---
title: "Mint a partner link to one event's gallery"
method: POST
path: "/api/hack/photos/grant"
tags: ["hack"]
---

# Mint a partner link to one event's gallery

`POST /api/hack/photos/grant`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/hack/photos/grant`
- Auth: one of:
  - API key in cookie `__session`
  - HTTP bearer

Organiser-only (`hack:manage` plus a live organizer/event_admin role). A grant is a bearer credential to real people's faces, so minting one is a decision a person makes and not something an attendee can do for themselves. The token carries no identity and cannot be revoked individually - `subject` is recorded IN it so a leaked link can be traced back to who it was minted for, and the TTL is the actual containment (default 14 days, ceiling 90).

## Request body

- HackPhotoGrantRequest
  - `eid` string: Event id. Defaults to the current hackathon.
  - `subject` string, required: Who the link is for. Recorded IN the token so a leaked link can be traced back.
  - `ttl_days` integer: Default 14, ceiling 90. The TTL is the actual containment — a grant cannot be revoked individually.

## Response `200`

The minted link and its expiry.

- HackPhotoGrantResponse
  - `ok` boolean, required
  - `eid` string, required
  - `subject` string, required
  - `expires_at` string, date-time, required
  - `url` string, required: The gallery link to hand over. It carries the bearer token in its query string.

## Other responses

- `400`: Missing `subject`, or a ttl over the ceiling.
- `403`: Not an organiser for this event.
- `500`: Gallery links are not configured (no signing key).

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)