---
title: "List a file's link variants"
method: GET
path: "/api/v1/files/{uuid}/variants"
tags: ["Variants"]
---

# List a file's link variants

`GET /api/v1/files/{uuid}/variants`

## Request

- Base URL: `https://everypage.co`
- URL: `https://everypage.co/api/v1/files/{uuid}/variants`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://everypage.co/oauth/authorize`, token URL `https://everypage.co/oauth/token`, scopes: `files:read`)

Every variant of the file, newest first - revoked and redacted ones included, so they can be managed here. Pro plan required; scope `files:read`.

## Response `200`

The file's variants

- object
  - `variants` Variant[]
    - `uuid` string, uuid
    - `shortId` string: The variant's own share-URL alias.
    - `url` string: The full shareable link (the owner's custom domain when one is verified).
    - `label` string: Recipient tag. Absent when never set - and, permanently, after redaction.
    - `overrides` VariantOverrides: Per-variant setting overrides applied to viewers arriving through this variant. Omitted keys inherit the file's settings. On update the object is stored exactly as sent (whole-object replace, never a per-key merge).
      - `allowDownload` boolean: Override the file's explicit-download permission for this variant's viewers.
      - `pageRange` PageRange: A non-owner page window, 1-based and inclusive. `{"from":0,"to":0}` is the explicit "no range" value (clears the file-level range; as a variant override it serves the full document through that variant).
        - `from` integer: First shared page (1-based).
        - `to` integer: Last shared page (inclusive; must be >= from).
    - `revoked` boolean: A revoked variant's link answers 404 to viewers until un-revoked.
    - `redactedAt` string, date-time: Present after GDPR redaction (the label is gone for good).
    - `createdAt` string, date-time

## Other responses

- `401`: No or invalid API key, OAuth token, manage token or claim token (code `missing_token` or `invalid_token`).
- `403`: Not the owner (code `forbidden`), an OAuth token missing the required scope (`insufficient_scope`, with a `WWW-Authenticate` challenge naming it), a feature above your plan (`plan_required`), a plan limit reached such as file slots or the per-file asset cap (`forbidden`), or - on the two manage-token operations - a token acting at the free tier on a plan-gated field.
- `404`: Unknown id, or a file you do not own on routes where 404 replaces 403 (code `not_found`).
- `429`: Over the limit - 120 requests per minute per Authorization value on /api/v1 (webhook test 10/min; the Canva lane 30/min per IP). Code `rate_limited`; wait for `Retry-After`.

---

[API](https://skmtc.dev/everypage/apis/everypage-api.md) · [All operations](https://skmtc.dev/everypage/apis/everypage-api/llms.txt) · [OpenAPI document](https://skmtc.dev/everypage/apis/everypage-api/revisions/e6674f903456?raw)