---
title: "Make one exported artifact public at an embeddable URL"
method: POST
path: "/preview/artifacts/{id}/shares"
tags: ["artifacts"]
---

# Make one exported artifact public at an embeddable URL

`POST /preview/artifacts/{id}/shares`

## Request

- Base URL: `https://autoresearch.sfcompute.com`
- URL: `https://autoresearch.sfcompute.com/preview/artifacts/{id}/shares`
- Auth: HTTP bearer

Make one exported artifact PUBLIC at a clean, embeddable URL - the way to put a file in front of a human in another tool. Where export_file's presigned URL is private, unwieldy, and only good for curl, the share URL (https://s.givemeanode.io/shr-.../cat1.jpg) carries the real filename, the real content type, and no query string: paste it in Slack and an image unfurls inline; <img src> works; browsers render rather than download. Returns {share_id, url, filename, content_type, size_bytes, expires_at}. The bytes are FROZEN at share time (a copy, so the link outlives the export's ~30-day object), the link lives 365 days by default (expires_after: "48h".."365d" chooses; re-sharing the same artifact refreshes the same URL's expiry), and unshare(share_id) revokes it any time - list_shares shows everything your org has public. ANYONE holding the URL can fetch the file: sharing is a deliberate, audited decision, never a default. Images, PDFs, video, audio, and plain text render inline; HTML and SVG never do (they download instead); anything else is a clean named download. Directory exports share as a .tar. Bounded per org in size, rate, and count (refusals name the limit).

## Path parameters

- `id` string, required: The art-... id of a READY artifact (from export_file, copy_file's export leg, get_job's output capture, or get_mission).

## Query parameters

- `workspace` string

## Request body

- object
  - `expires_after` string, nullable: How long the link lives, a duration like "48h" or "90d" (minimum 1h, default 365d, bounded by the share_ttl_days_max limit). The link dies at expiry; unshare kills it sooner.

## Response `200`

The capability's JSON result.

- Result: The capability's result: the same object the MCP tool returns as structuredContent. Resources carry an `object` type discriminator and an immutable id; money is integer micro-dollars in `*_usd_micros` fields.
  - `object` string: The resource type, when the result is one resource.

## Other responses

- `400`: Malformed request: bad JSON, a parameter that does not parse, or a value outside its range. Code `invalid`.
- `401`: No bearer token, or one this API cannot verify. Code `unauthenticated`.
- `403`: Authenticated, but the token's scopes or the account's role do not reach this operation. The message names the scope word to request. Code `forbidden`.
- `404`: No such route. Code `not_found`; the body names the OpenAPI document.
- `422`: A well-formed request the platform declined: no such node, a cap reached, a state that forbids the move. The message says which, and what to do instead. Code `refused`.
- `429`: Over this door's per-customer budget. Wait `Retry-After` seconds. Code `rate_limited`.
- `500`: Our fault. Retry; if it persists, quote the request-id. Code `internal`.

---

[API](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api.md) · [All operations](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/revisions/f88dcb70ac6c?raw)