---
title: "Create a password-protected share link for an item or collection."
method: POST
path: "/v1/op/share.link.create"
tags: ["kernel-ops"]
---

# Create a password-protected share link for an item or collection.

`POST /v1/op/share.link.create`

## Headers

- `x-api-key` string, nullable

## Request body

- ShareLinkCreate — Input for creating a share link.
  - `target_type` 'item' | 'collection', required
  - `target_id` string, required
  - `permission` 'view' | 'download'
  - `password` string, required — Plaintext password (will be bcrypt-hashed)
  - `expires_at` string, date-time, required

## Response `200`

Successful Response

- ShareLinkCreateOutput — Mirrors ShareLinkResponse on the wire, but created_by is Optional — a service-role principal has no human uuid, and the strict ShareLinkResponse (created_by: str) would 500 on that. Extra fields are IGNORED (NOT allow) — this is a security boundary: the service returns the full DB row including `password_hash`, and only the safe fields enumerated here may reach a client. (The first version used extra=allow and leaked the hash; a real test caught it.)
  - `id` string, required
  - `token` string, required
  - `target_type` string, required
  - `target_id` string, required
  - `permission` string, required
  - `organization_id` string, required
  - `project_id` string, required
  - `expires_at` string, date-time, required
  - `revoked_at` string, date-time, nullable
  - `access_count` integer
  - `last_accessed_at` string, date-time, nullable
  - `created_by` string, nullable
  - `created_at` string, date-time, required

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Validation Error
- `500` — Internal Server Error

---

[API](https://skmtc.dev/geopera/apis/geopera-data-platform.md) · [All operations](https://skmtc.dev/geopera/apis/geopera-data-platform/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/geopera/geopera-data-platform/revisions/cb0130b2a40a/schema)