---
title: "POST /secrets/{secret_uuid}/shares"
method: POST
path: "/secrets/{secret_uuid}/shares"
tags: ["Secrets"]
---

# POST /secrets/{secret_uuid}/shares

`POST /secrets/{secret_uuid}/shares`

## Request

- Base URL: `https://api.laver.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.laver.app/secrets/{secret_uuid}/shares`
- Auth: HTTP bearer

## Path parameters

- `secret_uuid` string, uuid, required

## Request body

- object
  - `user_uuid` string, uuid, required

## Response `2XX`

Success. This endpoint declares no response schema, so its body is not part of the generated contract.

## Other responses

- `400`: The request failed schema validation, or the handler rejected its contents. Undeclared properties are rejected on every body, path and query schema, so an unexpected field is a 400 rather than a silently ignored one.
- `401`: No credential, or one that is expired, revoked or not accepted by this endpoint.
- `404`: No such resource — or one the caller may not see. Membership and board access are enforced by answering 404 rather than 403, so a stranger never learns that a resource exists.
- `409`: The write lost a race, or collided with something that already exists. Where the resource carries optimistic concurrency the response body carries the current `version` alongside `error`, so the client can reconcile and retry without re-reading everything.
- `429`: The rate limit was exceeded. The budget is keyed on the authenticated session user or API key, falling back to the caller IP.

---

[API](https://skmtc.dev/laver/apis/laver-api.md) · [All operations](https://skmtc.dev/laver/apis/laver-api/llms.txt) · [OpenAPI document](https://skmtc.dev/laver/apis/laver-api/revisions/91e3db25a19c?raw)