---
title: "Revoke a share link"
method: DELETE
path: "/v1/assets/{asset_id}/share-links/{link_id}"
tags: ["assets"]
---

# Revoke a share link

`DELETE /v1/assets/{asset_id}/share-links/{link_id}`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/assets/{asset_id}/share-links/{link_id}`
- Auth: HTTP bearer

Shut one share link off. Takes effect immediately: the public URL answers 404 from the next request on. Revoking an already-revoked link is a no-op that returns it unchanged. It answers for a deleted file too, where removing the file already closed every open link. Answers 404 when the link does not exist or belongs to another workspace.

## Path parameters

- `asset_id` string, uuid, required: The asset's id.
- `link_id` string, uuid, required: The share link's id.

## Headers

- `X-Tenant-Id` string, nullable

## Response `200`

Successful Response

- AssetShareLinkInfo: One share link as the management view lists it — no token, ever. The token is shown exactly once, on creation; the server keeps only its hash, so this shape CANNOT carry it. A link works while BOTH dates say so: ``revoked_at`` null (nobody shut it off) and ``expires_at`` still ahead (it has not run out). The two are reported separately rather than collapsed into one "active" boolean because the screen has to say WHICH happened — a revoked link was a decision, an expired one just ran out, and only one of them is worth explaining as an accident.
  - `password_protected` boolean, required
  - `id` string, uuid, required
  - `created_at` string, date-time, required
  - `revoked_at` string, date-time, nullable: When this link was shut off, or null while it still works.
  - `expires_at` string, date-time, nullable: When this link stops working on its own. Null means it never does: either somebody created it with no end date, or it predates expiry entirely. Such a link is still revoked the moment somebody turns it off, deletes the file, or sets the file to 'Only me' — and a revoked link never comes back.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden. Inspect response body `code` for the specific reason (for example: PERMISSION_DENIED, EMAIL_NOT_VERIFIED, TENANT_ACCESS_REQUIRED, ROLE_UNRESOLVED)
- `404`: Not found
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)