---
title: "Create a link variant"
method: POST
path: "/api/v1/files/{uuid}/variants"
tags: ["Variants"]
---

# Create a link variant

`POST /api/v1/files/{uuid}/variants`

## Request

- Base URL: `https://everypage.co`
- URL: `https://everypage.co/api/v1/files/{uuid}/variants`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://everypage.co/oauth/authorize`, token URL `https://everypage.co/oauth/token`, scopes: `files:write`)

Mint a per-recipient child link for a file you own (Pro, `files:write`). The variant has its own 12-char short id and URL, an optional `label` (recipient name, GDPR-redactable) and `overrides` (`allowDownload`, `pageRange`). Views through it are attributed in readership and in `file.opened`/`file.viewed`/`file.downloaded` webhook payloads (`variantUuid`/`variantLabel`). Up to 200 variants per file.

Passwords and viewing gates are deliberately per-FILE, not per-variant: a viewer who passed the file's gate through one link has passed it for all of the file's links.

## Request body

- VariantCreate
  - `label` string: Optional recipient tag (shown in readership and webhook payloads; erasable via redaction).
  - `overrides` VariantOverrides: Per-variant setting overrides applied to viewers arriving through this variant. Omitted keys inherit the file's settings. On update the object is stored exactly as sent (whole-object replace, never a per-key merge).
    - `allowDownload` boolean: Override the file's explicit-download permission for this variant's viewers.
    - `pageRange` PageRange: A non-owner page window, 1-based and inclusive. `{"from":0,"to":0}` is the explicit "no range" value (clears the file-level range; as a variant override it serves the full document through that variant).
      - `from` integer: First shared page (1-based).
      - `to` integer: Last shared page (inclusive; must be >= from).

## Response `201`

Created

- Variant: A per-recipient child link of a file.
  - `uuid` string, uuid
  - `shortId` string: The variant's own share-URL alias.
  - `url` string: The full shareable link (the owner's custom domain when one is verified).
  - `label` string: Recipient tag. Absent when never set - and, permanently, after redaction.
  - `overrides` VariantOverrides: Per-variant setting overrides applied to viewers arriving through this variant. Omitted keys inherit the file's settings. On update the object is stored exactly as sent (whole-object replace, never a per-key merge).
    - `allowDownload` boolean: Override the file's explicit-download permission for this variant's viewers.
    - `pageRange` PageRange: A non-owner page window, 1-based and inclusive. `{"from":0,"to":0}` is the explicit "no range" value (clears the file-level range; as a variant override it serves the full document through that variant).
      - `from` integer: First shared page (1-based).
      - `to` integer: Last shared page (inclusive; must be >= from).
  - `revoked` boolean: A revoked variant's link answers 404 to viewers until un-revoked.
  - `redactedAt` string, date-time: Present after GDPR redaction (the label is gone for good).
  - `createdAt` string, date-time

## Other responses

- `400`: Invalid body, label too long, or variant limit (200) reached.
- `401`: No or invalid API key, OAuth token, manage token or claim token (code `missing_token` or `invalid_token`).
- `403`: Not the owner (code `forbidden`), an OAuth token missing the required scope (`insufficient_scope`, with a `WWW-Authenticate` challenge naming it), a feature above your plan (`plan_required`), a plan limit reached such as file slots or the per-file asset cap (`forbidden`), or - on the two manage-token operations - a token acting at the free tier on a plan-gated field.
- `404`: Unknown id, or a file you do not own on routes where 404 replaces 403 (code `not_found`).
- `413`: The upload (or the PDF a Word/PowerPoint file converted to) is above your plan's size cap - 20MB Free, 200MB Basic, 2GB Pro - or a JSON body is over its fixed cap (1MB for settings and hotspots, 64KB for variants and claims) (code `payload_too_large`).
- `429`: Over the limit - 120 requests per minute per Authorization value on /api/v1 (webhook test 10/min; the Canva lane 30/min per IP). Code `rate_limited`; wait for `Retry-After`.

---

[API](https://skmtc.dev/everypage/apis/everypage-api.md) · [All operations](https://skmtc.dev/everypage/apis/everypage-api/llms.txt) · [OpenAPI document](https://skmtc.dev/everypage/apis/everypage-api/revisions/e6674f903456?raw)