Hand over a password-protected document (C1). Deliberately no token and
no cookie: a reload asks again. Drill-down costs nothing extra — the whole
document is already in the reader's memory — so the only thing a session
would buy is skipping the prompt after a refresh, which is not worth a
second credential living in the browser.

Rate-limited per IP like the publish route, on top of argon2's own cost.

## Path parameters

- `slug` string, required

## Request body

- UnlockRequest: The password a reader types for a protected share (C1).
  - `password` string, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/drillflow/apis/drillflow-api.md) · [All operations](https://skmtc.dev/drillflow/apis/drillflow-api/llms.txt) · [OpenAPI document](https://skmtc.dev/drillflow/apis/drillflow-api/revisions/c892102e97b0?raw)