Create the file's link

Mint the file's link. It is the file's ADDRESS and publishes nothing: who can open it stays whatever the file is set to, checked every time somebody opens it. A file set to 'Only me' gets a link only its author can open; a file set to 'My team' opens for members of this workspace after they sign in; a file set to 'Anyone with the link' opens for anybody with no sign-in. ONE exception, and it is about the FOLDER rather than the file: a file whose folder holds a live folder link is readable by anybody holding that folder's link, whatever the file's own level says, so asset_visibility on this answer can read 'private' for a file a stranger can already open. Change who can see a file on PUT /assets/{id}/visibility, which is a separate act with its own permission. The link shows the file's CURRENT version and works until it EXPIRES, is revoked, or the file is deleted (deleting revokes it, so a restore does not bring it back). A new link lasts 30 days unless the body says otherwise. Send expires_in_days: null for a link with NO end date, for something meant to stay reachable (a report linked from a website, a deck in a proposal); it still stops the moment anyone revokes it, deletes the file, or sets the file to 'Only me', and a revoked link never comes back. Asking again for a file YOU already have an open link for returns that same link and the same token (reused: true) instead of a second URL, so one link can be handed out once and go on serving the file's latest version; it consumes no new link slot, and its end date only ever moves further out, never nearer, and only when you are the file's author or a workspace admin or the file is already 'Anyone with the link'; otherwise the link comes back unchanged and deadline_moved is false. Reuse also requires the file's level to equal the recorded mint level, so a publish returns an external-minted URL. A team-minted URL is never reused for that publish. The recorded level also supplies the folder-share bound. Each existing live link follows the file's CURRENT visibility: widening opens existing links to anyone the file allows, and narrowing closes direct outside reads immediately. An external-minted file token can still open through a folder with a live folder link. Revoked and expired links stay closed; password-protected links still require their grant. Folder-share access keeps the token's minted-level bound, so a team-minted file token cannot open through somebody else's folder share. Reuse is per PERSON: it returns the link you created, so a colleague asking for the same file gets their own, and a caller with no actor on their membership always gets a new one. A revoked or expired link is never reused — minting again after either produces a new URL, and the closed one stays closed. The token is shown in API responses only; the server stores it as a hash plus an encrypted copy that only your own later ask can read, so revoke and mint again to get a DIFFERENT URL. Answers 404 when the file does not exist, has been deleted, or belongs to another workspace, or is a private file that is not yours.