---
title: "Share Shortcut"
method: PATCH
path: "/api/v1/shortcuts/{id}/shares"
tags: ["Shortcuts"]
---

# Share Shortcut

`PATCH /api/v1/shortcuts/{id}/shares`

## Request

- Base URL: `http://localhost:3009`
- URL: `http://localhost:3009/api/v1/shortcuts/{id}/shares`
- Auth: HTTP bearer

Lets members of your organization use the shortcut, and stops letting others, in one call. It does not give access to the workflow behind it; share the workflow for that. To open it to the whole organization instead, set `visibility` to `org` with Update Shortcut.

Only the shortcut's creator can do this. You, and people in `add` who already have it, are reported in `data.skipped`; `data.failed` lists shares that could not be saved, so retry those. People in `remove` who did not have it are ignored. Read the current list from Get Shortcut (`shared_users`).

**Check what removed people keep.** They can still use the shortcut while it is visible to the whole organization (`data.organization_access_remains`) or while they can edit its workflow (`data.workflow_edit_access_remains` lists them). To fully revoke, also set `visibility` to `private` or unshare the workflow.

A refusal changes nothing; its `code` says why, and `emails` lists any refused addresses.

## Path parameters

- `id` string, required

## Request body

- object
  - `add` string[]: Email addresses to share with. They must be current members of your organization.
  - `remove` string[]: Email addresses to stop sharing with. Former members can be removed too.

## Response `200`

Default Response

- object
  - `status` integer
  - `message` string
  - `data` object
    - `shortcut_id` string
    - `shared_users` string[]: Everyone the shortcut is shared with, after this call.
    - `added` string[]: Newly shared with.
    - `skipped` string[]: You, and people who already had it.
    - `failed` string[]: Shares that could not be saved; retry them.
    - `removed` string[]: No longer shared with.
    - `organization_access_remains` boolean: The shortcut is visible to the whole organization, so removed people can still use it.
    - `workflow_edit_access_remains` string[]: Removed people who can still use it because they can edit its workflow.

## Other responses

- `400`: Bad Request — invalid body, or a refused change (`code` + `emails`)
- `401`: Unauthorized — missing or invalid API key
- `403`: Forbidden. `code` says which permission refused: ROLE_FORBIDDEN (your role), INSUFFICIENT_SCOPE (the API key's scopes), WORKFLOW_FORBIDDEN (no access to the workflow), KEY_WORKFLOW_FORBIDDEN (the API key's workflow restriction).
- `404`: Shortcut not found, archived, or not one you created
- `429`: Too Many Requests — rate limit exceeded. Check `Retry-After` header for seconds until the limit resets.

---

[API](https://skmtc.dev/floqer/apis/floqer-public-api.md) - [All operations](https://skmtc.dev/floqer/apis/floqer-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/floqer/apis/floqer-public-api/revisions/fce50dc07b20?raw)